File name:

spirit-fortnite-injector.zip.exe

Full analysis: https://app.any.run/tasks/f9284864-2c1e-4206-b177-c7056778abd3
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: September 30, 2020, 09:45:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
adware
pua
lavasoft
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

9C9AF6B2DFB3E933119A685D582F94EE

SHA1:

FCF85BA8AFE81AF446D48CA70111E50A640B1ED9

SHA256:

29F8C587D0F8A5B0D3B235C193D70E93B45905ED0B5F7EFE4E78094800A0BF32

SSDEEP:

98304:fG5QgrvI6QpOkvjKg0afvdCuJRy85EMijZu6:fG5bvvQIkmpa9F3VuMyZd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • GenericSetup.exe (PID: 1292)
      • installer.exe (PID: 2180)

    • Loads dropped or rewritten executable

      • GenericSetup.exe (PID: 1292)

    • Changes settings of System certificates

      • GenericSetup.exe (PID: 1292)

    • LAVASOFT was detected

      • installer.exe (PID: 2180)

  • SUSPICIOUS

    • Reads the Windows organization settings

      • GenericSetup.exe (PID: 1292)

    • Reads Environment values

      • GenericSetup.exe (PID: 1292)

    • Executable content was dropped or overwritten

      • spirit-fortnite-injector.zip.exe (PID: 2728)

    • Searches for installed software

      • GenericSetup.exe (PID: 1292)

    • Reads Windows owner or organization settings

      • GenericSetup.exe (PID: 1292)

    • Adds / modifies Windows certificates

      • GenericSetup.exe (PID: 1292)

  • INFO

    • Manual execution by user

      • taskmgr.exe (PID: 2144)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:04:18 20:54:06+02:00
PEType: PE32
LinkerVersion: 6
CodeSize: 104448
InitializedDataSize: 344064
UninitializedDataSize: -
EntryPoint: 0x148d4
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.2.0.3088
ProductVersionNumber: 1.2.0.3088
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileVersion: 1.2.0.3088
ProductVersion: 1.2.0.3088
CompanyName: CherryPlayer_Web
FileDescription: Software Installation
InternalName: -
LegalCopyright: CherryPlayer_Web
OriginalFileName: -
ProductName: CherryPlayer_Web's Installer
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start spirit-fortnite-injector.zip.exe #LAVASOFT installer.exe genericsetup.exe taskmgr.exe no specs spirit-fortnite-injector.zip.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1292"C:\Users\admin\AppData\Local\Temp\7zS8AADDD8B\GenericSetup.exe" C:\Users\admin\AppData\Local\Temp\7zS8AADDD8B\GenericSetup.exe C:\Users\admin\AppData\Local\Temp\7zS8AADDD8B\GenericSetup.exe
installer.exe
User:
admin
Integrity Level:
HIGH
Description:
Software Installation
Exit code:
0
Version:
1.2.0.3088
Modules
Images
c:\users\admin\appdata\local\temp\7zs8aaddd8b\genericsetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1700"C:\Users\admin\AppData\Local\Temp\spirit-fortnite-injector.zip.exe" C:\Users\admin\AppData\Local\Temp\spirit-fortnite-injector.zip.exe—explorer.exe
User:
admin
Company:
CherryPlayer_Web
Integrity Level:
MEDIUM
Description:
Software Installation
Exit code:
3221226540
Version:
1.2.0.3088
2144"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2180.\installer.exeC:\Users\admin\AppData\Local\Temp\7zS8AADDD8B\installer.exe
spirit-fortnite-injector.zip.exe
User:
admin
Company:
adaware
Integrity Level:
HIGH
Description:
Software Installation
Exit code:
0
Version:
1.2.0.3088
Modules
Images
c:\users\admin\appdata\local\temp\7zs8aaddd8b\installer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2728"C:\Users\admin\AppData\Local\Temp\spirit-fortnite-injector.zip.exe" C:\Users\admin\AppData\Local\Temp\spirit-fortnite-injector.zip.exe
explorer.exe
User:
admin
Company:
CherryPlayer_Web
Integrity Level:
HIGH
Description:
Software Installation
Exit code:
0
Version:
1.2.0.3088
Modules
Images
c:\users\admin\appdata\local\temp\spirit-fortnite-injector.zip.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
2 721
Read events
2 636
Write events
85
Delete events
0

