Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 11:42

General

  • Target
    2026-08-08_7d1f041599690eaa820fe3c5eae7e5b0_mespinoza.exe
  • Size 276KB
  • Sample260808-nt5geswckd
  • SHA256 ea81ddd86f4d32b66792828b14d110311e0bb44434fa829dfbd5b23d86a3ecc2
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Family: Azov

    A wiper seeking only damage, first seen in 2022.

  • Renames multiple (10707) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_7d1f041599690eaa820fe3c5eae7e5b0_mespinoza.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_7d1f041599690eaa820fe3c5eae7e5b0_mespinoza.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    PID:1160
  • C:\ProgramData\rdpclient.exe
    C:\ProgramData\rdpclient.exe
    1⤵
    • Creates a file in the Startup directory
    • Executes dropped EXE
    • Enumerates connected drives
    • Drops file in Program Files directory
    PID:2272

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        PlayStore_icon.svg

        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\PlayStore_icon.svg
        • Size 6KB
        • SHA256 5ea4dcd73109f18b19bdccefde457b9936e96a145bc774b352c98a89f0a2f9a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7-zip.chm.azov

        • Path C:\Program Files\7-Zip\7-zip.chm.azov
        • Size 117KB
        • SHA256 8c5b74ae9a9d823561771d4f52c1a018e7e5a3457120ab9ea1c07b7b931c56ef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7z.exe

        • Path C:\Program Files\7-Zip\7z.exe
        • Size 672KB
        • SHA256 967f2c6bac2ee95c2f0df2598e5a67b6aae2fd706e85672f4ea2c1f661bfd462
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7z.sfx.azov

        • Path C:\Program Files\7-Zip\7z.sfx.azov
        • Size 210KB
        • SHA256 bc8c140404c3aff02785ac431dca9abeed8546b411f7d8e427a95fb47df14573
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zCon.sfx.azov

        • Path C:\Program Files\7-Zip\7zCon.sfx.azov
        • Size 189KB
        • SHA256 e2ebc7af579a03d0305baed867c38d0af28a94f9faa124ac29bba454aab32a1a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zFM.exe

        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 1.1MB
        • SHA256 8ce0233820f4c0d08d101befbadab61f733799c179419285c1dfef6dacf87162
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 840KB
        • SHA256 3535efb3613b9d49592a5d89bc51e68b035e961b995dcfc00433495c73a48809
        • MD5 SHA1 SHA512 SSDEEP TLSH

        History.txt.azov

        • Path C:\Program Files\7-Zip\History.txt.azov
        • Size 7KB
        • SHA256 76e9b30aeb8d2ac80eda03d2771e44dbae7f4c6b50aee267a491b01729081a7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RESTORE_FILES.txt

        • Path C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt
        • Size 2KB
        • SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
        • MD5 SHA1 SHA512 TLSH

        af.txt.azov

        • Path C:\Program Files\7-Zip\Lang\af.txt.azov
        • Size 4KB
        • SHA256 50b58e3107b378240c734647968bfee68e4fff9626daf68524985a99bc6c5a31
        • MD5 SHA1 SHA512 SSDEEP TLSH

        an.txt.azov

        • Path C:\Program Files\7-Zip\Lang\an.txt.azov
        • Size 7KB
        • SHA256 4b6626d6df8370d9b9c0433a1ca90b76069b7e08fa7212b3ffb472531eda4393
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ar.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ar.txt.azov
        • Size 12KB
        • SHA256 1abc19db7f6ad987699559963ff6165655fa039e334872b8b10d59816672479e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ast.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ast.txt.azov
        • Size 4KB
        • SHA256 ed30ca148439a5d1acf726d51d8f931a8c167fa4877efcda923c638e15e70878
        • MD5 SHA1 SHA512 SSDEEP TLSH

        az.txt.azov

        • Path C:\Program Files\7-Zip\Lang\az.txt.azov
        • Size 10KB
        • SHA256 8ca7137e2f0ee9e0a4e9c70f64330dbfd4603b68c28599d363a20fa773136c48
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ba.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ba.txt.azov
        • Size 11KB
        • SHA256 8dca5eeb81329df8e6f322836364bf6627e0e3943c1efa9ec0da9fa6648f6655
        • MD5 SHA1 SHA512 SSDEEP TLSH

        be.txt.azov

        • Path C:\Program Files\7-Zip\Lang\be.txt.azov
        • Size 11KB
        • SHA256 4e8e70bffc787c11606c428cf41f35f5778a1f1957fe06261d64e02e8fdcccad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bg.txt.azov

        • Path C:\Program Files\7-Zip\Lang\bg.txt.azov
        • Size 17KB
        • SHA256 e63634dae2edbbcdd23c8817502f8f12494a3378914708f6c3008f16e54ffd9c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bn.txt.azov

        • Path C:\Program Files\7-Zip\Lang\bn.txt.azov
        • Size 14KB
        • SHA256 1f1831bc530ca7dfb2192b42066ea7efe22bd9108a41fd01d63ef698be94cd62
        • MD5 SHA1 SHA512 SSDEEP TLSH

        br.txt.azov

        • Path C:\Program Files\7-Zip\Lang\br.txt.azov
        • Size 4KB
        • SHA256 ca0929597e617c021fd5bf65662df89085fecafc3513b273d1e4eb6559041c83
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ca.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ca.txt.azov
        • Size 8KB
        • SHA256 5167a91e99c128bdd66dbe09fb28d2860e1258c109c040ec46c726e18cdc57a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        co.txt.azov

        • Path C:\Program Files\7-Zip\Lang\co.txt.azov
        • Size 11KB
        • SHA256 3e402cab53ee65680aee29387efcb670765c250eb70cb483b829286fdf8ea1a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cs.txt.azov

        • Path C:\Program Files\7-Zip\Lang\cs.txt.azov
        • Size 9KB
        • SHA256 8418c54584c55eab348c3929b0f23275bac6ab0dd39e9316d9d3fb6b04fd83a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cy.txt.azov

        • Path C:\Program Files\7-Zip\Lang\cy.txt.azov
        • Size 4KB
        • SHA256 59ef14606f999b21f9060edbf46969e21a918aa4b5e3eb7fa2d58d9b33e36920
        • MD5 SHA1 SHA512 SSDEEP TLSH

        da.txt.azov

        • Path C:\Program Files\7-Zip\Lang\da.txt.azov
        • Size 7KB
        • SHA256 eb0cd2fdef1b580b0a57022b814eadd610e20d6898d71384a91baf4ac2286497
        • MD5 SHA1 SHA512 SSDEEP TLSH

        de.txt.azov

        • Path C:\Program Files\7-Zip\Lang\de.txt.azov
        • Size 9KB
        • SHA256 15e2c11e3b15d6bb37ed51dcf73028e2c175440d3e07629c7caa89842e4eea0d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        el.txt.azov

        • Path C:\Program Files\7-Zip\Lang\el.txt.azov
        • Size 17KB
        • SHA256 b889a669a811bc1f6cc3d4de10adb1c388214ef79d266453b8de4411ef9e2ebe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en.ttt.azov

        • Path C:\Program Files\7-Zip\Lang\en.ttt.azov
        • Size 7KB
        • SHA256 21c0b3fd56d1e0f3996b5a7d58dc9c39d0964cb5dcfea5811d1432f190ce310c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        eo.txt.azov

        • Path C:\Program Files\7-Zip\Lang\eo.txt.azov
        • Size 4KB
        • SHA256 51a3151367f21835aaffff54a31516ca567b746aa482bd1fbe4040fab6e1c741
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es.txt.azov

        • Path C:\Program Files\7-Zip\Lang\es.txt.azov
        • Size 10KB
        • SHA256 6cb068e8e10d992dbcacdbc4673edb777d722f9b0dde1b0a20bd7504ba50a63f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        et.txt.azov

        • Path C:\Program Files\7-Zip\Lang\et.txt.azov
        • Size 7KB
        • SHA256 f82024da0686f863ef3192580f3f2c25850cf27e8beba07c6d54e2fecab4a962
        • MD5 SHA1 SHA512 SSDEEP TLSH

        eu.txt.azov

        • Path C:\Program Files\7-Zip\Lang\eu.txt.azov
        • Size 8KB
        • SHA256 5d2a785b1deb74465001ab4c0939a7dd50614b0e8008c30c64908c7f4a1c8e32
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ext.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ext.txt.azov
        • Size 7KB
        • SHA256 9e91177259c2b0b42a948418a9845e31c91346055f5729a6ad222bfd94033564
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fa.txt.azov

        • Path C:\Program Files\7-Zip\Lang\fa.txt.azov
        • Size 12KB
        • SHA256 b2f0d18f247582527ca7c80b53a07cdb46e7a1319846fbe18a2ba7050e6faf71
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fi.txt.azov

        • Path C:\Program Files\7-Zip\Lang\fi.txt.azov
        • Size 8KB
        • SHA256 dc23dce55af9af052a342fcea393a9beed789bdfcacb6fb33637e5ba3b2a2e2f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fr.txt.azov

