Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/08/2026, 14:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe
- Size 276KB
- Sample260812-rbfxwsdb29
- SHA256 ccad669ad6c825bbd3209464e747f83e740507ad848eaed4e26d1d5a33fb8ca7
- MD5 faea60fa8d5f03e70cd32e5405455a38
- SHA1 13d4061b03ce5fbec669a93ea462ca5aeb55f871
- SHA512 fc850adaeeaa565c65d65d5e1e974ab8aa8ac2f2bfc0136d8062cb7af2889a13283d4351e7e36bcaa7e2710f470db7fb91447a43ed2a5b8914c3448e5feb9cb4
- SSDEEP 6144:eSNEs9M2RC/FrNuEfM8gqzgoe4vEb8SZ9P6JYEYk9z:e6Es9tRC/1Nhk8gvoe48p9Pcx9z
- TLSH T154549D4E77A44CF2E5638178CA6597B2F7B2B9A51E10CB0F1261C7AF2F23560AC2C751
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened (read-only) \??\K: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened (read-only) \??\O: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened (read-only) \??\U: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened (read-only) \??\W: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened (read-only) \??\Y: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened (read-only) \??\Z: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened (read-only) \??\B: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened (read-only) \??\E: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened (read-only) \??\J: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened (read-only) \??\L: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened (read-only) \??\N: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened (read-only) \??\Q: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened (read-only) \??\R: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened (read-only) \??\T: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened (read-only) \??\G: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened (read-only) \??\H: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened (read-only) \??\M: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened (read-only) \??\P: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened (read-only) \??\S: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened (read-only) \??\V: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened (read-only) \??\X: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened (read-only) \??\A: 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files (x86)\Windows Media Player\setup_wm.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86218\javaws.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.54\elevated_tracing_service.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-12_faea60fa8d5f03e70cd32e5405455a38_mespinoza.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
- Size 1.7MB
- SHA256 e0a0cf73f66832af5c543835043f4e7d8127967777340043eae8c5006f0e895d
- MD5 13d7bffedd2b5e571aa2581425470fd8
- SHA1 051bede49cd0af5708225703ec4b5406e3b989b5
- SHA512 b4a4f50622aa02209be6c8e15be94f7fa63912fd421c00fe00ded79034bb474e5ff8d6804d6c489fa23fcf7b6493a219cf861f9663503b406da19383d8bab0f5
- SSDEEP 24576:kpc3AFk61+vvV737huB8sKoZhyiRsBb9keQuJXlPnyF4mfHU9YawsNW+oAaumq7Y:kkQuIvKoZAiRsxWeHX04mfHIWvHuB7Y
- TLSH T1EA858B03F2D901E8E06DD2B8C7468532EAB27C450B34A6DF0691B6562F7BEE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
- Size 4.1MB
- SHA256 b33448585521e375a7d329e1d073fada6a9bbf1cb5b6a6563b466efee00f77d4
- MD5 00b0e1fad31802871664edf6381e8ae9
- SHA1 84c680d48685555f7ca5e6abe64b5c3a9c9c8e14
- SHA512 64a7264c29a233fbb5ec0237bf46972f5ae22447559432a4b60c1a985077a54d128aa71a7dcf1e357e0a7034caf30b86b9d8f3d78a46f875be72e2bea494319c
- SSDEEP 49152:Du1Sv+fxSnBtyq35TEJXjPf7+TjE9zExldDwUIDtaZHWRdpev2y/BaUd:XuMvIjbqd+RaAo
- TLSH T171165903B29940D8D049D074CE5AD232AB617C8D47F162EF3690B7EA2A73AD47B3DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
- Size 1.6MB
- SHA256 cfc6cfbc2d83a7f5f1eccf66351e3b367ec375d02ec072449ee0fc3408496a75
- MD5 ce44579fd7c6e51200423a44bec410d0
- SHA1 06cb34f6954ac2f675806870932e6da2bfa79735
- SHA512 dcd06839b78324d2e2b5526804ae5e5b5660160f9b72a79bb1efbe53ca7a936766121da791352f275ec8a129ed442119f20ea7206b4150441626836b06a78b05
- SSDEEP 24576:pU5QcL6kxJHczRDGkXu9xGNjFkQwqkWvL1oaedpEukUoygGmq/Sv59wA:pBcLZjH6IRxGNZkDq9vBo7EukU14N
- TLSH T1FE759D03F3D801E8E069D1B8C7568536EAB27C450B24A6EF0A90B6552E7BFE45F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
- Size 1.5MB
- SHA256 ad130254367dcd3584ca4f22b0f9c68076772dfc40b938e3fccb47a2353f1119
- MD5 fd77c8f93ab27be44039feced8ea6261
- SHA1 1a30a795f4b69ed12bcc59e4ad4a271492968f3d
- SHA512 d6741e35e73b2809ad1e106a28c332f32c6d18f1469691ca0cd13aac092c0d8b280480c553fbf371723559b15a6ee74e11f551ac0e107228daeae0bfe9df8892
- SSDEEP 24576:3wSUxj60Gj2CO993QurRXu8pnFy64GsVa4i6h27d3WlCpNhVY/:gRxjT0C/7RXu8pnwln+6h27dfNe
- TLSH T11B759D03F39940E8E05DD1B8C756893AE9A27C450B34A6EF0B90B6552F7BEE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH