Report - github.com/massgravel/Microsoft-Activation-Scripts/archive/refs/heads/master.zip

Report Overview

Visited public
2025-05-05 22:28:20
Tags
URL
github.com/massgravel/Microsoft-Activation-Scripts/archive/refs/heads/master.zip
Finishing URL
about:privatebrowsing
IP / ASN
140.82.121.3
#36459 GITHUB
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
github.com	1423	unknown	No data	No data	548 B	472 kB	140.82.121.4
codeload.github.com	62359	unknown	No data	No data	549 B	469 kB	140.82.121.9

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
codeload.github.com/massgravel/Microsoft-Activation-Scripts/zip/refs/heads/master
IP
140.82.121.9
ASN
#36459 GITHUB

File type
Zip archive data, at least v1.0 to extract, compression method=store
Size
468 kB (468015 bytes)
Hash
698edcbdc8d8dd876a222fe7ab25306a
fe1ecd500fc9452296ff0565b696ccd1d50edab9
f0c7948b4d630f83b31697a5c14a5db3b0a745d23199b170543ba5f8088980e3

Archive (15)

Filename

Md5

File type

LICENSE

1ebbd3e34237af26da5dc08a4e440464

ASCII text

MAS_AIO.cmd

024a2daaf69a70d6afc131fcba9a4462

ASCII text, with very long lines (348), with CRLF line terminators

HWID_Activation.cmd

45c224666a74587514820f9fd9941ea7

DOS batch file, ASCII text, with very long lines (376), with CRLF line terminators

KMS38_Activation.cmd

47ac3a96b5865642c225f8362b58e07c

DOS batch file, ASCII text, with very long lines (500), with CRLF line terminators

Ohook_Activation_AIO.cmd

63206323f888efd68cacfe3c478ddb02

DOS batch file, ASCII text, with very long lines (452), with CRLF line terminators

Online_KMS_Activation.cmd

09f8ee31582ca018ad76a4f54b2d34c7

DOS batch file, ASCII text, with very long lines (452), with CRLF line terminators

TSforge_Activation.cmd

02b0e0fbe9e2dfc9df5e204d296b47c5

DOS batch file, ASCII text, with very long lines (348), with CRLF line terminators

_ReadMe.txt

e699451ed0dfe4ebdd499666dc411c3c

ASCII text, with CRLF line terminators

Change_Office_Edition.cmd

32cf54077924ed7405954dcdd1abef33

DOS batch file, ASCII text, with very long lines (453), with CRLF line terminators

Change_Windows_Edition.cmd

4f60d72c2015c1dfb156f81334b16b39

DOS batch file, ASCII text, with very long lines (348), with CRLF line terminators

Check_Activation_Status.cmd

456851be659b8b759ce8b69e0e72312c

DOS batch file, ASCII text, with very long lines (379), with CRLF line terminators

Extract_OEM_Folder.cmd

589ffe8d95c59838c2ee616cdbe91999

DOS batch file, ASCII text, with very long lines (348), with CRLF line terminators

Troubleshoot.cmd

480f8acb42e3ebac8627d9afeec20cd1

DOS batch file, ASCII text, with very long lines (376), with CRLF line terminators

_ReadMe.html

574e18c1f9b32a47f988ac91588901ba

HTML document, ASCII text, with CRLF line terminators

README.md

4cf2df0bec7061577e6850f347c6b0c1

Unicode text, UTF-8 text

Detections

Analyzer	Verdict	Alert
Public Nextron YARA rules	malware	Detects suspicious PowerShell code that downloads from web sites
Public Nextron YARA rules	malware	Detects suspicious PowerShell code that downloads from web sites

JavaScript (0)

HTTP Transactions (2)

	URL	IP	Response	Size
	github.com/massgravel/Microsoft-Activation-Scripts/archive/refs/heads/master.zip	140.82.121.4	302 Found	468 kB
URL User Request GET github.com/massgravel/Microsoft-Activation-Scripts/archive/refs/heads/master.zip IP 140.82.121.4:443 ASN #36459 GITHUB Certificate IssuerSectigo Limited Subjectgithub.com FingerprintE4:33:71:DD:D6:91:4A:75:B6:1F:9E:4F:74:6D:9B:F0:DD:26:FC:3A ValidityWed, 05 Feb 2025 00:00:00 GMT - Thu, 05 Feb 2026 23:59:59 GMT File type Size 468 kB (468015 bytes) Hash d41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 HTTP Headers GET /massgravel/Microsoft-Activation-Scripts/archive/refs/heads/master.zip HTTP/1.1 Host: github.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/2 302 Found date: Mon, 05 May 2025 22:27:47 GMT content-type: text/html; charset=utf-8 content-length: 0 vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame,Accept-Encoding, Accept, X-Requested-With location: https://codeload.github.com/massgravel/Microsoft-Activation-Scripts/zip/refs/heads/master cache-control: max-age=0, private strict-transport-security: max-age=31536000; includeSubdomains; preload x-frame-options: deny x-content-type-options: nosniff x-xss-protection: 0 referrer-policy: no-referrer-when-downgrade content-security-policy: default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com .rel.tunnels.api.visualstudio.com wss://.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com .actions.githubusercontent.com wss://.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/ server: github.com x-github-request-id: A073:2228D:67619B1:6A023BB:68193B63 X-Firefox-Spdy: h2

	codeload.github.com/massgravel/Microsoft-Activation-Scripts/zip/refs/heads/master	140.82.121.9	200 OK	468 kB
URL User Request GET codeload.github.com/massgravel/Microsoft-Activation-Scripts/zip/refs/heads/master IP 140.82.121.9:443 ASN #36459 GITHUB Certificate IssuerSectigo Limited Subject.github.com Fingerprint7A:96:66:B4:C7:AA:A7:7E:A1:CD:48:AF:0B:3D:0F:BF:60:60:4F:B2 ValidityWed, 05 Feb 2025 00:00:00 GMT - Thu, 05 Feb 2026 23:59:59 GMT File type Zip archive data, at least v1.0 to extract, compression method=store Size 468 kB (468015 bytes) Hash 698edcbdc8d8dd876a222fe7ab25306a fe1ecd500fc9452296ff0565b696ccd1d50edab9 f0c7948b4d630f83b31697a5c14a5db3b0a745d23199b170543ba5f8088980e3 HTTP Headers GET /massgravel/Microsoft-Activation-Scripts/zip/refs/heads/master HTTP/1.1 Host: codeload.github.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/2 200 OK access-control-allow-origin: https://render.githubusercontent.com content-disposition: attachment; filename=Microsoft-Activation-Scripts-master.zip content-length: 468015 content-security-policy: default-src 'none'; style-src 'unsafe-inline'; sandbox content-type: application/zip cross-origin-resource-policy: cross-origin etag: W/"51fb17c9c26533a514091f8a05ec8d063b28351662c0e6420053d738b7680a07" strict-transport-security: max-age=31536000 vary: Authorization,Accept-Encoding,Origin x-content-type-options: nosniff x-frame-options: deny x-xss-protection: 1; mode=block date: Mon, 05 May 2025 22:27:47 GMT x-github-request-id: 39E5:2807B8:4B6E8:63948:68193B63 X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (15)

Detections

JavaScript (0)

HTTP Transactions (2)

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers