URL:

https://objects.githubusercontent.com/github-production-release-asset-2e65be/660441027/3bd754fa-af38-43ae-af5d-118b6e11c629?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230715%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230715T010751Z&X-Amz-Expires=300&X-Amz-Signature=56f57e54d28f69c91c3328916be79ea4ce859fc2616cb8c139319265951e9a8f&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=660441027&response-content-disposition=attachment%3B%20filename%3DDevboxlab.zip&response-content-type=application%2Foctet-stream

Full analysis: https://app.any.run/tasks/a44e3cca-57f1-4966-8f58-009df17f513c
Verdict: Malicious activity
Analysis date: July 15, 2023, 01:08:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

84EA01025A7A1888E7E862C8FBCF0D54

SHA1:

2304E806F4D8A725643F7AF2F8F749BA8E7965D7

SHA256:

1552C1E143FBD50E8CE9FE6DE30CB41CB2A381E3124B5484733E6833773636F9

SSDEEP:

12:28aMGmbk9Lvttsq9AA4BRNcSJ3TAFReOIZoX9TUF/LVnAIn:23MGmoJt9HuR/UFRTXUF/xAIn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Devboxlab.exe (PID: 1388)
      • javaw.exe (PID: 696)
      • Devboxlab.exe (PID: 2412)
      • Devboxlab.exe (PID: 1364)
      • Devboxlab.exe (PID: 1912)
      • javaw.exe (PID: 2252)

    • Loads dropped or rewritten executable

      • Devboxlab.exe (PID: 2412)
      • javaw.exe (PID: 696)
      • Devboxlab.exe (PID: 1912)
      • javaw.exe (PID: 2252)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • javaw.exe (PID: 696)
      • javaw.exe (PID: 2252)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2144)
      • cmd.exe (PID: 1376)
      • cmd.exe (PID: 2664)
      • cmd.exe (PID: 3180)
      • cmd.exe (PID: 3500)
      • cmd.exe (PID: 3524)

    • Uses WMIC.EXE to obtain a list of video controllers

      • cmd.exe (PID: 1376)
      • cmd.exe (PID: 3500)

    • Reads the Internet Settings

      • WMIC.exe (PID: 4072)
      • WMIC.exe (PID: 288)
      • WMIC.exe (PID: 3720)
      • WMIC.exe (PID: 2716)

    • Uses WMIC.EXE to obtain Sound Devices data

      • cmd.exe (PID: 2664)
      • cmd.exe (PID: 3524)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3348)
      • msedge.exe (PID: 1228)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3348)
      • WinRAR.exe (PID: 1148)

    • The process checks LSA protection

      • SearchProtocolHost.exe (PID: 3112)
      • javaw.exe (PID: 696)
      • WMIC.exe (PID: 4072)
      • WMIC.exe (PID: 288)
      • javaw.exe (PID: 2252)
      • WMIC.exe (PID: 3720)
      • WMIC.exe (PID: 2716)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1148)

    • Checks supported languages

      • javaw.exe (PID: 696)
      • Devboxlab.exe (PID: 2412)
      • chcp.com (PID: 1364)
      • chcp.com (PID: 3968)
      • more.com (PID: 4076)
      • chcp.com (PID: 2948)
      • more.com (PID: 444)
      • Devboxlab.exe (PID: 1912)
      • javaw.exe (PID: 2252)
      • chcp.com (PID: 2524)
      • chcp.com (PID: 1576)
      • more.com (PID: 2576)
      • chcp.com (PID: 2512)
      • more.com (PID: 1916)

    • Manual execution by a user

      • Devboxlab.exe (PID: 2412)
      • Devboxlab.exe (PID: 1388)
      • Devboxlab.exe (PID: 1364)
      • Devboxlab.exe (PID: 1912)

    • Reads the machine GUID from the registry

      • javaw.exe (PID: 696)
      • javaw.exe (PID: 2252)

    • Create files in a temporary directory

      • javaw.exe (PID: 696)
      • javaw.exe (PID: 2252)

    • Reads the computer name

      • javaw.exe (PID: 696)
      • javaw.exe (PID: 2252)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
96
Monitored processes
43
Malicious processes
5
Suspicious processes
4

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe ie_to_edge_stub.exe no specs ie_to_edge_stub.exe no specs ie_to_edge_stub.exe no specs ie_to_edge_stub.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe searchprotocolhost.exe no specs devboxlab.exe no specs devboxlab.exe javaw.exe no specs cmd.exe no specs chcp.com no specs reg.exe no specs cmd.exe no specs chcp.com no specs wmic.exe no specs more.com no specs cmd.exe no specs chcp.com no specs wmic.exe no specs more.com no specs devboxlab.exe no specs devboxlab.exe javaw.exe no specs cmd.exe no specs chcp.com no specs reg.exe no specs cmd.exe no specs chcp.com no specs wmic.exe no specs more.com no specs cmd.exe no specs chcp.com no specs wmic.exe no specs more.com no specs

Process information

PID
CMD
Path
Indicators
Parent process
288C:\Windows\System32\wbem\wmic.exe Sounddev Get /Format:List C:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\lpk.dll
444C:\Windows\System32\more.comC:\Windows\System32\more.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
More Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\more.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\ulib.dll
696"C:\Users\admin\Desktop\Devboxlab\.\resources\bin\javaw.exe" -jar "C:\Users\admin\Desktop\Devboxlab\Devboxlab.exe"C:\Users\admin\Desktop\Devboxlab\resources\bin\javaw.exe—Devboxlab.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.1010.13
Modules
Images
c:\users\admin\desktop\devboxlab\resources\bin\javaw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1148"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\Devboxlab.zip"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1228"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=20138C:\Program Files\Microsoft\Edge\Application\msedge.exe
ie_to_edge_stub.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
1364C:\Windows\System32\chcp.com 65001 C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Change CodePage Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1364"C:\Users\admin\Desktop\Devboxlab\Devboxlab.exe" C:\Users\admin\Desktop\Devboxlab\Devboxlab.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
DevBoxLab: Downloading programs
Exit code:
3221226540
Version:
1.1.0.6
Modules
Images
c:\users\admin\desktop\devboxlab\devboxlab.exe
c:\windows\system32\ntdll.dll
1376C:\Windows\System32\cmd.exe /c "C:\Windows\System32\chcp.com 866>nul & C:\Windows\System32\wbem\wmic.exe Path Win32_VideoController Get AdapterRAM /Format:List | C:\Windows\System32\more.com"C:\Windows\System32\cmd.exe—javaw.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1388"C:\Users\admin\Desktop\Devboxlab\Devboxlab.exe" C:\Users\admin\Desktop\Devboxlab\Devboxlab.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
DevBoxLab: Downloading programs
Exit code:
3221226540
Version:
1.1.0.6
Modules
Images
c:\users\admin\desktop\devboxlab\devboxlab.exe
c:\windows\system32\ntdll.dll
1392"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6d60f598,0x6d60f5a8,0x6d60f5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
Total events
22 003
Read events
21 890
Write events
112
Delete events
1

Modification events

(PID) Process:(3348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3348) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
111
Suspicious files
53
Text files
130
Unknown types
1

Dropped files

PID
Process
Filename
Type
1228msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
1228msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF21f1a2.TMP —
MD5:—
SHA256:—
1228msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
1228msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF21f1d1.TMP —
MD5:—
SHA256:—
3368iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
1228msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:E5EC9DB87108491C5B2186506C30BFC3
SHA256:E8A4B35C7D5E194D1505E146CB6A77FE1C05866A744F9AA6C0E4E62D62558FBC
1228msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datbinary
MD5:A2B913D3BC9B6344C76B056712064197
SHA256:CC7E7F39A2B36FFD7D6EC45A4AA70BFB8DBEBC58EEB784D08218B0036D3AD564
3368iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:E5DD2C64F76BF6FC010BB34002D4258F
SHA256:47506FDB2C76517ACCE7320150411FAB1775C8265B7E7EFB227073A93B93A1A1
1392msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics.pmabinary
MD5:886E82F2CA62ECCCE64601B30592078A
SHA256:E5E13D53601100FF3D6BB71514CBCCC4C73FE9B7EF5E930100E644187B42948E
1228msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Local State~RF21eea5.TMPtext
MD5:9C53ABE3CDB5F41FAF133E9BD33EC2FD
SHA256:E333A5F3CA496C28600A300F0023F4602FB2D3FAC482CB7997C8C0F62BD716B3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
46
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3348
iexplore.exe
GET
304
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?086bb8379a1b162b
US
—
—
whitelisted
3368
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0a258cf158d0b170
US
compressed
4.70 Kb
whitelisted
3368
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7a2ddfa7854568a4
US
compressed
4.70 Kb
whitelisted
3368
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?023cb48ad2f34464
US
compressed
4.70 Kb
whitelisted
3368
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
3348
iexplore.exe
GET
200
192.229.221.95:80
http://crl3.digicert.com/Omniroot2025.crl
US
der
7.78 Kb
whitelisted
3348
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
binary
471 b
whitelisted
3368
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?522ea457cb308c1a
US
compressed
4.70 Kb
whitelisted
3348
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1068
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3368
iexplore.exe
185.199.108.133:443
—
FASTLY
US
malicious
3368
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
3368
iexplore.exe
23.56.204.161:443
go.microsoft.com
AKAMAI-AS
GB
unknown
2640
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3368
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3348
iexplore.exe
184.86.251.27:443
www.bing.com
Akamai International B.V.
DE
suspicious
1228
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 23.56.204.161
whitelisted
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 184.86.251.27
  • 184.86.251.22
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
config.edge.skype.com
  • 13.107.42.16
malicious
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
  • 152.199.21.175
whitelisted
crl3.digicert.com
  • 192.229.221.95
whitelisted
crl4.digicert.com
  • 192.229.221.95
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://objects.githubusercontent.com/github-production-release-asset-2e65be/660441027/3bd754fa-af38-43ae-af5d-118b6e11c629?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAIWNJYAX4CSVEH53A%2F20230715%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20230715T010751Z&X-Amz-Expires=300&X-Amz-Signature=56f57e54d28f69c91c3328916be79ea4ce859fc2616cb8c139319265951e9a8f&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=660441027&response-content-disposition=attachment%3B%20filename%3DDevboxlab.zip&response-content-type=application%2Foctet-stream