Modification events

(PID) Process:(2180) installer.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
Operation:writeName:PendingFileRenameOperations
Value:
\??\C:\Users\admin\AppData\Local\Temp\7zS8AADDD8B\de\DevLib.resources.dll
(PID) Process:(2180) installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2180) installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1292) GenericSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1292) GenericSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1292) GenericSetup.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1292) GenericSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474
Operation:writeName:Blob
Value:
040000000100000010000000ACB694A59C17E0D791529BB19706A6E40F0000000100000014000000CE0E658AA3E847E467A147B3049191093D055E6F030000000100000014000000D4DE20D05E66FC53FE1A50882C78DB2852CAE4741D0000000100000010000000918AD43A9475F78BB5243DE886D8103C140000000100000014000000E59D5930824758CCACFA085436867B3AB5044DF062000000010000002000000016AF57A9F676B0AB126095AA5EBADEF22AB31119D644AC95CD4B93DBF3F26AEB0B0000000100000030000000440069006700690043006500720074002000420061006C00740069006D006F0072006500200052006F006F007400000009000000010000003E000000303C06082B0601050507030106082B0601050507030406082B0601050507030206082B0601050507030306082B0601050507030906082B0601050507030853000000010000006200000030603020060A2B06010401B13E01640130123010060A2B0601040182373C0101030200C0301F06096086480186FD6C020130123010060A2B0601040182373C0101030200C0301B060567810C010130123010060A2B0601040182373C0101030200C019000000010000001000000068CB42B035EA773E52EF50ECF50EC52920000000010000007B030000308203773082025FA0030201020204020000B9300D06092A864886F70D0101050500305A310B300906035504061302494531123010060355040A130942616C74696D6F726531133011060355040B130A43796265725472757374312230200603550403131942616C74696D6F7265204379626572547275737420526F6F74301E170D3030303531323138343630305A170D3235303531323233353930305A305A310B300906035504061302494531123010060355040A130942616C74696D6F726531133011060355040B130A43796265725472757374312230200603550403131942616C74696D6F7265204379626572547275737420526F6F7430820122300D06092A864886F70D01010105000382010F003082010A0282010100A304BB22AB983D57E826729AB579D429E2E1E89580B1B0E35B8E2B299A64DFA15DEDB009056DDB282ECE62A262FEB488DA12EB38EB219DC0412B01527B8877D31C8FC7BAB988B56A09E773E81140A7D1CCCA628D2DE58F0BA650D2A850C328EAF5AB25878A9A961CA967B83F0CD5F7F952132FC21BD57070F08FC012CA06CB9AE1D9CA337A77D6F8ECB9F16844424813D2C0C2A4AE5E60FEB6A605FCB4DD075902D459189863F5A563E0900C7D5DB2067AF385EAEBD403AE5E843E5FFF15ED69BCF939367275CF77524DF3C9902CB93DE5C923533F1F2498215C079929BDC63AECE76E863A6B97746333BD681831F0788D76BFFC9E8E5D2A86A74D90DC271A390203010001A3453043301D0603551D0E04160414E59D5930824758CCACFA085436867B3AB5044DF030120603551D130101FF040830060101FF020103300E0603551D0F0101FF040403020106300D06092A864886F70D01010505000382010100850C5D8EE46F51684205A0DDBB4F27258403BDF764FD2DD730E3A41017EBDA2929B6793F76F6191323B8100AF958A4D46170BD04616A128A17D50ABDC5BC307CD6E90C258D86404FECCCA37E38C637114FEDDD68318E4CD2B30174EEBE755E07481A7F70FF165C84C07985B805FD7FBE6511A30FC002B4F852373904D5A9317A18BFA02AF41299F7A34582E33C5EF59D9EB5C89E7C2EC8A49E4E08144B6DFD706D6B1A63BD64E61FB7CEF0F29F2EBB1BB7F250887392C2E2E3168D9A3202AB8E18DDE91011EE7E35AB90AF3E30947AD0333DA7650FF5FC8E9E62CF47442C015DBB1DB532D247D2382ED0FE81DC326A1EB5EE3CD5FCE7811D19C32442EA6339A9
Executable files
22
Suspicious files
0
Text files
20
Unknown types
0

