File name:

HQ Fortnite Checker Leaked by @Flash Cracked.To.rar

Full analysis: https://app.any.run/tasks/2d3e2626-3acb-4084-90b4-2e44c9543f9d
Verdict: Malicious activity
Analysis date: June 05, 2019, 20:13:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

1143972D1ED37060BF22DD610C228267

SHA1:

71C2FC2C52032807744493F5935634E30477454C

SHA256:

9B563257C2C680331E2B7559CC60643B26C446B9BC260BFD8F9B20AB547EF900

SSDEEP:

49152:ru1e7Xk96bEbbM8YWlCt/KryLTfo1XztX:rO6XksbEOQCt/YyL8RztX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • FortNite Brute_Checker.exe (PID: 3972)

    • Loads dropped or rewritten executable

      • FortNite Brute_Checker.exe (PID: 3972)
      • SearchProtocolHost.exe (PID: 3572)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2100)

    • Reads Environment values

      • FortNite Brute_Checker.exe (PID: 3972)

    • Reads Internet Cache Settings

      • FortNite Brute_Checker.exe (PID: 3972)

  • INFO

    • Manual execution by user

      • WinRAR.exe (PID: 2100)
      • FortNite Brute_Checker.exe (PID: 3972)

    • Reads settings of System Certificates

      • FortNite Brute_Checker.exe (PID: 3972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe fortnite brute_checker.exe searchprotocolhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1520"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\HQ Fortnite Checker Leaked by @Flash Cracked.To.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2100"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\HQ Fortnite Checker Leaked by @Flash Cracked.To.rar" "C:\Users\admin\Desktop\HQ Fortnite Checker Leaked by @Flash Cracked.To\"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3572"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3972"C:\Users\admin\Desktop\HQ Fortnite Checker Leaked by @Flash Cracked.To\FortNite Brute_Checker.exe" C:\Users\admin\Desktop\HQ Fortnite Checker Leaked by @Flash Cracked.To\FortNite Brute_Checker.exe
explorer.exe
User:
admin
Company:
FortNite Brute_Checker
Integrity Level:
MEDIUM
Description:
FortNite Brute_Checker
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\hq fortnite checker leaked by @flash cracked.to\fortnite brute_checker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
1 471
Read events
1 356
Write events
111
Delete events
4

Modification events

(PID) Process:(1520) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1520) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1520) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1520) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\HQ Fortnite Checker Leaked by @Flash Cracked.To.rar
(PID) Process:(1520) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1520) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1520) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1520) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1520) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:@C:\Windows\system32\notepad.exe,-469
Value:
Text Document
(PID) Process:(1520) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
120
Executable files
3
Suspicious files
5
Text files
4
Unknown types
2

Dropped files

PID
Process
Filename
Type
3972FortNite Brute_Checker.exeC:\Users\admin\AppData\Local\Temp\CabA550.tmp —
MD5:—
SHA256:—
3972FortNite Brute_Checker.exeC:\Users\admin\AppData\Local\Temp\TarA551.tmp —
MD5:—
SHA256:—
3972FortNite Brute_Checker.exeC:\Users\admin\AppData\Local\Temp\CabA581.tmp —
MD5:—
SHA256:—
3972FortNite Brute_Checker.exeC:\Users\admin\AppData\Local\Temp\TarA582.tmp —
MD5:—
SHA256:—
3972FortNite Brute_Checker.exeC:\Users\admin\AppData\Local\Temp\CabA67D.tmp —
MD5:—
SHA256:—
3972FortNite Brute_Checker.exeC:\Users\admin\AppData\Local\Temp\TarA67E.tmp —
MD5:—
SHA256:—
2100WinRAR.exeC:\Users\admin\Desktop\HQ Fortnite Checker Leaked by @Flash Cracked.To\FortNite Brute_Checker.exeexecutable
MD5:—
SHA256:—
2100WinRAR.exeC:\Users\admin\Desktop\HQ Fortnite Checker Leaked by @Flash Cracked.To\39.txttext
MD5:—
SHA256:—
2100WinRAR.exeC:\Users\admin\Desktop\HQ Fortnite Checker Leaked by @Flash Cracked.To\FortNite Brute_Checker.xmlxml
MD5:—
SHA256:—
2100WinRAR.exeC:\Users\admin\Desktop\HQ Fortnite Checker Leaked by @Flash Cracked.To\FortNite Brute_Checker.pdbpdb
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
252
DNS requests
7
Threats
162

