Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
26/08/2026, 02:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe
- Size 276KB
- Sample260826-cmpa3sbd94
- SHA256 8747566f21dd9e1d9dec4a1878b4f98c08b3567c428c8fb1a3983c61b64566e8
- MD5 f4032ef08f8bed3a9d954fb1b8063c7e
- SHA1 e721aed5f60af3984dc1d1794f5824db5510161f
- SHA512 c584325349cb3c84850fc10ecb57929442b701a9b38714bbcbe84e929f2467bbbef444b892ebafaf86df1e0e20259ffcf81c95b5c89349a83a1ed6ff0098320d
- SSDEEP 6144:en2acs9B2Bq/eFNDEf1Kg2+BoM0vEb8SZ9P6Sw3MtAm59w:01cs9gBq/KN49KgRoM08p9P6S4Kxfw
- TLSH T116548C4E77A54CF2D6A38278CD5196B2F7B2B8A55E20CB0F1661C76F2F23560AD2C311
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened (read-only) \??\B: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened (read-only) \??\J: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened (read-only) \??\N: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened (read-only) \??\P: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened (read-only) \??\Q: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened (read-only) \??\S: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened (read-only) \??\V: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened (read-only) \??\H: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened (read-only) \??\I: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened (read-only) \??\L: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened (read-only) \??\O: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened (read-only) \??\R: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened (read-only) \??\T: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened (read-only) \??\W: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened (read-only) \??\X: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened (read-only) \??\U: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened (read-only) \??\Z: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened (read-only) \??\E: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened (read-only) \??\G: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened (read-only) \??\K: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened (read-only) \??\M: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened (read-only) \??\Y: 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-25_f4032ef08f8bed3a9d954fb1b8063c7e_mespinoza.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
- Size 1.7MB
- SHA256 893d5fbbcea9f608a70b3a529cca2ab8a170266fd55919315e67bd99c15392ee
- MD5 f8509a9fa17f3e51f0cdb6f81d83c803
- SHA1 a6b3569e39c12d5a41806fd1c222fbd59e18f5fe
- SHA512 eb35650cc07789dc0b18d0dbb2545bd88c021716aba672fd40307112b6bfee7cd2c74ad93b12f3f920e68023470d2b131751df11f798886ffb289fd19a237e59
- SSDEEP 24576:EW/gEJf6SyiE7ZIT7bu6iQKslO2klRoTb9ieQuJXlPnyF4mfHU9YawsNlXUrs9:vJf74A54slOPlRoPIeHX04mfHI2rs9
- TLSH T1EC858C03F2D941E8E06ED2B8C7468132EAB27C450B34A6DF0691B6562F77EE45B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
- Size 4.1MB
- SHA256 1f5db1d25769cab32eae8d2a02222d9ece0e571e1954f3fad35c7acd67ac4c20
- MD5 51b0ff9f40c58585ba411a5820a38a87
- SHA1 e9b164d664e79790442dce31e546ae14e476d465
- SHA512 03e78195204fbb08d8e8f21c71eaa22a5382d3faa1c2aeda0a65cfcc6c17149a7d90c48af108244bddb6f3a9899d9738962e968aa01015d8aad3331dd03b31ee
- SSDEEP 49152:DudrELRXLe56d3lQwLfJV2yWC+TjEnzExldDwUIDtaZHWRdpev2y/Ba6:+4tnvQd+RaA6
- TLSH T1E9165903B29940D8D059C074CE5AD232AB617C8D47F162EF3690B7EA2A73AD47B3DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
- Size 1.6MB
- SHA256 d5d8ce7355230e724dcad942ddb3156f166d6699af53cc947ca28182d7ebc8d4
- MD5 780c7a2aabbee26c65643f2eada0c0e8
- SHA1 7ccacdcb24fc48a6803dc2770a0abc691c9c8871
- SHA512 3f3acec6e6d190e871c85f99beb291518e7d65110417465820569893418e92d16b681755101f1a7d3fb5a1a40195aef1bb0f4268dc48c66e3d7b99c0e6241e0d
- SSDEEP 24576:mkNqv86nKf8tjFYS2huG5R3hLO8/zkW9L1oaedpEukUoygGmq/SHahq:mTv8ao8thK5R3tOsz99Bo7EukU1Fhq
- TLSH T1D1759D03F3D841E8E06AD1B8C7468536E9B27C450B28A6EF0690B6552E7BFE45F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
- Size 1.5MB
- SHA256 d8fc10f4fa1730162dcdacea6b4cb682d8c70e81735870be20f0226da60b9326
- MD5 0839a92c631d2916f31cd164c326e9a7
- SHA1 c5747a009d00c6555a0fcb7f2738877966ee8a6e
- SHA512 49993e901cec656da50a0ce5a4faae1b41e09afc0c243df778f434a3749e3d3f13cefbc26a746648cdff79f9d496416ddb3d61913251c650b957b3462a881c7e
- SSDEEP 24576:WpjA56FX8VIFfU6fujYGumzwkJokGsVa4i6h27d3WlWTY:kA5GMy8JYGumzweHn+6h27dTY
- TLSH T190759D03F39940E8E05DD1B8CB56853AEAB27C450B34A6EF0B90B6552E77EE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH