db8f17e83555cbcc559fe53c1de7d7a5f71ad31d82871174f492cb5705768364

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 13:48

Target
nfa.exe
Size 12.9MB
Sample260602-q34mlaey2w
SHA256 db8f17e83555cbcc559fe53c1de7d7a5f71ad31d82871174f492cb5705768364
MD5 5dc44df5c65903f73762f4557e8e6265
SHA1 da3c9e82187ffe28e8e7ed51f3f39aaebef848f7
SHA512 0da38393aa033135bacc211424a56b65f9ab15eecdb2f832324c49d777c9c666fae0c3b0e386225a8acf252c60b56899e661a84c86566fcf9164acc7374b2c2f
SSDEEP 98304:5jt0wdlBoNuffH7SbFm/RLT0BvnUFjabNXram4wGG+kp4QbqK+ufbjBKH1P:NtD/uwH79ELb/pZZUK
TLSH
T102D67B12BB5A99ACC45AC4B0835A86736A3174CB0B35B9FF45C486383F69AF01F3C759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4872	nfa.exe

C:\Users\Admin\AppData\Local\Temp\nfa.exe
"C:\Users\Admin\AppData\Local\Temp\nfa.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:4872