1dd67d41b043e7be85deb2559130436a72cd05a4c20f39189fd81dba7f19bdc6

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 03:04

Target
redemption-bootstrapper-5.2.4.exe
Size 5.5MB
Sample260801-dkw4kscf96
SHA256 1dd67d41b043e7be85deb2559130436a72cd05a4c20f39189fd81dba7f19bdc6
MD5 cb770f6f11097f2e401326299f320bf1
SHA1 f787f00ee8d51665ec243af0790d44a79700d57a
SHA512 09ca0a0bfbaf7a6e587e3239395e5ac432862d62aebeeecd5f0cbc84e36cc6ec58d3177b69d2fc731a9070326ac39ba4cc7f5964947a17576bbcecf56b28e32b
SSDEEP 49152:0udZ+AGZFy2h+7w13e6y7mh/8gQ9LhFoh0b+N+331Gub9bbKJelrm0ezCYIU6i3J:xdgASewavFGObrn+3Vgt
TLSH
T119467D02BB87999DD05AC8B0C34686638E2274CB0B36B5BF56C955293F6E7F05F1831E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1488	redemption-bootstrapper-5.2.4.exe

C:\Users\Admin\AppData\Local\Temp\redemption-bootstrapper-5.2.4.exe
"C:\Users\Admin\AppData\Local\Temp\redemption-bootstrapper-5.2.4.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1864