2691413f8c80fa17cff3500c88a4a714ccae5c59986113e9206c17cf1fe8a625

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
Size 276KB
Sample260701-dvbkmafs8s
SHA256 2691413f8c80fa17cff3500c88a4a714ccae5c59986113e9206c17cf1fe8a625
MD5 b029afea9f60d75d5e89b61a87537804
SHA1 95e105cb978f6de8e1f621844646df78e530e536
SHA512 df37e51055617a081263f5ac1040181dd50ff7a06ab95717ce037d8a9138eb44952d04e5fd407081c5392ab72bfc9b2f6c92505a168c5d8843e3fcef5d98e8ae
SSDEEP 6144:O7D9s9F2aq/ZiNyEfLegrl7oW6vEb8SZ9PxojX:OP9s9Uaq/0N9jeg9oW68p9PijX
TLSH
T19A548D4E7BA49CF2E5638278CD519672F6B2B4A54E20CB0F56A1C77F2F23560AD2C311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened (read-only)	\??\U:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened (read-only)	\??\V:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened (read-only)	\??\E:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened (read-only)	\??\K:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened (read-only)	\??\O:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened (read-only)	\??\Q:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened (read-only)	\??\J:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened (read-only)	\??\S:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened (read-only)	\??\T:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened (read-only)	\??\W:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened (read-only)	\??\X:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened (read-only)	\??\A:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened (read-only)	\??\G:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened (read-only)	\??\H:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened (read-only)	\??\I:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened (read-only)	\??\M:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened (read-only)	\??\R:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened (read-only)	\??\Y:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened (read-only)	\??\Z:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened (read-only)	\??\B:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened (read-only)	\??\L:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened (read-only)	\??\N:	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Time.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\setup_wm.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_b029afea9f60d75d5e89b61a87537804_mespinoza.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
Size 1.7MB
SHA256 54d63d9f4ce9ef72b8337198b932a954fa8825bf9bde37d40ddde3a03867d9be
MD5 0176aa360f7e9ec204f11a0a24270f51
SHA1 a9d1bab3e25d7aef5e6d378dd26cbd91c46eaaf6
SHA512 c7191563a316a4e1bfbb392c8f713eef56cca049a4bbda1db717bdb3c66b3cd893ad870d967d08f4318c01f90457f7b6a0d7df471d3ee41a25cfcd22f033a98d
SSDEEP 49152:JsU//sqICwBp5pdRZoeHX04mfHI8YR5dS://vGdgHQdS
TLSH
T14E858B03F2D941E8E06DD2B8C7468532EAB27C450B34A6DF0691B6562F7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.1MB
SHA256 972e40c1078fc1a5b203eb73c2f80383c97b2c1ce0a40d47033beab6cf0b6151
MD5 07b9d466746d67c5bf810b347ded3075
SHA1 a3ab4a664b688c7b3c3f459277886ca6697cc238
SHA512 82894b3aa8086c2c9ea6715a7ffce9eb9d2e58deb657c3f3463776863c3adbc15bc6381b8c32df7e5eb50a765b590d637a732903955af0cbeeecefa3e17b8622
SSDEEP 49152:Duv9tG7t+kozo7PAqabjAQ+TjEIzExldDwUIDtaZHWRdpev2y/Ba8PovO:2dAW1td+RaA8qO
TLSH
T1FF165903B29940D8D059C074CE5AD232AB617C8D47F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
Size 1.6MB
SHA256 d64ac6c6f2fd016f419508d169d7a3ff546cbb3ebbf45518e6228137e8d04e3c
MD5 b1ee04b28b7b4da986686c78c9cf976c
SHA1 0547ce8c53b0eea28ba251b1e3a07961062b63e4
SHA512 7f8e8dd5cf46993b288bfcecbc409d6b14ee3cea8b7f548fed331b00578eb0f9a788811580d0a8ba7785a4011dc83ba92128590af1ec9d22d979fed511b237e2
SSDEEP 24576:uv+mvL06kvFOR9Ft7ysDuufxAwDAmiCkWkL1oaedpEukUoygGmq/SM/qtzh:qrL09dOJwGfxA6AzC9kBo7EukU1jO1
TLSH
T1CA758C03F3D801E8D06AD1B8C7568536E9B2BC450B24AAEF0A90B6552E77FE45F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 1.5MB
SHA256 00dbc5912cf4349c63b6e1ee8c5a5b50c94717cdf9baf85d4073b5e8fafc5016
MD5 d7e12d49b21772c657f6e08e9f942152
SHA1 71823d070c678f8f44cd6b6842171f9c5e5230b3
SHA512 9351ad937b90e92a184a9d7bac1b2e799fd15d2902ac8ddba3390b2812b5ea4d6a871bac0757627d7d0c799694d2819fa9933e06ad778c25ff1076866de0e81b
SSDEEP 24576:CLDN36ez0MPwe+WouhCOZBwNyy7QNGsVa4i6h27d3Wlzvgluq:mN31AVRwCOZBwNyuen+6h27dJlZ
TLSH
T11B759D03F39940E8D05DD1B4CB56893AEAB27C450B34A6EF0B90B6552E7BEE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3216-3-0x0000024E32570000-0x0000024E32575000-memory.dmp

Download

memory/3216-2-0x0000024E32550000-0x0000024E32557000-memory.dmp

Download

memory/3216-6-0x0000024E32570000-0x0000024E32575000-memory.dmp

Download

memory/3216-0-0x00007FF7A04B0000-0x00007FF7A04F1000-memory.dmp

Download

memory/3216-1-0x0000024E32570000-0x0000024E32575000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads