hxxps://cdn[.]discordapp[.]com/attachments/1511360553103397055/1535811747942895666/fabric-installer-1[.]1[.]2[.]exe?ex=6a791fa6&is=6a77ce26&hm=22dc6767257225aadd356eea931f976ada76e0b88c30b0bbf51abdaeb042348b&

Analysis

user interaction
yes
max time kernel
16s
max time network
16s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/08/2026, 00:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1511360553103397055/1535811747942895666/fabric-installer-1.1.2.exe?ex=6a791fa6&is=6a77ce26&hm=22dc6767257225aadd356eea931f976ada76e0b88c30b0bbf51abdaeb042348b&
Sample260809-a5tbmsxene

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
21	3028	msedge.exe

Executes dropped EXE 1 IoCs

pid	Process
1256	fabric-installer-1.1.2.exe

Loads dropped DLL 1 IoCs

pid	Process
228	javaw.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\fabric-installer-1.1.2.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fabric-installer-1.1.2.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3028	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307101006971637"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2654269261-3199571979-4291878722-1000\{BBE8D8BE-9912-4629-BDB9-98AB25BF309E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\fabric-installer-1.1.2.exe:Zone.Identifier	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
228	javaw.exe
228	javaw.exe
228	javaw.exe
228	javaw.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 4788	4940	msedge.exe	81
PID 4940 wrote to memory of 3028	4940	msedge.exe	82
PID 4940 wrote to memory of 416	4940	msedge.exe	83
PID 4940 wrote to memory of 416	4940	msedge.exe	83
PID 4940 wrote to memory of 416	4940	msedge.exe	83
PID 4940 wrote to memory of 720	4940	msedge.exe	84
PID 4940 wrote to memory of 720	4940	msedge.exe	84
PID 4940 wrote to memory of 4424	4940	msedge.exe	86
PID 4940 wrote to memory of 4424	4940	msedge.exe	86
PID 4940 wrote to memory of 4424	4940	msedge.exe	86
PID 4940 wrote to memory of 4056	4940	msedge.exe	87
PID 4940 wrote to memory of 4056	4940	msedge.exe	87
PID 4940 wrote to memory of 4056	4940	msedge.exe	87
PID 4940 wrote to memory of 2488	4940	msedge.exe	88
PID 4940 wrote to memory of 2488	4940	msedge.exe	88
PID 4940 wrote to memory of 2488	4940	msedge.exe	88
PID 4940 wrote to memory of 2464	4940	msedge.exe	89
PID 4940 wrote to memory of 4820	4940	msedge.exe	90
PID 4940 wrote to memory of 4824	4940	msedge.exe	91
PID 4940 wrote to memory of 2464	4940	msedge.exe	89
PID 4940 wrote to memory of 2464	4940	msedge.exe	89
PID 4940 wrote to memory of 4820	4940	msedge.exe	90
PID 4940 wrote to memory of 4820	4940	msedge.exe	90
PID 4940 wrote to memory of 4824	4940	msedge.exe	91
PID 4940 wrote to memory of 4824	4940	msedge.exe	91
PID 4940 wrote to memory of 4936	4940	msedge.exe	93
PID 4940 wrote to memory of 4936	4940	msedge.exe	93
PID 4940 wrote to memory of 4304	4940	msedge.exe	94
PID 4940 wrote to memory of 4304	4940	msedge.exe	94
PID 4940 wrote to memory of 3616	4940	msedge.exe	95
PID 4940 wrote to memory of 3616	4940	msedge.exe	95
PID 4940 wrote to memory of 4120	4940	msedge.exe	96
PID 4940 wrote to memory of 912	4940	msedge.exe	97
PID 4940 wrote to memory of 4120	4940	msedge.exe	96
PID 4940 wrote to memory of 4120	4940	msedge.exe	96
PID 4940 wrote to memory of 2432	4940	msedge.exe	98
PID 4940 wrote to memory of 2432	4940	msedge.exe	98
PID 4940 wrote to memory of 1904	4940	msedge.exe	101
PID 4940 wrote to memory of 764	4940	msedge.exe	102
PID 764 wrote to memory of 2684	764	msedge.exe	103
PID 4940 wrote to memory of 1256	4940	msedge.exe	104
PID 1256 wrote to memory of 4628	1256	fabric-installer-1.1.2.exe	105
PID 1256 wrote to memory of 228	1256	fabric-installer-1.1.2.exe	106

