Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/08/2026, 04:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe
- Size 276KB
- Sample260831-etzrhadj61
- SHA256 21e44d69e7cee54b848e6eb6b3d0c8574de1d1b1c49c97177b11edaeec88b3b8
- MD5 cd07ba6a2fb1fc6fb5efe8fe05233a6a
- SHA1 703b52807f88ec7de5520e7bbcf541c228be8829
- SHA512 3cc1c6c27ed64e8ccb6720ac662eba55aebb7b1827ca3a0ac89dd13788ad625055e12ad4ab42390c076257dbb9fcb7949817d317a34bb4e23cab774b74eb30e0
- SSDEEP 6144:556Ss9P2St/4lNQEfpVgk7soLlvEb8SZ9P6IlDPDmxPGc+G8:5ESs9OSt/QN/xVgBoLl8p9PFDM8
- TLSH T1F1547C4B7BA54CF2D5938178CA559672E7B2B8611E20C70F1AA5CF6F2F73560AC2C312
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened (read-only) \??\K: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened (read-only) \??\N: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened (read-only) \??\O: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened (read-only) \??\P: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened (read-only) \??\Q: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened (read-only) \??\S: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened (read-only) \??\X: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened (read-only) \??\Y: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened (read-only) \??\B: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened (read-only) \??\G: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened (read-only) \??\H: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened (read-only) \??\L: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened (read-only) \??\R: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened (read-only) \??\T: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened (read-only) \??\V: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened (read-only) \??\E: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened (read-only) \??\Z: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened (read-only) \??\A: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened (read-only) \??\I: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened (read-only) \??\J: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened (read-only) \??\M: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened (read-only) \??\U: 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Windows Media Player\setup_wm.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-30_cd07ba6a2fb1fc6fb5efe8fe05233a6a_mespinoza.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
- Size 1.7MB
- SHA256 e97784f4d2ec2717153fb9289470cd80750ce03e19fa0ff2b40aa5dfc691d42a
- MD5 3ef97a0c26ccf9c316ffa587e50a4095
- SHA1 540cc61009144311d908a21bb45b0abe48b70867
- SHA512 889bb8a71aed2442c2077aaf91362d6f7f854c604d0435842130671f625b525e8b5895e0da14700f0ad80f1bc0ab8637b8243920a38b8ee29986ff84408641d2
- SSDEEP 24576:quk+s169A26JJFHNRuRi+je7am+SLWb9PeQuJXlPnyF4mfHU9YawsNEjGichisBs:A1Q69mnje7N+SLABeHX04mfHIaHchDBs
- TLSH T1E5858C03F2D901E8E06ED2B8C7468532EAB27C450B34A6DF0691B6562F77EE45B3E750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
- Size 4.1MB
- SHA256 aa6a8c5a20606d6f7f1d45d71f42b15ceefeffb0edc75ab8b09f330450cd4881
- MD5 815ff9da5246da67b2ab91fc5fd35979
- SHA1 4fb8a5c4331e3d72af785e78f363fd7c73047e14
- SHA512 861387c53ecbfbbde603af1b1237d48ef3f6919a025257f97fd2ffda311a13408814ae920e0364870a868576e525e0604414f127a6ea93c9b886b3f4c20d7935
- SSDEEP 49152:DuQIMOWfvb/4AEgygqQBKq+TjEDzExldDwUIDtaZHWRdpev2y/Ba89C:4Sd5Pcd+RaA89C
- TLSH T1FE165903F29940D8D049D074CE5A9232AB617C8D47F162EF3690B7EA2A73AD47B3DB15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
- Size 1.6MB
- SHA256 0557232a6a727a46a4a98343f5dd562f1c25c4cab4d814b2554e6bc004faeb28
- MD5 951bfb465c85bb37e0ce38d5625164a7
- SHA1 e405ee284877f8280de395c3dc42de586fba148b
- SHA512 71a562a6f7e5abc6b0719b40f759ab70fb809832fac4245ca113d1cfdaa16b439ae86b9f0313116eba408902db65cd5b6956bfbde580ab82d078b5b7b0b2b919
- SSDEEP 49152:y4LkYLKT8T7rOeWn/a9zBo7EukU1oh9U3L:j4YLWqUuhOL
- TLSH T100759D03F3D801E8E06AD1B8C7568536E9B27C450B24A6EF0A90B6552E7BFE45F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
- Size 1.5MB
- SHA256 3956a6f370ccdc083cbb634bdbc489220f87126289c60c8a57a9b977c3ff2474
- MD5 fcb3b91a5d982819faa6f7bab57ed6b1
- SHA1 9d8efc4739fbaf2fc3962e777695ed3e81cd47e5
- SHA512 74f2a96609b8108840a35dc765c9e0bc56591f40e8a7c077fe9a9c137fbdd96989f688421219d915ca69e8d62bf6b46b7feafc594ac9adf0f21a4a05ec8c7a9e
- SSDEEP 24576:vSjje6TrERqdTBjPSufuZTV6/LAvoGsVa4i6h27d3WlYmF1:qjekIITNBuZTV6/kwn+6h27d/k1
- TLSH T13F759D03F7D900D8E05DD1B8CB56893AEAB27C450B24A6EF0B90B6552E77EE45B3E710
- MD5 SHA1 SHA512 SSDEEP TLSH