597e38bf0b93c924fa5e6d73938392c9be1f4670dc6db17adcce2c0a61303082

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 04:33

Target
redemption-bootstrapper-4.2.1.exe
Size 5.5MB
Sample260718-e6x4fabw9t
SHA256 597e38bf0b93c924fa5e6d73938392c9be1f4670dc6db17adcce2c0a61303082
MD5 0927117f24f7761c78fbe593c036ea9c
SHA1 b98ab1b42929de39043a55a83083e0ac129183b5
SHA512 3244e7e2500bd7d1a659ba0532f53d0e6d9ed5608d2b746964e2cce8a824fe4bd41603c7fe5bd2ca8d75b21870e4a816ed1ecfcefdd7ddfa14c83ffca7b31731
SSDEEP 49152:9Wpv/cs1Cx1GVrJ7O6JkmouOppgTocmJS0r2eEOpw0zTI9bbKJelrm0823eYIU66:9qv/cs1smo1w4EbNen+Pjl
TLSH
T101467D02BB47999DD05AC8B083468A638E2274DB0B36B5BF52C955393F6E7F05F1831E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4464	redemption-bootstrapper-4.2.1.exe

C:\Users\Admin\AppData\Local\Temp\redemption-bootstrapper-4.2.1.exe
"C:\Users\Admin\AppData\Local\Temp\redemption-bootstrapper-4.2.1.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:4464