How To Collect Malware Indicators Of Compromise In The ANY.RUN Sandbox

This document explains how the ANY.RUN sandbox supports threat analysis by safely executing suspicious files/URLs and capturing comprehensive indicators of compromise—including network connections, DNS/HTTP requests, dropped files, registry modifications, hashes, domains/IPs, and C2 configuration via MalConf—consolidated in a centralized IOC view with filtering and one-click export for streamlined investigation and defense.