Dropped files

PID
Process
Filename
Type
2728spirit-fortnite-injector.zip.exeC:\Users\admin\AppData\Local\Temp\7zS8AADDD8B\BundleConfig.jsontext
MD5:0F3C5140CABAB53ACF9B8F76A43BC910
SHA256:E5FB77DC271B822F797C04A022149B4EC0442221D18635CF4055B7F549A3470D
2728spirit-fortnite-injector.zip.exeC:\Users\admin\AppData\Local\Temp\7zS8AADDD8B\Resources\OfferPage.htmlhtml
MD5:53A4925B3382E7DB8472D92A67BA94F4
SHA256:19180A9E414034A059503F88E385D4C9372576E56F0222F8D3A60024DBD8A7C8
2728spirit-fortnite-injector.zip.exeC:\Users\admin\AppData\Local\Temp\7zS8AADDD8B\Resources\style.csstext
MD5:4C8C0D2041A52FF69A71A1462D492CB6
SHA256:F184542E422AFEA9F3C2C2CA589E1427467BE22A039D0C31D8FD95F1AAB49E49
2728spirit-fortnite-injector.zip.exeC:\Users\admin\AppData\Local\Temp\7zS8AADDD8B\Resources\images\cherry-player-logo.pngimage
MD5:15F948325152E7C99D900EE4DADE93EA
SHA256:C7004BF44810058E1F3ABDFD01B3881E9B945C05DD10660EEBE8C215519D4D3B
2728spirit-fortnite-injector.zip.exeC:\Users\admin\AppData\Local\Temp\7zS8AADDD8B\GenericSetup.exeexecutable
MD5:CC7F3C2AEC42DB29F5EC9A22AC08585E
SHA256:E91391F1F53FE5E0C6575570B09F6D1B10D0BB855B5C1B65F13743185E39A9EC
2728spirit-fortnite-injector.zip.exeC:\Users\admin\AppData\Local\Temp\7zS8AADDD8B\Resources\tis\EventHandler.tistext
MD5:E40D7878D88D2D55119E2D28A994653E
SHA256:2DBB0A6C28F1A4C199B3090AA17147BD4F784458B0663BCB75E18C17090101B7
2728spirit-fortnite-injector.zip.exeC:\Users\admin\AppData\Local\Temp\7zS8AADDD8B\Resources\tis\Config.tistext
MD5:FB1C09FC31CE983ED99D8913BB9F1474
SHA256:293959C3F8EBB87BFFE885CE2331F0B40AB5666F9D237BE4791ED4903CE17BF4
2728spirit-fortnite-injector.zip.exeC:\Users\admin\AppData\Local\Temp\7zS8AADDD8B\Resources\tis\Log.tistext
MD5:CEF7A21ACF607D44E160EAC5A21BDF67
SHA256:73ED0BE73F408AB8F15F2DA73C839F86FEF46D0A269607330B28F9564FAE73C7
2728spirit-fortnite-injector.zip.exeC:\Users\admin\AppData\Local\Temp\7zS8AADDD8B\Resources\tis\ViewStateLoader.tistext
MD5:CFA267DB7E3295C099F9AE454FD23331
SHA256:5EA24E0CB28EA1F50CC2BEEF1EB0C1B9BA2A5099B63F66F2A4EE2ED60CFE30FD
2728spirit-fortnite-injector.zip.exeC:\Users\admin\AppData\Local\Temp\7zS8AADDD8B\Resources\WelcomePage.htmlhtml
MD5:05EC0B98E13AA9C2290D43BA3544FEF2
SHA256:574A1BB37654813EBDC73EE8C0696069CDAC80CAC7D975FC40FA6B5252406402
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
6
DNS requests
6
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2180
installer.exe
POST
200
104.18.88.101:80
http://flow.lavasoft.com/v1/event-stat?ProductID=IS&Type=StubStart
US
text
29 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2180
installer.exe
104.18.88.101:80
flow.lavasoft.com
Cloudflare Inc
US
shared
1292
GenericSetup.exe
104.16.236.79:443
h2oapi.adaware.com
Cloudflare Inc
US
shared
1292
GenericSetup.exe
104.16.235.79:443
h2oapi.adaware.com
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
h2oapi.adaware.com
  • 104.16.235.79
  • 104.16.236.79
malicious
flow.lavasoft.com
  • 104.18.88.101
  • 104.18.87.101
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
sos.adaware.com
  • 104.16.236.79
  • 104.16.235.79
whitelisted

Threats

PID
Process
Class
Message
2180
installer.exe
A Network Trojan was detected
ET MALWARE Lavasoft PUA/Adware Client Install
Process
Message
GenericSetup.exe
GenericSetup.exe
at sciter:init-script.tis
GenericSetup.exe
at sciter:init-script.tis
GenericSetup.exe
file:resources/tis/TranslateOfferTemplate.tis(82) : warning :'async' does not contain any 'await'
GenericSetup.exe
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
spirit-fortnite-injector.zip.exe