Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/08/2026, 21:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe
- Size 276KB
- Sample260814-1jdl6sscma
- SHA256 c51d19003f894dd922b2b0a91d1976198d336d7cf561185684a628b4abb9ffe7
- MD5 608eb79cefd31d64ba6a10b5bbdf3703
- SHA1 413701b9922604b048caf66dcc15e00ad72663bd
- SHA512 12564dca1099d78cac76b42ff6290d595fe29a9d6dce8af5d69f8f669ccb8952ac07d8e74207e0059ab5a47a7ef4eae5b6577d2bb2ba7deea3acc4d748300a6c
- SSDEEP 6144:9DIWs9K2c7/meNdEfL9gqMgoZMvEb8SZ9PmGOnAJG:9cWs9jc7/tNGT9gKoZM8p9PiEG
- TLSH T1B0548C4E77A58CF2E5638278CD519672E6B2B8A51E10CB0F12B5C77F2F23960AD2C711
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened (read-only) \??\N: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened (read-only) \??\P: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened (read-only) \??\U: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened (read-only) \??\X: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened (read-only) \??\G: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened (read-only) \??\O: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened (read-only) \??\H: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened (read-only) \??\I: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened (read-only) \??\S: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened (read-only) \??\Y: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened (read-only) \??\Z: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened (read-only) \??\B: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened (read-only) \??\K: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened (read-only) \??\L: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened (read-only) \??\Q: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened (read-only) \??\R: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened (read-only) \??\T: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened (read-only) \??\V: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened (read-only) \??\W: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened (read-only) \??\A: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened (read-only) \??\E: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened (read-only) \??\J: 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\java.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaws.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Windows NT\Accessories\wordpad.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-14_608eb79cefd31d64ba6a10b5bbdf3703_mespinoza.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
- Size 1.7MB
- SHA256 eeddfefb7cb8acba75c77d2451f3fc0d619d7df69eb44a72c56a12b435759c69
- MD5 21302f2971d5e1656e827d69f7112820
- SHA1 2032c15bfc12e90f37dda0c0582e545375c0633a
- SHA512 c73b5f0239c8183431320101fc4c83b0b3ca0d509d6f4b524a92bf4291a6062c6661aa3ee3e16620380637fda16a3f70560d30095ec287497db3b43427e6dcf2
- SSDEEP 24576:rdcziB6XRAMdRk3tu779OFRUTOS1Tb91eQuJXlPnyF4mfHU9YawsNeeT85U:vB20+JOFRSOS1PXeHX04mfHIfTr
- TLSH T148858B03F6D841E8D06ED2B8C7468532EAB27C450B34A6DF0691B6562F7BEE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
- Size 4.1MB
- SHA256 81bb42396346aad32089ba1d39dea1c0829cc58e46876438cec0ace69f0c9a24
- MD5 de899f93eb2e4494323cc0c732faa3c4
- SHA1 8b43c9833a1aecb067a3fbb04ee5283f5830b55e
- SHA512 6e554eb5962aa764ea46f6af22641b1e28d5a85281e384c623aec3457b173d7cf03b8f26cd1a20c90da77fb2f1155ebbdcc468fdb9cd839ece54148eac114296
- SSDEEP 49152:Du4A4zRE3QnfQLlTx7q/F8U5jX+TjEuzExldDwUIDtaZHWRdpev2y/Bafo5:wx7L4tPd+RaAfo5
- TLSH T166165903B29940D8D059C074CE5AD232AB617C8D47F162EF3690B7EA2A73AD47B3DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
- Size 1.6MB
- SHA256 9c6524fe5daa69d02fcf67f384f9d24c151fdb177f469b9170cf611ea99b3daa
- MD5 373f33174594ac3d49877c80b7948765
- SHA1 8341a9b1d6e671e364c0555709a887412bbbcb81
- SHA512 f4175ab7224e9ab11b96a54c42a2d12fc3ddcda58c81b9b96b273238888fe5ee536ae233141acab9b931737170692e7e53a33078229991202214193a7d2d209e
- SSDEEP 49152:TMyYNYbdfEMV7Nzw5L9lBo7EukU1kWYgkpd:YfNYhuCOuad
- TLSH T12D759D03F3D801E8D06AD1B8C7468936E9B27C454B24A6EF0A90B6552E7BFE45F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
- Size 1.5MB
- SHA256 15fc64c80c596629aad23a5a93ceb25c83b7a5e6b0688c4fc9ae8d8b117709cc
- MD5 f56ef33d068c7763b9085a8912d5b4eb
- SHA1 743bcd76aec25ecf56aaad2be3a7326b0bd9813f
- SHA512 da8b7a4b737ef090035f941ce1def6f547f5381aa4de33afb7160c0b303bc8cd91acfa30020fc1d22248ec3a8f7b227b04390cc1f1b80b7b28d075df5d90c5e0
- SSDEEP 24576:7Jkmz6mO/GtBKxMAkuoa/rie04ymn8iGsVa4i6h27d3Wl0g8toOnn:umzlZCe/a/me04yCNn+6h27db1tN
- TLSH T1C0759D03F79900D8E05DD1B8CB56853AEAB27C450B24A6EF0B90B6552F7BEE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH