Analysis

  • user interaction
    yes
  • max time kernel
    0s
  • max time network
    28s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 15:37

General

  • Target
    https://59.email.stripe.com/CL0/https:/billing.stripe.com/p/subscription/recovery/live_YWNjdF8wb2hLNEhIR2xZalJRNUQ1djV6MyxfVjBOTkNzbzVqa1FxVlhmaTRoSlp5ZlNMenlkcmtmSA0100zlVV1w91%3Freferer=failed_payment/1/0101019fc7f9484e-61eaafea-0308-458b-8db0-ba9bf6c8d6c9-000000/asuHjFV1VmrTVoQM4D-Ux-TzABa_EvNjNcmjHeum_Mg=452
  • Sample260804-s2h1lstdla
Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SendNotifyMessage 10 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://59.email.stripe.com/CL0/https:/billing.stripe.com/p/subscription/recovery/live_YWNjdF8wb2hLNEhIR2xZalJRNUQ1djV6MyxfVjBOTkNzbzVqa1FxVlhmaTRoSlp5ZlNMenlkcmtmSA0100zlVV1w91%3Freferer=failed_payment/1/0101019fc7f9484e-61eaafea-0308-458b-8db0-ba9bf6c8d6c9-000000/asuHjFV1VmrTVoQM4D-Ux-TzABa_EvNjNcmjHeum_Mg=452
    1⤵
    • Enumerates system info in registry
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2284
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffab253c188,0x7ffab253c194,0x7ffab253c1a0
      2⤵
        PID:2596
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,8921309098201293172,10397267970686165139,524288 --field-trial-handle=2300,i,4690828203922232370,30585651470062131,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
        2⤵
        • System Time Discovery
        PID:3764
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,14400701971896683918,8041323448058162947,262144 --field-trial-handle=2300,i,4690828203922232370,30585651470062131,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
        2⤵
          PID:4888
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,9826725048144487203,15571902221883498178,524288 --field-trial-handle=2300,i,4690828203922232370,30585651470062131,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
          2⤵
            PID:4688
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,16361255851487557561,11186270593472815363,2097152 --field-trial-handle=2300,i,4690828203922232370,30585651470062131,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
            2⤵
              PID:2588
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,8697607932505954161,13378893414614917078,2097152 --field-trial-handle=2300,i,4690828203922232370,30585651470062131,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
              2⤵
                PID:4228
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,10126111212220929197,10953005937065185566,2097152 --field-trial-handle=2300,i,4690828203922232370,30585651470062131,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
                2⤵
                  PID:924
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,1509533493374631123,8792911257411360327,2097152 --field-trial-handle=2300,i,4690828203922232370,30585651470062131,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:2
                  2⤵
                    PID:2788
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5004,i,1828782032990330133,14493665260154442301,2097152 --field-trial-handle=2300,i,4690828203922232370,30585651470062131,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
                    2⤵
                      PID:1744
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,15874776349794727706,8583195196081196467,524288 --field-trial-handle=2300,i,4690828203922232370,30585651470062131,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
                      2⤵
                        PID:1384
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,7301864384828560612,10077074635981104355,524288 --field-trial-handle=2300,i,4690828203922232370,30585651470062131,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
                        2⤵
                          PID:5020
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5856,i,7560045739295562077,17207124400428199610,2097152 --field-trial-handle=2300,i,4690828203922232370,30585651470062131,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:1
                          2⤵
                            PID:2996
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,5200409253792558278,3960504348739088822,524288 --field-trial-handle=2300,i,4690828203922232370,30585651470062131,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
                            2⤵
                              PID:3372
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,5200409253792558278,3960504348739088822,524288 --field-trial-handle=2300,i,4690828203922232370,30585651470062131,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
                              2⤵
                                PID:2604
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6124,i,10799154047067184334,9205317910428584623,2097152 --field-trial-handle=2300,i,4690828203922232370,30585651470062131,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
                                2⤵
                                  PID:2752
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6280,i,17957729580407473616,17384351496882124718,2097152 --field-trial-handle=2300,i,4690828203922232370,30585651470062131,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:1
                                  2⤵
                                    PID:4652
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6580,i,3578847251191060997,17474259017659802712,2097152 --field-trial-handle=2300,i,4690828203922232370,30585651470062131,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
                                    2⤵
                                      PID:3308
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,237347691685221426,10595149631666536605,524288 --field-trial-handle=2300,i,4690828203922232370,30585651470062131,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:8
                                      2⤵
                                        PID:3468
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,8849367766410342300,9698319690988312068,524288 --field-trial-handle=2300,i,4690828203922232370,30585651470062131,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:8
                                        2⤵
                                          PID:4364
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,15288977632588600575,12728573346278430661,524288 --field-trial-handle=2300,i,4690828203922232370,30585651470062131,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:8
                                          2⤵
                                            PID:760
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                          1⤵
                                            PID:3524

                                          Network

                                                MITRE ATT&CK Enterprise v16

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                blocklist

                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                • Size 105KB
                                                • SHA256 aa0d78ec9cd90e7c6714bdce5235de1fc6b7c3088a6cd8f6e6d2c1cebea7d661
                                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                                settings.dat

                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                • Size 280B
                                                • SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
                                                • MD5 SHA1 SHA512 TLSH

                                                settings.dat

                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                • Size 280B
                                                • SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
                                                • MD5 SHA1 SHA512 TLSH

                                                BookmarkMergedSurfaceOrdering

                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                • Size 6B
                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                • MD5 SHA1 SHA512

                                                SiteList-Enterprise.json

                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                • Size 2B
                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                • MD5 SHA1 SHA512

                                                Edge Profile.ico

                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                • Size 70KB
                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                                Network Persistent State

                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                • Size 111B
                                                • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                • MD5 SHA1 SHA512 TLSH

                                                SCT Auditing Pending Reports

                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                • Size 2B
                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                • MD5 SHA1 SHA512

                                                Preferences

                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                • Size 12KB
                                                • SHA256 c3008a52779efb0a8721e07ea340afee4da4946dafeb73d1028397de14fc7c46
                                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                                Secure Preferences

                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                • Size 30KB
                                                • SHA256 5b2487001982def63a76eb8b0d09b6ef6a6b318a4dac059996957ea13aa2108d
                                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                                sync_diagnostic.log

                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                • Size 6KB
                                                • SHA256 1965bbd70977af6a4ed581f4c81acd503d27cdc700018c9c692ce287bf90a1e4
                                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                                index.txt

                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
                                                • Size 90B
                                                • SHA256 2ce05721f1c3c6f57931516cd4a35e12830ff9fa0238fb35929418b9e3e3e220
                                                • MD5 SHA1 SHA512 TLSH

                                                index.txt

                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
                                                • Size 177B
                                                • SHA256 bfb96c857eea9fef75adbfbe61b088fa5146a3c00762b7841e3b404ba4064c08
                                                • MD5 SHA1 SHA512 TLSH

                                                index.txt~RFe5884db.TMP

                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5884db.TMP
                                                • Size 177B
                                                • SHA256 b2a0902f60e4e1b5845c654e3630d498c8660a7e361f3c9fad99cc8f7f07e00a
                                                • MD5 SHA1 SHA512 TLSH

                                                Local State

                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                • Size 8KB
                                                • SHA256 5ca6715d7488ade94bc84c1c62ef9163771d40c5dd300c6be9febef01c71cb16
                                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                                Local State

                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                • Size 19KB
                                                • SHA256 2229037542a8be1f0400b56077809f80136dc843dd4ca85d29262e10ea7b779e
                                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                                Local State

                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                • Size 8KB
                                                • SHA256 e5a3e21e8052452d305c5859112e25e90fd0a97ca5b47e8884623b70df7053ab
                                                • MD5 SHA1 SHA512 SSDEEP TLSH

                                                5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

                                                • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                                • Size 2KB
                                                • SHA256 ade0ff12af78355bc0f3a8cfec559368bec9becc00ef6599f9c3073ace46854d
                                                • MD5 SHA1 SHA512 TLSH