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1511360553103397055/1535811747942895666/fabric-installer-1.1.2.exe?ex=6a791fa6&is=6a77ce26&hm=22dc6767257225aadd356eea931f976ada76e0b88c30b0bbf51abdaeb042348b&
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7fff8ad2c188,0x7fff8ad2c194,0x7fff8ad2c1a0
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,12941274198745830406,11378434646273141262,524288 --field-trial-handle=2068,i,16707010739094496820,11812360366718050524,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,13791485619246669752,7653521323965285685,262144 --field-trial-handle=2068,i,16707010739094496820,11812360366718050524,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,17738742810299569441,5399086450481427593,524288 --field-trial-handle=2068,i,16707010739094496820,11812360366718050524,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:13
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,7639586566269207619,15285995690408981504,2097152 --field-trial-handle=2068,i,16707010739094496820,11812360366718050524,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,10006378767649497601,13073027119156161065,2097152 --field-trial-handle=2068,i,16707010739094496820,11812360366718050524,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,3848625100798738910,16854491242092260103,2097152 --field-trial-handle=2068,i,16707010739094496820,11812360366718050524,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4188,i,4602000867063889262,12532889307631608019,2097152 --field-trial-handle=2068,i,16707010739094496820,11812360366718050524,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,3759199933167975186,9736515032939423640,2097152 --field-trial-handle=2068,i,16707010739094496820,11812360366718050524,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:9
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4196,i,5142518732839807868,18309239044324841015,2097152 --field-trial-handle=2068,i,16707010739094496820,11812360366718050524,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:9
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,7354779635991586023,5695793618883850960,524288 --field-trial-handle=2068,i,16707010739094496820,11812360366718050524,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,10405150192288260423,11264452539156113094,524288 --field-trial-handle=2068,i,16707010739094496820,11812360366718050524,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,17548940672878785724,8700322687314764099,524288 --field-trial-handle=2068,i,16707010739094496820,11812360366718050524,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5872,i,9607524098207676976,8271557135319561765,2097152 --field-trial-handle=2068,i,16707010739094496820,11812360366718050524,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,18196691128771288714,12326782598756076980,524288 --field-trial-handle=2068,i,16707010739094496820,11812360366718050524,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,5958863976782891102,12087263175757885812,524288 --field-trial-handle=2068,i,16707010739094496820,11812360366718050524,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,6711867374543083558,7911603711084527850,524288 --field-trial-handle=2068,i,16707010739094496820,11812360366718050524,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,6711867374543083558,7911603711084527850,524288 --field-trial-handle=2068,i,16707010739094496820,11812360366718050524,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,3709842164108792988,14122075000043891751,524288 --field-trial-handle=2068,i,16707010739094496820,11812360366718050524,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:2684
- C:\Users\Admin\Downloads\fabric-installer-1.1.2.exe
  "C:\Users\Admin\Downloads\fabric-installer-1.1.2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
    "javaw.exe" "-version"
    3⤵
    PID:4628
- - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
    "javaw.exe" "-jar" "C:\Users\Admin\Downloads\fabric-installer-1.1.2.exe" "-fabricInstallerBootstrap" "true"
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ed54168e9bd9b049b307ad0198c8ff96fedc239690683bbbe954b5b6ccc78d1e
MD5 e13f095bcb4b9c0f4556bd8310cd4c8b
