Report Overview

  1. Visited public
    2025-02-27 17:42:00
    Tags
  2. URL

    github.com/massgravel/Microsoft-Activation-Scripts/archive/refs/heads/master.zip

  3. Finishing URL

    about:privatebrowsing

  4. IP / ASN
    140.82.121.4

    #36459 GITHUB

    Title
    about:privatebrowsing
Detections
urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
3

Domain Summary

Domain / FQDNRankRegisteredFirst SeenLast Seen
github.com14232007-10-092016-07-132025-02-26
codeload.github.com623592007-10-092013-04-182025-02-26
aus5.mozilla.org25481998-01-242015-10-272025-02-26

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected


OpenPhish

No alerts detected


PhishTank

No alerts detected


Quad9 DNS

No alerts detected


ThreatFox

No alerts detected


Files detected

  1. URL

    codeload.github.com/massgravel/Microsoft-Activation-Scripts/zip/refs/heads/master

  2. IP

    140.82.121.9

  3. ASN

    #36459 GITHUB

  1. File type

    Zip archive data, at least v1.0 to extract, compression method=store

    Size

    432 kB (432474 bytes)

  2. Hash

    107d33080bcdbf8256f5df898db9d725

    5f1c3d6acfd6b8d6fe722ebc6fdda9ace6d9e6ba

  1. Archive (15)

  2. FilenameMd5File type
    LICENSE
    1ebbd3e34237af26da5dc08a4e440464
    ASCII text
    MAS_AIO.cmd
    5b9a3cf1f44face6c7ba60b2f729a2d3
    ASCII text, with very long lines (348), with CRLF line terminators
    HWID_Activation.cmd
    bc2c3a225f3070b880018b0d6054883a
    DOS batch file, ASCII text, with very long lines (376), with CRLF line terminators
    KMS38_Activation.cmd
    494145b383ab4f6aeb0c94a93d3e02c9
    DOS batch file, ASCII text, with very long lines (500), with CRLF line terminators
    Ohook_Activation_AIO.cmd
    8f81c520e16e59afb2b285943ca013a2
    DOS batch file, ASCII text, with very long lines (452), with CRLF line terminators
    Online_KMS_Activation.cmd
    425b17143a00eae5296d6673c78ceea8
    DOS batch file, ASCII text, with very long lines (452), with CRLF line terminators
    TSforge_Activation.cmd
    54e55b0ffc28762c5f932cf061bf8fb6
    DOS batch file, ASCII text, with very long lines (348), with CRLF line terminators
    _ReadMe.txt
    3b8e1221690b7e303daf1c93f44d44aa
    ASCII text, with CRLF line terminators
    Change_Office_Edition.cmd
    9eeb2214c5c7aa04e65806ec62a6b9ba
    DOS batch file, ASCII text, with very long lines (453), with CRLF line terminators
    Change_Windows_Edition.cmd
    21c18a30a74c610c2c4a33ef043abad1
    DOS batch file, ASCII text, with very long lines (348), with CRLF line terminators
    Check_Activation_Status.cmd
    296e0e43b3cda4df264e26cdc0792799
    DOS batch file, ASCII text, with CRLF line terminators
    Extract_OEM_Folder.cmd
    6e1c9e5e925dd3a357e719b3c622639f
    DOS batch file, ASCII text, with very long lines (348), with CRLF line terminators
    Troubleshoot.cmd
    5b7c3b5fe140d706d22975d9faa7dab6
    DOS batch file, ASCII text, with very long lines (376), with CRLF line terminators
    _ReadMe.html
    574e18c1f9b32a47f988ac91588901ba
    HTML document, ASCII text, with CRLF line terminators
    README.md
    993bfda4f638b2ca35ee471f318ea1ad
    Unicode text, UTF-8 text

    Detections

    AnalyzerVerdictAlert
    Public Nextron YARA rulesmalware
    Detects suspicious PowerShell code that downloads from web sites
    Public Nextron YARA rulesmalware
    Detects suspicious PowerShell code that downloads from web sites
    VirusTotalsuspicious

JavaScript (0)

HTTP Transactions (3)

URLIPResponseSize
github.com/massgravel/Microsoft-Activation-Scripts/archive/refs/heads/master.zip
140.82.121.3302 Found0 B
codeload.github.com/massgravel/Microsoft-Activation-Scripts/zip/refs/heads/master
140.82.121.9200 OK432 kB
aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.41%2Clibpulse%20not-available)/default/default/update.xml
35.244.181.201200 OK444 B