        • Path C:\Program Files\7-Zip\Lang\fr.txt.azov
        • Size 11KB
        • SHA256 37031f9e9d1a12d7f8d8a14fdebb7bbee227f85333787e7c1aa6d55daa5c068b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fur.txt.azov

        • Path C:\Program Files\7-Zip\Lang\fur.txt.azov
        • Size 7KB
        • SHA256 5e7bfe01a613baca49dabdc51921beae77441e5ac2f260d1e10096189d61e861
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fy.txt.azov

        • Path C:\Program Files\7-Zip\Lang\fy.txt.azov
        • Size 5KB
        • SHA256 f23fd82025658f6c5a6f1e3cfe170be93aea008fd7778375b2b8c0e6fc55806c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ga.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ga.txt.azov
        • Size 7KB
        • SHA256 2ddde13bfa04970b50654fba4606956ccc2614ee91c18de49c30af2a6273e645
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gl.txt.azov

        • Path C:\Program Files\7-Zip\Lang\gl.txt.azov
        • Size 8KB
        • SHA256 2fa5a36c3034a01685bdc034ccff959f05c512cad44413442d1e1524a790c621
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gu.txt.azov

        • Path C:\Program Files\7-Zip\Lang\gu.txt.azov
        • Size 17KB
        • SHA256 a027e37b0648aef4e6f8c5fad5231ee2ec58bd48af4a225504d5962b71a18b91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        he.txt.azov

        • Path C:\Program Files\7-Zip\Lang\he.txt.azov
        • Size 11KB
        • SHA256 f63b63a6514dda3dfba9192a5e920d7f0ce0adf8218ef280df76483518a48019
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hi.txt.azov

        • Path C:\Program Files\7-Zip\Lang\hi.txt.azov
        • Size 17KB
        • SHA256 65d04540de19e9d692bda11e5f7c1316de7e5df4f9261dfe883187c1fcdb5b8b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hr.txt.azov

        • Path C:\Program Files\7-Zip\Lang\hr.txt.azov
        • Size 8KB
        • SHA256 2333280f413a2821a3c865c84170f30f08c18d95a84afebe2d837833084c2265
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hu.txt.azov

        • Path C:\Program Files\7-Zip\Lang\hu.txt.azov
        • Size 10KB
        • SHA256 805c0041dcbfb09c51fcc102b328647a813d5c17a95f3bdd96594cfa31f15681
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hy.txt.azov

        • Path C:\Program Files\7-Zip\Lang\hy.txt.azov
        • Size 13KB
        • SHA256 118bb3540b94602153846c05422ee88117565be4140715e4dfbcaba41a6ce942
        • MD5 SHA1 SHA512 SSDEEP TLSH

        id.txt.azov

        • Path C:\Program Files\7-Zip\Lang\id.txt.azov
        • Size 8KB
        • SHA256 183367a971849c8e6971367e53da6a8fe88698746c1dc8b9f6d7b2f9d432159d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        io.txt.azov

        • Path C:\Program Files\7-Zip\Lang\io.txt.azov
        • Size 4KB
        • SHA256 ca4eec0903c73e890d0a953fcde49fd50db2d2ba517861dc111ad043850dca4a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        is.txt.azov

        • Path C:\Program Files\7-Zip\Lang\is.txt.azov
        • Size 8KB
        • SHA256 5f253a27b0faf671077488be6bfa87cda5345fc4379b01327ad818e359c2c4d0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        it.txt.azov

        • Path C:\Program Files\7-Zip\Lang\it.txt.azov
        • Size 9KB
        • SHA256 9765f95f0200105fea9fa75c5d265861b912aad37aaf0f857fc97bda18f376dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ja.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ja.txt.azov
        • Size 12KB
        • SHA256 cc77967f90db4b6dda7a900944b101f0cb803f36b61e1b57ad378213ef1cf1be
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ka.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ka.txt.azov
        • Size 17KB
        • SHA256 da138eba269b08c1ab84fa01b376c71205e0bd2aa5fbefe2a50d763a278465f8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kaa.txt.azov

        • Path C:\Program Files\7-Zip\Lang\kaa.txt.azov
        • Size 7KB
        • SHA256 5e38188c80302403e9a306b6fe392601df4877970cad66a500720e751bb477e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kab.txt.azov

        • Path C:\Program Files\7-Zip\Lang\kab.txt.azov
        • Size 8KB
        • SHA256 27762da70b9e63d2e551245d5d802c170aa2db5a983e580abbdbdd54cb5f8769
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kk.txt.azov

        • Path C:\Program Files\7-Zip\Lang\kk.txt.azov
        • Size 10KB
        • SHA256 b41fa5c17beee6f29bbcf922afd81f3c47d2d2a665cc09d71b626a179e1ac284
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ko.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ko.txt.azov
        • Size 10KB
        • SHA256 12e64bb4c298add93c4bc25786d8d13cbc82ba12f3296d60bd1d8715a495df72
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ku-ckb.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ku-ckb.txt.azov
        • Size 11KB
        • SHA256 ce20d8dd24304bd65f801feb37ba28d1d401c731dc62fc4c412817e9e55c3816
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ku.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ku.txt.azov
        • Size 5KB
        • SHA256 10e9807d35c587a6534323960f247f4ccabb4be51a9d0ceb4d423ca260dcf104
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ky.txt.azov

        • Path C:\Program Files\7-Zip\Lang\ky.txt.azov
        • Size 12KB
        • SHA256 4d49e29491498349c6f514b9dfa4be8252bad77011cdd26511d173353260ffba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lij.txt.azov

        • Path C:\Program Files\7-Zip\Lang\lij.txt.azov
        • Size 7KB
        • SHA256 8a84bb51c3beea2e7972d3c932eb0c37418b86c7186523f8390b3002300caa35
        • MD5 SHA1 SHA512 SSDEEP TLSH

        descript.ion.azov

        • Path C:\Program Files\7-Zip\descript.ion.azov
        • Size 666B
        • SHA256 516e0395fa9d55f098a07248e70f15a7eb79ababe7dea211e63609c6e322a8a7
        • MD5 SHA1 SHA512 TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 350KB
        • SHA256 4817b5bb31956533e06686f77080666121c1f40d3e035bfa199624c1047f0753
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 4.3MB
        • SHA256 5fddbc070283ab88290e96d5684f6677c1753e3b82ee8408b201ad24c51bc15a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 2.3MB
        • SHA256 d84dd66c799bb7152f781989f72cd9741e6b1e0d1ea95932c3caf035ae924bd3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 188KB
        • SHA256 68c2a68e852ae1e739c9b9724fe16b1ad0b26dd78cd7636f8b8b51c7d9c90f13
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rdpclient.exe

        • Path C:\ProgramData\rdpclient.exe
        • Size 113KB
        • SHA256 3231194b90fa20ec266b80c0ce0d4936b5719f5bb4b85227ba48087a67fcbbf7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        a8c7ec7a9468e4e9_0

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a8c7ec7a9468e4e9_0
        • Size 666B
        • SHA256 e4e5aa8565d5326593e61ec3b4cbd4f91e506bb24947a6a37f2f9e5541953176
        • MD5 SHA1 SHA512 TLSH

        e060ac3d279ec869_0

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e060ac3d279ec869_0
        • Size 666B
        • SHA256 f9c704e3443f4d9382d156e56d970c61730985b5334368114d7d7bf1ea74f32e
        • MD5 SHA1 SHA512 TLSH

        ebcc49a8a7443b7c_0

        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ebcc49a8a7443b7c_0
        • Size 666B
        • SHA256 13ab4d7231093871234468dd6fad4343665ca1e91e791ef70de89bd3478da1ac
        • MD5 SHA1 SHA512 TLSH

        memory/1160-11-0x00000187DD070000-0x00000187DD075000-memory.dmp

        memory/1160-3-0x00000187DD070000-0x00000187DD075000-memory.dmp

        memory/1160-9-0x00000187DD080000-0x00000187DD084000-memory.dmp

        memory/1160-0-0x00000187DD080000-0x00000187DD084000-memory.dmp

        memory/1160-2-0x00007FF656980000-0x00007FF6569C1000-memory.dmp

        memory/1160-4-0x00000187DD050000-0x00000187DD057000-memory.dmp

        memory/1160-5-0x00000187DD070000-0x00000187DD075000-memory.dmp

        memory/2272-506-0x00007FF6FAB80000-0x00007FF6FAB97000-memory.dmp

        memory/2272-511-0x000001A6267D0000-0x000001A6267D5000-memory.dmp

        memory/2272-509-0x000001A6267B0000-0x000001A6267B7000-memory.dmp

        memory/2272-510-0x000001A6267D0000-0x000001A6267D5000-memory.dmp

        memory/2272-512-0x000001A6267E0000-0x000001A6267E4000-memory.dmp