Extracted

• • Target

    262e7dbbdb91878827837b289db207d9bfb548e9b3f9775e9e16532cc51c4e82

  • Size

    88KB

  • MD5

    4a6069ce4a670a2303b469f975d37862

  • SHA1

    cd3a566a0da0566510cfe000444382e3e46d1615

  • SHA256

    262e7dbbdb91878827837b289db207d9bfb548e9b3f9775e9e16532cc51c4e82

  • SHA512

    63531950c098bfb763dc02cdfa7a0b5aa57ea8a320218bc875ec62f5a69a9535b950910d35b11bc191c9b3e613240e9b1625039f1e89af308fc00cc62a2f8743

  • SSDEEP

    1536:Xyehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQAYskWvgrPE4nWHPNc2G:Xyehv7q2Pjx45uoDGTj+5xtekEvi8/dh

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2