Extracted

• • Target

    d7bca44cd6f3a32f3d147e1af282dc6be882b6c5084ec2a91fb420d225ad3819

  • Size

    88KB

  • MD5

    315de88b5298e932d09d1238bd3b91d6

  • SHA1

    a55676faa0bd96950941fa9bc3be931abf51844b

  • SHA256

    d7bca44cd6f3a32f3d147e1af282dc6be882b6c5084ec2a91fb420d225ad3819

  • SHA512

    9fa9d92944b856e21fc31f6a314bcf4811debc552868a3455bcd0ea2337e89bfc86f5e90b24979d930d208d4e8729490cb78a0f2db4998c5cf4732b6a27f1de5

  • SSDEEP

    1536:Ayehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQAekWvgrPE4nWHPNc2AB:Ayehv7q2Pjx45uoDGTj+5xtekEvi8/da

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2