20b99a9c4fd24d4389d7a5b8d687d27e6adb2891438aa713bd808dad8cf0d2dd

Resubmissions

23/09/2026, 19:43

23/09/2026, 19:40

geolocation tags

cacanadananorth-americatoronto
max time kernel
899s
max time network
453s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/09/2026, 19:40

Target
ultrakill-save-editor.exe
Size 4.2MB
Sample260923-ydtp4abc57
SHA256 20b99a9c4fd24d4389d7a5b8d687d27e6adb2891438aa713bd808dad8cf0d2dd
MD5 04d4dc1a23c0ccbab7d4903e3c8da582
SHA1 5cc7b047579298fb6519187f43b15d82d5b64116
SHA512 35e2ce282243e806126fd90fe1f4ca3ed08918c5cd4791c356e41e540b501df7a67a1c687b5774a9f9bcf5a68758de3462e47f06387a98639a6f359f4ecfef65
SSDEEP 49152:5S3QSzC3RdXQNOLfrzQjyNfDxBPigMtGUCgoz68x9GwkLzQ0B9bVroKJeq0NAiLL:8EHVxWQSbwAiLL
TLSH
T138168E02B7479AADC01BC474834656235E72B8CA0B35BEFF16C465383E6AAF05F39359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3808	ultrakill-save-editor.exe

C:\Users\Admin\AppData\Local\Temp\ultrakill-save-editor.exe
"C:\Users\Admin\AppData\Local\Temp\ultrakill-save-editor.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:3808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2764

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1628