051f3053ed0fac5c270fc9c3e006149f27ddd73ce3a2ebf839383d14cee80ff8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
Size 276KB
Sample260804-xe59vavycy
SHA256 051f3053ed0fac5c270fc9c3e006149f27ddd73ce3a2ebf839383d14cee80ff8
MD5 aead69bf83d6389d091f8416efe64ba1
SHA1 06b7fef44fde2612f7cb133b8c2b9630f1db9949
SHA512 947cff0605c980da4501374d59c355eface4e7865ac4996a0b2dbe444d6d4cfe285b2ddec91e1b614a7b63cc6f0905567afd6135dc427d5778d88462275f8bf9
SSDEEP 6144:4x6AElxgW2eB/iSNvEfShgwJBoiavEb8SZ9P4vpsK+mG:48Blq/eB/ZNMKhg6oia8p9P4BG
TLSH
T179548C4E77A54CF2D5678278CD619632F6B2B8691E20C70F16A1CB7F2F23560AD2C712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened (read-only)	\??\X:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened (read-only)	\??\Z:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened (read-only)	\??\B:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened (read-only)	\??\M:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened (read-only)	\??\N:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened (read-only)	\??\U:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened (read-only)	\??\W:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened (read-only)	\??\E:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened (read-only)	\??\K:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened (read-only)	\??\V:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened (read-only)	\??\Y:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened (read-only)	\??\P:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened (read-only)	\??\G:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened (read-only)	\??\I:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened (read-only)	\??\J:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened (read-only)	\??\L:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened (read-only)	\??\O:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened (read-only)	\??\S:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened (read-only)	\??\T:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened (read-only)	\??\A:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened (read-only)	\??\H:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened (read-only)	\??\Q:	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\setup_wm.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_aead69bf83d6389d091f8416efe64ba1_mespinoza.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
PID:3796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

notification_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe
Size 1.7MB
SHA256 40eded1f0d0224e5c79dda039fb6dc327fdffd58c0be485028be78a59a312c57
MD5 af7701962b0949407384efc5be0cfc53
SHA1 b93df1313403e6077f3b5be707ec0ab2958dee55
SHA512 7c4b8abcbad1caf431f1cbe37b3c16ab2c9f1fe951ab2ec14559aa88105e8800dd0fd1b9a399c714abb09f14081e994c2f3c543c77341f0520a503e7f6921e15
SSDEEP 24576:4QSf8kfq6DVhbNYreIGuJBkdFBzMudOBGNb9/lqPeQuJXlPnyF4mfHU9YawsNPzk:ofq+VB0WdFVbdOBGVuPeHX04mfHICR
TLSH
T1B6858C03F6D901E8E06ED2B8C7469132EAB27C450B34A6DF0691B6562F77EE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Size 4.1MB
SHA256 139d71ee7f11feb22296cd3aa17f6031a80c804160981810630c67dc0722a498
MD5 0c0bb9a344e1f0de7f1d7ab720bc1046
SHA1 ce443a3010badf7eb381c65940ae268f22a3489d
SHA512 df599b1018b152fcdf7392ed40bd62c5379fea0f8e70a49664490d77417220e18a9419e9d16850ae05fdc5934f8510940f1af4f134cd06223b3f0b17f650d93d
SSDEEP 49152:Dur89i04L7XGft/FO17Mdxwt+TjERlzExldDwUIDtaZHWRdpev2y/BaAK:j+0f2lmd+RaAAK
TLSH
T1E6165903B29940D8D059C074CE5AD233AB617C8947F162EF3690B7EA2A73AD47B3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
Size 1.6MB
SHA256 792f90b6874a6d25dcdaccd574b37df1c916a3964ed6ae2eba4bec688030c345
MD5 f6988e3334b533c322ef820800677ee6
SHA1 e1ff46410ca4d9ca335dcb5b3bba8436683a9619
SHA512 917bfa976409bf50a30d856e9d676ef958e0b9c707e4e05bd4d7a5c637501504f761a03f10368001c8119ccad733f5118b0974dc86a735b22e88c388f15b8c02
SSDEEP 24576:8mfVRA6j+BYiPgrpGmuWOmYGOZ29VkWvlqEL1oaedpEukUoygGmq/SG+D:8cRAu+YECBOmYVZ0V98EBo7EukU1xk
TLSH
T127759D03F3D801E8E069D1B8CB568536E9B17C450B24A6EF0A90B6552E7BFE49F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pwahelper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe
Size 1.5MB
SHA256 17bd62506eb18c19167a182b156c6f8b3224f803047aefdb3dd9dfea5c0cdd91
MD5 1b4eb4a627b11d97efab069d6fd8c984
SHA1 1f21ce3027ccfd159d005805f9d40fe392837a29
SHA512 3e59d8bb1dd2a9e6265a9a16ab9ab05c58667bf3f20e9ac94d11155f19b9d21e139a0361556c1052b6ad2fd7fa5e94401d2b001d3713952a941235a8a6d9fdd3
SSDEEP 24576:8cFLS6AoymEPIFHCucuras322nK1lqxGsVa4i6h27d3Wlg2+zU:pLS7rVUGuras322Lxn+6h27dI+zU
TLSH
T10E759E03F39940E8E05DD1B8CB56893AEAB17C450B24A6EF0B90B6552F77EE45B3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3796-3-0x000001FA0A850000-0x000001FA0A855000-memory.dmp

Download

memory/3796-2-0x00007FF794640000-0x00007FF794681000-memory.dmp

Download

memory/3796-1-0x000001FA0A850000-0x000001FA0A855000-memory.dmp

Download

memory/3796-6-0x000001FA0A850000-0x000001FA0A855000-memory.dmp

Download

memory/3796-4-0x000001FA0A850000-0x000001FA0A855000-memory.dmp

Download

memory/3796-0-0x000001FA0A830000-0x000001FA0A836000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads