File name: | Fortnite Hack.rar |
Full analysis: | https://app.any.run/tasks/4be5bbcf-ba92-4363-b766-41710e72d07e |
Verdict: | Malicious activity |
Analysis date: | December 14, 2018, 14:29:00 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-rar |
File info: | RAR archive data, v5 |
MD5: | 1BB83158B71005A970CBD1F5AF155AAA |
SHA1: | 355EA0BBA994DC306D59607CC46CF6F8D21E6443 |
SHA256: | 9D87AD899D9FE15A76E5EC43ECCEF05E7A8732BAD4C1C2D10B55281614BA5230 |
SSDEEP: | 3072:0RyuQZuSLOv6Ft0TltoFpq/xFzvbZMT154Aswjvm16Cz0+gp44oT2:0R3QEvtjg0/bzFMTLA3z0+g62 |
.rar | | | RAR compressed archive (v5.0) (61.5) |
---|---|---|
.rar | | | RAR compressed archive (gen) (38.4) |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2944 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Fortnite Hack.rar" | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | |
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.60.0 | ||||
336 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Exit code: 0 Version: 7.00.7600.16385 (win7_rtm.090713-1255) | ||||
3212 | "C:\Users\admin\Desktop\Fortnite Hack\Fortnite Hack.exe" | C:\Users\admin\Desktop\Fortnite Hack\Fortnite Hack.exe | explorer.exe | |
User: admin Company: NVIDIA GeForce Experience Integrity Level: MEDIUM Description: NVIDIA GeForce Experience Exit code: 0 Version: 64.3282.1731.2 | ||||
2988 | "C:\Users\admin\AppData\Local\Temp\winload.exe" | C:\Users\admin\AppData\Local\Temp\winload.exe | — | Fortnite Hack.exe |
User: admin Company: NVIDIA GeForce Experience Integrity Level: MEDIUM Description: NVIDIA GeForce Experience Exit code: 0 Version: 64.3282.1731.2 | ||||
2772 | "C:\Users\admin\AppData\Local\Temp\winload.exe" | C:\Users\admin\AppData\Local\Temp\winload.exe | winload.exe | |
User: admin Company: NVIDIA GeForce Experience Integrity Level: MEDIUM Description: NVIDIA GeForce Experience Exit code: 0 Version: 64.3282.1731.2 | ||||
2432 | "C:\Users\admin\AppData\Local\Temp\svhost.exe" | C:\Users\admin\AppData\Local\Temp\svhost.exe | winload.exe | |
User: admin Company: NVIDIA GeForce Experience Integrity Level: MEDIUM Description: NVIDIA GeForce Experience Exit code: 0 Version: 64.3282.1731.2 | ||||
3948 | "C:\Users\admin\AppData\Local\Temp\winload.exe" | C:\Users\admin\AppData\Local\Temp\winload.exe | — | svhost.exe |
User: admin Company: NVIDIA GeForce Experience Integrity Level: MEDIUM Description: NVIDIA GeForce Experience Exit code: 0 Version: 64.3282.1731.2 | ||||
1856 | "C:\Users\admin\AppData\Local\Temp\winload.exe" | C:\Users\admin\AppData\Local\Temp\winload.exe | winload.exe | |
User: admin Company: NVIDIA GeForce Experience Integrity Level: MEDIUM Description: NVIDIA GeForce Experience Exit code: 0 Version: 64.3282.1731.2 | ||||
2392 | "C:\Users\admin\AppData\Local\Temp\svhost.exe" | C:\Users\admin\AppData\Local\Temp\svhost.exe | winload.exe | |
User: admin Company: NVIDIA GeForce Experience Integrity Level: MEDIUM Description: NVIDIA GeForce Experience Exit code: 0 Version: 64.3282.1731.2 | ||||
3852 | "C:\Users\admin\AppData\Local\Temp\winload.exe" | C:\Users\admin\AppData\Local\Temp\winload.exe | — | svhost.exe |
User: admin Company: NVIDIA GeForce Experience Integrity Level: MEDIUM Description: NVIDIA GeForce Experience Exit code: 0 Version: 64.3282.1731.2 |
(PID) Process: | (2944) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtBMP |
Value: | |||
(PID) Process: | (2944) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
Operation: | write | Name: | ShellExtIcon |
Value: | |||
(PID) Process: | (2944) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (2944) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Fortnite Hack.rar | |||
(PID) Process: | (2944) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | name |
Value: 120 | |||
(PID) Process: | (2944) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | size |
Value: 80 | |||
(PID) Process: | (2944) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | type |
Value: 120 | |||
(PID) Process: | (2944) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
Operation: | write | Name: | mtime |
Value: 100 | |||
(PID) Process: | (2944) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath |
Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop | |||
(PID) Process: | (3212) Fortnite Hack.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\Run\CurrentVersion |
Operation: | write | Name: | winload.exe |
Value: C:\Users\admin\AppData\Local\Temp\winload.exe |
PID | Process | Filename | Type | |
---|---|---|---|---|
2772 | winload.exe | C:\Users\admin\AppData\Local\Temp\svhost.exe | executable | |
MD5:E12701E66AA27E8CC0B3C7CA271FDEBC | SHA256:A43B31FBDD609DFB40874D39B7E8986AD995C48E23E29A4CF72B95248DC9BE4C | |||
1384 | winload.exe | C:\Users\admin\AppData\Local\Temp\svhost.exe | executable | |
MD5:E12701E66AA27E8CC0B3C7CA271FDEBC | SHA256:A43B31FBDD609DFB40874D39B7E8986AD995C48E23E29A4CF72B95248DC9BE4C | |||
2392 | svhost.exe | C:\Users\admin\AppData\Local\Temp\winload.exe | executable | |
MD5:E12701E66AA27E8CC0B3C7CA271FDEBC | SHA256:A43B31FBDD609DFB40874D39B7E8986AD995C48E23E29A4CF72B95248DC9BE4C | |||
1856 | winload.exe | C:\Users\admin\AppData\Local\Temp\svhost.exe | executable | |
MD5:E12701E66AA27E8CC0B3C7CA271FDEBC | SHA256:A43B31FBDD609DFB40874D39B7E8986AD995C48E23E29A4CF72B95248DC9BE4C | |||
2944 | WinRAR.exe | C:\Users\admin\Desktop\Fortnite Hack\php5ts.dll | executable | |
MD5:1E6FDCD6D847BBF9CD3A37BA72CDA3F7 | SHA256:06754CB39C2E814577AC287B7DD0083F59933C867038407CDDFB22EBC6C0F193 | |||
2944 | WinRAR.exe | C:\Users\admin\Desktop\Fortnite Hack\Fortnite Hack.exe | executable | |
MD5:E12701E66AA27E8CC0B3C7CA271FDEBC | SHA256:A43B31FBDD609DFB40874D39B7E8986AD995C48E23E29A4CF72B95248DC9BE4C | |||
3212 | Fortnite Hack.exe | C:\Users\admin\AppData\Local\Temp\winload.exe | executable | |
MD5:E12701E66AA27E8CC0B3C7CA271FDEBC | SHA256:A43B31FBDD609DFB40874D39B7E8986AD995C48E23E29A4CF72B95248DC9BE4C | |||
2432 | svhost.exe | C:\Users\admin\AppData\Local\Temp\winload.exe | executable | |
MD5:E12701E66AA27E8CC0B3C7CA271FDEBC | SHA256:A43B31FBDD609DFB40874D39B7E8986AD995C48E23E29A4CF72B95248DC9BE4C | |||
2720 | winload.exe | C:\Users\admin\AppData\Local\Temp\svhost.exe | executable | |
MD5:E12701E66AA27E8CC0B3C7CA271FDEBC | SHA256:A43B31FBDD609DFB40874D39B7E8986AD995C48E23E29A4CF72B95248DC9BE4C | |||
1668 | svhost.exe | C:\Users\admin\AppData\Local\Temp\winload.exe | executable | |
MD5:E12701E66AA27E8CC0B3C7CA271FDEBC | SHA256:A43B31FBDD609DFB40874D39B7E8986AD995C48E23E29A4CF72B95248DC9BE4C |