Extracted

• • Target

    26c1324282afb5198d382a763f225043ddc1529782593e86c2a05a21fac64ba0

  • Size

    88KB

  • MD5

    1b861ed89fde0218d32826bda95a248f

  • SHA1

    dadf12128c0596715ae14c75b626e4c740259590

  • SHA256

    26c1324282afb5198d382a763f225043ddc1529782593e86c2a05a21fac64ba0

  • SHA512

    263b1b28d03225f45231e6e6b7925d1b484cd6630e9df651bd665c6deb29043789c514f80bead8edc93858368535f65f8d35ba3e27666efe33f36ae3195b503a

  • SSDEEP

    1536:iyehv7q2Pjx45uoDGTj+5xtekEvi8/dgL8EsAeE9jbDXQAWkWvgrPE4nWHPNc2At:iyehv7q2Pjx45uoDGTj+5xtekEvi8/da

  Score

  10^/10

  discoveryexecution

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1behavioral2