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3972
FortNite Brute_Checker.exe
GET
200
205.185.216.42:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
56.2 Kb
whitelisted
3972
FortNite Brute_Checker.exe
GET
200
52.222.146.167:80
http://x.ss2.us/x.cer
US
der
1.27 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
178.128.90.237:8080
—
Forthnet
GR
suspicious
3972
FortNite Brute_Checker.exe
50.62.35.107:31028
—
GoDaddy.com, LLC
US
suspicious
3972
FortNite Brute_Checker.exe
122.116.161.100:30127
—
Data Communication Business Group
TW
unknown
3972
FortNite Brute_Checker.exe
46.105.57.150:26026
—
OVH SAS
FR
suspicious
3972
FortNite Brute_Checker.exe
70.168.93.218:17026
—
Cox Communications Inc.
US
suspicious
3972
FortNite Brute_Checker.exe
41.211.104.247:9999
—
Matrix-ASN1
CM
unknown
3972
FortNite Brute_Checker.exe
41.191.204.80:9999
—
VODACOM-LESOTHO
LS
suspicious
3972
FortNite Brute_Checker.exe
138.68.59.157:1210
—
Digital Ocean, Inc.
US
suspicious
3972
FortNite Brute_Checker.exe
35.185.64.205:1080
—
Google Inc.
US
unknown
3972
FortNite Brute_Checker.exe
132.148.130.46:4329
—
GoDaddy.com, LLC
US
suspicious

DNS requests

Domain
IP
Reputation
account-public-service-prod03.ol.epicgames.com
  • 35.175.48.36
  • 52.206.66.49
  • 34.236.199.170
  • 35.174.188.152
  • 34.225.14.179
  • 52.20.233.92
  • 34.232.244.217
  • 52.202.122.46
  • 34.205.183.103
  • 34.195.182.26
  • 34.193.67.210
  • 34.194.245.227
  • 34.193.152.151
  • 34.196.202.237
  • 34.197.172.233
  • 3.92.153.152
  • 54.83.95.253
  • 52.71.161.195
  • 107.23.234.211
  • 52.3.178.115
  • 52.55.154.22
  • 52.70.33.122
  • 34.235.15.141
  • 52.202.222.43
  • 54.152.179.146
  • 52.2.144.95
  • 52.201.68.62
  • 52.21.234.37
  • 52.203.121.38
  • 52.72.190.169
  • 52.86.75.185
  • 52.54.191.161
  • 34.226.179.72
  • 34.196.117.233
  • 34.206.224.52
  • 34.228.154.101
  • 34.231.227.192
  • 34.236.207.126
  • 52.7.33.10
  • 54.210.61.39
suspicious
x.ss2.us
  • 52.222.146.167
  • 52.222.146.11
  • 52.222.146.170
  • 52.222.146.195
whitelisted
www.download.windowsupdate.com
  • 205.185.216.42
  • 205.185.216.10
whitelisted

Threats

PID
Process
Class
Message
3972
FortNite Brute_Checker.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] Socks4 Connection
3972
FortNite Brute_Checker.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] Socks4 Connection
3972
FortNite Brute_Checker.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] Socks4 Connection
3972
FortNite Brute_Checker.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] Socks4 Connection
3972
FortNite Brute_Checker.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] Socks4 Connection
3972
FortNite Brute_Checker.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] Socks4 Connection
3972
FortNite Brute_Checker.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] Socks4 Connection
3972
FortNite Brute_Checker.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] Socks4 Connection
3972
FortNite Brute_Checker.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] Socks4 Connection
3972
FortNite Brute_Checker.exe
Potential Corporate Privacy Violation
POLICY [PTsecurity] Socks4 Connection
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HQ Fortnite Checker Leaked by @Flash Cracked.To.rar