SHA1 6f2ae1857ed820a530bece8a02541eb1eb26db43
SHA512 391fa95533bb7b534e5cf1ef628f7178db1ff4a768c5f98f0211d091434bef89f8aadb2e77a3b24168c58577d469227622dd559bec9b2751e416ce9e380714f1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7N:fwUQC5VwBIiElEd2K57P7N
TLSH
T123B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7da5fd99a0ab66e77a1c7d418475484f3755ec6c2945de3295f2577e789df01a
MD5 39ab0f1d6d7946d873f1bb6929a4c13e
SHA1 c59f4f27654295f008fbfc2411a1ef79ea54cec0
SHA512 e470432f3c728552a9408dd90789bb6c2ace1ee0142fae2a37ea0127d228691c3150637174b3202058e5952e25dfd9256f96a6af74b77d36328dc528bee21aea
TLSH
T10BD080332F1D7041FB1D4730D463CB24277F845638478616B211C40C99754C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 23823794b3b6267e9c083ddaf520ee01fa32d4516798865f1445a1abc4b04bbd
MD5 83250c7c4d7b6ef62bd1bf26f4c3e0c4
SHA1 e9602c3da743490459da2b565766ef634e141b1e
SHA512 ca69ff689a6f6e3b7d2372cd69b840c4bfc55765ed02240fdf7742b99373e9bfcada680b5f79ef47adfa800608d07b4a31cf3835f5c30b056283e46bca076180
TLSH
T189D012232A5D7041EB1946309463CB24266E845628468616B211840C89664C493C5587
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6408d44a98d3d036dac6a9e2e2ae61f12ad5c444f11ddad19ccd794a2169701a
MD5 aa2e73275e5a610486fa16d25347d5f7
SHA1 cbd6ed3bb4977d2d4e688b10649a53e7714bf642
SHA512 66df5c8436b29dbc35b935bc3beba96599e9bb6229ae527f5a8c7e79d7db48a9c0d74b831522615d1bae1c3d6a265fdfba184fb421d46e70c89ce8f9ba7da674
SSDEEP 192:sxZZRSyM/jK1Ml8MoO/fQs1LdIUIdpM/W6+WNGY0uBHWG2fjIgrJ:sxZZgQO/fQs1LdINM/bG5uUV9
TLSH
T10C42E6126B34A977CCCBD209FA55BF53D6F91472A2900E54A9FCDA1C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 f50a5317db7ef23a0f58042ddab325af9f9d2cf9c33d01735fdb5525a2913c4b
MD5 68a3e3dbe74f44bda8872956e13c7098
SHA1 59706db7675c94fa0305787cf65e17f761b5dba6
SHA512 e470b04bd5812e1a7bb70bae1a8fa0da0932d94c81f8030993ceae92c13ccb3a33e9a9483501d198fe5b7ca555cbb58c420bc8ff772fd3657c7359b2e35d5bf2
SSDEEP 768:5E/Lh8dF2/kWRmAcQ3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3KjLl/060l6krozE:5E/Lh8dF2/kWRmAcQ3wu1jaKKjLp0Dlr
TLSH
T16DE23A3B690CCBBE4F840EADEC266F976ED801CB56684D5447FA894C03C73EA411A59F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 d9eea42eab7821026cf1ac7e12ebd6942ecab38c68d0a55702874ca8f1d0ecba
MD5 fd74c4d05ddf03d44ae7a057b98bf099
SHA1 9f26f2f9850d41b7bbef764ce40307dd70c1d214
SHA512 0c60df46f5f668204bb7eee28cb7baf385d9d81f125d5456bf9967c1694b65e60f592cfb5b149e9830c1b85a60529d124d7df4cf97d8739f466a05cfd8d7ab8e
SSDEEP 48:K08I/KFGsH2InKfawvydVIhKeE8zyp2I/KvKwl:K08gKFGq2UKfaK+V+KeESa20KvK6
TLSH
T14BB155A6327A02423C3D682C97558726AA47B1673414AD3F7BB800B64EE7F618CFD5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 bca1c004f83aabda3d3c8fc22c58f0815820acd70a4af1edbcf93333af492b93
MD5 13f31f7012362e91552c476c5e2ad681
SHA1 bb9eb9d334622510f8f62bbf7256ff1f2589b04d
SHA512 9899920602797f39e89bb07a87680a0ca0b63bd4fb18859a087909fc0a56b703d16eaa00654049de93c3056a595bd736206c050cd18556791c9d10a60da987f9
SSDEEP 384:WZcIZ8N3/xQe40HCoR0FptNk6ygHnTKwBODNZOCAKD9:EZtYRubDhxHnewBKZOrO
TLSH
T133928D725C382C379EE7B545F54736075EF881B3F7C42B58A5EEAB1C41EA688130B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 638e844d2c03a1c866cc112c95d9d1d10c7d1033264aacc19ae06662a03b1953
MD5 f33f954e188732e905b98b9cb3daf07f
SHA1 581c569f94454bbe41f8f6ee0e3c92817b0fbf6d
SHA512 6c8728cccefe3ba6e70e9cbafd3187c239dd3f0f1f0d4a55aeb5dff8a6d817c2e84d40e7cc009018effe4d90c820bf2575195e87671785956a4859cca9a4dd11
SSDEEP 192:qGNI6d9402QmiUy4vqTBF2oP1lbkBmPGw9m8U6:qGNI6740SnCTBFptNkejU6
TLSH
T17702F93568383CBB9FB3AE45F5833B176EE5216BEA842B84D9E41B0C41D728C1307966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a8895b6da931244dbed9596403f5204359b6d728df75784fb9b3266e736d86ea
MD5 3cc37eaa993906651a908e1adf952aa7
SHA1 fa867e64b787646fb6a1f16700d5e130ecbd7683
SHA512 1e0c9361ad16aeb00cea909876fcf290ab2616429f96f4b6226403cdeb88f2938cbc2e13ce5b5fd3e23ff5d7e228eab349166018adf1271fe75d20db07805ea7
SSDEEP 192:bGNC6d940AQmiUyCqjBF2oP1lbkBmTyuiDDqwU6:bGNC6740AOjBFptNk6yDHU6
TLSH
T121123C3658783C375EA3A841F08736176DE54267EB847B4495EC2B1C41EF79C130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fabric-installer-native8843030643212529896.tmp

