File name:

Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe

Full analysis: https://app.any.run/tasks/8ea0a7b7-8e4f-4e1f-922d-5417232f38c6
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Analysis date: March 16, 2025, 22:46:37
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
sality
sainbox
rat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 10 sections
MD5:

10E2E1D6446135B4B0EFA284EE5E2F3D

SHA1:

F0D43421CD7C74597F02CA77BE0B4C0B8B489485

SHA256:

F8C306717404E547EB3B33AC8B4C50EA9DD828E72DBD661E36608C82F4A1DC7B

SSDEEP:

98304:H+QqZ8fOerIXe0eZWI1O4dmt7DCEpzGbRjtL4olDX3hd9p1pKGRsLQC9KA+iCIcb:zTz7CMI/s

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • SAINBOX has been detected

      • Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe (PID: 732)
    • SALITY mutex has been found

      • Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe (PID: 732)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe (PID: 732)
  • INFO

    • Checks supported languages

      • Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe (PID: 732)
      • Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.tmp (PID: 3332)
    • Reads the computer name

      • Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.tmp (PID: 3332)
      • Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe (PID: 732)
    • Create files in a temporary directory

      • Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe (PID: 732)
    • Reads the software policy settings

      • slui.exe (PID: 3888)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:11:15 09:48:30+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741376
InitializedDataSize: 157184
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 1.4.1.0
ProductVersionNumber: 1.4.1.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: Linkvertise GmbH & Co. KG
FileVersion: 1.4.1
LegalCopyright:
OriginalFileName:
ProductName: Linkvertise GmbH & Co. KG
ProductVersion: 1.4.1
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SALITY hydro fortnite spoofer - linkvertise downloader_nj4-ga1.exe hydro fortnite spoofer - linkvertise downloader_nj4-ga1.tmp no specs sppextcomobj.exe no specs slui.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
732"C:\Users\admin\AppData\Local\Temp\Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe" C:\Users\admin\AppData\Local\Temp\Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Linkvertise GmbH & Co. KG
Exit code:
1
Version:
1.4.1
Modules
Images
c:\users\admin\appdata\local\temp\hydro fortnite spoofer - linkvertise downloader_nj4-ga1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2980C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3332"C:\Users\admin\AppData\Local\Temp\is-E68TU.tmp\Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.tmp" /SL5="$B028A,1793745,899584,C:\Users\admin\AppData\Local\Temp\Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe" C:\Users\admin\AppData\Local\Temp\is-E68TU.tmp\Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.tmpHydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\is-e68tu.tmp\hydro fortnite spoofer - linkvertise downloader_nj4-ga1.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
3888"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6392C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exesvchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
778
Read events
766
Write events
12
Delete events
0

Modification events

(PID) Process:(732) Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:GlobalUserOffline
Value:
0
(PID) Process:(732) Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143
Operation:writeName:1768776801
Value:
153
(PID) Process:(732) Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143
Operation:writeName:-757413694
Value:
0
(PID) Process:(732) Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143
Operation:writeName:1011363107
Value:
0
(PID) Process:(732) Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143
Operation:writeName:-1514827388
Value:
35
(PID) Process:(732) Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143
Operation:writeName:253949413
Value:
302
(PID) Process:(732) Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143
Operation:writeName:2022726214
Value:
0800687474703A2F2F627573696E65636573736974792E636F6D2F6C6F676F2E67696600687474703A2F2F616C2D736F6D6F772E636F6D2F696D616765732F6C6F676F2E67696600687474703A2F2F616D6E69737572652E636F6D2E74722F696D616765732F6C6F676F2E67696600687474703A2F2F62686167617661746972616E6E6164652E6F72672F6C6F676F2E67696600687474703A2F2F616E6B6172612D63616D62616C6B6F6E2E6E65742F696D616765732F6C6F676F2E67696600687474703A2F2F616F63756F696B68616E686C696E682E766E2F696D616765732F6C6F676F2E67696600687474703A2F2F79656E692E616E74616C796168696C616C2E636F6D2F6C6F676F2E67696600687474703A2F2F6172696D616578696D2E636F6D2F6C6F676F2E676966
(PID) Process:(732) Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp\-227342143
Operation:writeName:-503464281
Value:
96D3CDDE1C47B6A5FC358E558DE5299650540F2D50E5B087B8550A1861A21FDD2D08CFD143520423640DF1B597E13A5AA874C82897D59B5DC0680E58CE7259E3740BA29EE6BB43137ECE07AEF1C391CF0D6BDB7CAFE72C3B3933EF3874B3E349C7516230896C2320F5AD567F594746C1E5F1686CDF8A85051E8105B44B94E21E
(PID) Process:(732) Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp
Operation:writeName:a1_0
Value:
159343150
(PID) Process:(732) Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Aaspp
Operation:writeName:a2_0
Value:
6759
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
732Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exeC:\Users\admin\AppData\Local\Temp\0010B817_Rar\Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exeexecutable
MD5:10E2E1D6446135B4B0EFA284EE5E2F3D
SHA256:F8C306717404E547EB3B33AC8B4C50EA9DD828E72DBD661E36608C82F4A1DC7B
732Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.exeC:\Users\admin\AppData\Local\Temp\is-E68TU.tmp\Hydro Fortnite Spoofer - Linkvertise Downloader_nJ4-GA1.tmpexecutable
MD5:45E61D4831803F7B07D8FA633F26DD55
SHA256:FAAD724F850B2850BC0979F8DB1450252D72EC3FBF40DEBB2EABCF5E27EEAF1D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
6584
SIHClient.exe
GET
200
104.115.34.42:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
6584
SIHClient.exe
GET
200
104.115.34.42:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
192.168.100.255:137
whitelisted
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
5496
MoUsoCoreWorker.exe
88.221.110.122:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
88.221.110.122:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
6620
backgroundTaskHost.exe
20.103.156.88:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6620
backgroundTaskHost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 142.250.181.238
whitelisted
crl.microsoft.com
  • 88.221.110.122
  • 88.221.110.114
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.31.67
  • 40.126.31.128
  • 20.190.159.131
  • 20.190.159.73
  • 40.126.31.3
  • 20.190.159.68
  • 40.126.31.0
  • 20.190.159.4
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 104.115.34.42
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info