Path C:\Users\Admin\AppData\Local\Temp\fabric-installer-native8843030643212529896.tmp
Size 9KB
SHA256 32a9cbd598dfd72ee53e60c79c195306afd19acc65c8fc1db6d33833d1550f25
MD5 2a4edd64e186969b56c571c6889b450b
SHA1 6dffeccb4f7f65d0fedc965bea8e1494375a3d9f
SHA512 e3ff5a86dccba08caff1ee17bdf9a33a1e0a43e0ab669a23e0eb8f9d8f85d1383ec959d7cde6ef6b40fe58ae02a795761fdd36769aaf202c0ff5d2eda1d1510a
SSDEEP 96:uJ0QxytkCLePias1It++7CJIPWJlqnvsPJel8me8q9QCJFzHCAD/Bzax:OxyCCCqasGtjDnzOD7zHCAD/B
TLSH
T1F4121A89FE6649E9E72282B4C8D34D4CA178B311531223DB2374662E1E1B78F7127B46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fabric-installer-1.1.2.exe.crdownload

Path C:\Users\Admin\Downloads\fabric-installer-1.1.2.exe.crdownload
Size 479KB
SHA256 2fa3c8644aea9b469e722d3218437c00a462646422791eff6e6252d87c8dd1da
MD5 8d0e3d299c4e9e321de90ea20483c6ec
SHA1 885e5c0b0f703571c618302601051a054e1bf354
SHA512 6087b3ac56fb7972f006af0a2dfaa72228df2c2ec837826c2420ae67d72443f86b2b0308e2c0f55a60bb39522a4de421aaa6770ec72bf901758dc0465c28e98d
SSDEEP 6144:lwauinGcqhuZB4uPCU5hAE7+Xmtxiwf9IB0BE486K5Zy5OYl9Jot/rLSVvuKt4s/:RFsuZBxj+Wz9IB0BE4BK5ZMJoemKbfzD
TLSH
T13BA4CF11BA92C433D66715734D35DB7A9A3EBC604BA065FBA3C01A7ECA301C05B3679B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fabric-installer-1.1.2.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\fabric-installer-1.1.2.exe:Zone.Identifier
Size 234B
SHA256 35b04d0845bdc8b8e3e537102aa0a7da70d480a1cd7b8d833e2a01258d02409b
MD5 18b25186be17c2e577496a9cb9dc5729
SHA1 15e5cdcdaf752d342067b0fdc238dafbfad54a8f
SHA512 25fbb530be55ed6cc3c6547d8dbc3fea6edc0d9de9dac278482e0fcaf502945ebfa2153553d19c49a9a452171aeae8b099850d405c87bfc1a6ada5c312dfa0a4
TLSH
T194D0977A0348D460C60B35EA38CA085AC2AD6300C68048CC8C10482A1E0188971CDE07
MD5 SHA1 SHA512 TLSH

Submit Download

memory/228-191-0x0000023ED3400000-0x0000023ED3401000-memory.dmp

Download

memory/228-222-0x0000023ED3400000-0x0000023ED3401000-memory.dmp

Download

memory/228-264-0x0000023ED3400000-0x0000023ED3401000-memory.dmp

Download

memory/228-267-0x0000023ED3400000-0x0000023ED3401000-memory.dmp

Download

memory/228-273-0x0000023ED3400000-0x0000023ED3401000-memory.dmp

Download

memory/228-186-0x0000023ED3400000-0x0000023ED3401000-memory.dmp

Download

memory/228-304-0x0000023ED3400000-0x0000023ED3401000-memory.dmp

Download

memory/228-323-0x0000023ED3400000-0x0000023ED3401000-memory.dmp

Download

memory/228-325-0x0000023ED3400000-0x0000023ED3401000-memory.dmp

Download

memory/228-336-0x0000023ED3400000-0x0000023ED3401000-memory.dmp

Download

memory/228-366-0x0000023ED3400000-0x0000023ED3401000-memory.dmp

Download

memory/4628-174-0x00000226257D0000-0x00000226257D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads