MalwareTipsTools

File scan report

Scan another file

Verdict Malicious

Analyzed , 7 hours ago

Is FORTNITE-MACROS-EDITOR-V2.5-main.zip safe? No, we rate this exact file malicious.

This archive is packaged as a Fortnite macro tool, but 41 of the 69 antivirus engines that checked it flag it, several naming the Lumma infostealer, and it drops a payload while showing a fake update message.

Strong evidence · Two or more major antivirus engines agree.

Don't open or extract this archive

Do not open or run this file; delete it. If it was executed, scan the PC with an up-to-date antivirus and change important passwords from a clean device.

What to do now4 steps

This ZIP archive is harmful. Don't open or extract it, and delete it.

If you haven't opened or extracted it

  1. Don't open or extract this archive. Delete the archive and any files you extracted from it, then empty the Recycle Bin or Trash.

If you already opened or extracted it

  1. If you already extracted it, delete the extracted files too and run a full antivirus scan.

  2. If a page it opened asked for a password or card details and you entered them, change that password and call your bank.

  3. It created a file that antivirus engines classify as malicious, so run a full scan, not a quick one.

If you opened or installed it

Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.

Paste this report's link in your topic so helpers can see what was found.

Why we think so

Share this file report

FORTNITE-MACROS-EDITOR-V2.5-main.zip: Malicious — MalwareTips file scan

The link always shows the latest result for this exact file (its SHA-256 fingerprint).

Antivirus results

41 of 69 flagged

  • Flagged 41
  • No detection 28
  • No result 7
FileFORTNITE-MACROS-EDITOR-V2.5-main.zip8.6 MBSHA-256 62cd1676fe0e…7a7d6d
  • Code signing Not applicable
  • Test run Completed
  • First seen 1y ago
It created a file that antivirus engines classify as malicious.

Chapter 02

Why we think so

6 points against it and 0 in its favour, checked against the scan evidence.

MT AI Engine · Verdict analysis

The reasoning behind this verdict

Analyst conclusion

41 of the 69 antivirus engines that checked it flag this ZIP, including Kaspersky and TrendMicro with Lumma stealer detections. When run, it shows a fake 'Checking for updates' dialog while loading a DLL and writing an executable into AppData. A dropped file is also listed as malware.

Full reasoning

The archive was flagged by 41 of the 69 antivirus engines that checked it, 32 of them independent after removing shared scan engines, and 11 major antivirus engines agreed it is malicious. Kaspersky, TrendMicro, VBA32 and Lionic use Lumma stealer labels, a family known for stealing credentials and crypto wallets. Sandbox runs show a fake updater message box, rundll32 loading Family.dll, and a new executable written to AppData\Roaming. One dropped file is also listed in MalwareBazaar as malicious. The game-macro filename is a typical lure for this kind of stealer.

Detailed assessment

What We Detected

Forty-one of the 69 antivirus engines that checked it flag this ZIP. Kaspersky and TrendMicro identify it as the Lumma information stealer, and other engines label it a downloader or dropper.

Threat Behavior

The sandbox shows the bundled executable launching a PowerShell message box that says 'Checking for updates...' as a distraction, while rundll32 loads Family.dll and an executable is written into the user's AppData\Roaming folder. The sample also contacted pastebin.com, which stealers often use to fetch configuration. A dropped file is listed as malicious in a public malware database.

What To Do Now

Do not run anything from this archive. If it was already run, disconnect from the network, run a full antivirus scan, and change passwords for accounts used on that PC from a clean device.
Where this verdict could be wrong2 caveats
  • Sandbox verdicts were not recorded and the two sandbox runs show no injected process or confirmed network a control server beyond a pastebin.com contact.
  • Major family consensus on Lumma is only 3 engines, and many other labels are vendor generic buckets (Trojan.Generic, MalwareX, Artemis).

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

Points against
  • 41 of the 69 antivirus engines that checked it flag the archive, including 11 major antivirus engines
  • Kaspersky and TrendMicro name the Lumma information stealer
  • A dropped file is listed as malicious in a public malware database
  • Fake 'Checking for updates' message box shown while a DLL is loaded through rundll32
  • Writes an executable into the user's AppData Roaming folder
  • Game-cheat style filename is a common lure for stealers

6 sources checked · all complete. See every source

Chapter 03

What it did in our test

It ran in 2 isolated tests; no test environment rated what it did as risky.

Test run summary

Capture complete
  • 2isolated sandbox runs
  • 24sandbox rule tags
  • 8spawned processes
  • 3network contacts
  • 19filesystem & mutex artifacts

What the test run showed

What the file did on a test computer

Confirmed in the test run

  • High concern: Created a file that antivirus engines classify as malicious.

  • Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).

  • Moderate concern: Ran commands or a script on the test computer.

  • Moderate concern: Used an unusual way to talk to a server.

  • Moderate concern: Checked whether it was running on a test computer.

  • Moderate concern: Hid files or windows on the test computer.

  • Note: Listed the programs running on the test computer.

Sandbox labels we could not confirm (common in safe files too)

  • Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.

  • Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.

  • Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.

This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.

Threat context

How password stealers work

A password stealer runs quietly in the background and copies your private data, such as saved passwords, browser cookies, autofill details and crypto wallets, then sends it to criminals. You usually won't notice anything.

Bottom line:Stolen logins are used to break into your accounts or sold in bulk, so change passwords from another device.

Recorded behavior

What happened in the test

Grouped by step. The order is not a timeline.

Seen in the test runWorked out from other results

  1. Input file

    The submitted object

    1
    1. Evidence 1 of 7: FileSeen in the test run

      FORTNITE-MACROS-EDITOR-V2.5-main.zip

      62cd1676fe0ef673a73754d930906bec3c1dbbf4d0c93b9fba35c744117a7d6d

      Uploaded file

  2. Processes

    What ran

    2
    1. Evidence 2 of 7: ProcessSeen in the test run

      FORTNITE MACROS EDITOR V2.5.exe

      "C:\Users\<USER>\AppData\Local\Temp\FORTNITE-MACROS-EDITOR-V2.5-main/FORTNITE MACROS EDITOR V2.5.exe"

      Test run
    2. Evidence 3 of 7: ProcessSeen in the test run

      powershell

      powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Checking for updates...', 'Updater', 'OK', 'Information')"

      Test run
    3. +1 more recorded observation

  3. Files

    Created or changed

    2
    1. Evidence 4 of 7: Dropped fileWorked out from other results

      775d25d0bc3125ae6df9a2e84cd448e2108ae7edf6d66916e39f97e9b5cb86e2

      A file it created, rated malicious.

      Files it created
    2. Evidence 5 of 7: Written fileSeen in the test run

      cada220096d3ef400.exe

      C:\Users\<USER>\AppData\Roaming\cada220096d3ef400.exe

      Test run
    3. +1 more recorded observation

  4. Network

    Hosts contacted

    2
    1. Evidence 6 of 7: Contacted hostSeen in the test run

      pastebin.com

      Contacted during the test run.

      Test run
    2. Evidence 7 of 7: Contacted hostSeen in the test run

      172.67.25.94

      Contacted during the test run.

      Test run
    3. +1 more recorded observation

7 facts from the test run. See the full activity list.

Runtime behaviour

What this file did when executed

This file was detonated in 2 sandboxes and its runtime behaviour was observed.

Techniques observed in the sandbox

24

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

  • T1010
  • T1012
  • T1014
  • T1027.002· Obfuscated code
  • T1036
  • T1055· Process injection
  • T1057· Lists programs
  • T1059· Runs commands
  • T1064
  • T1071· Application protocol
  • T1082· System recon
  • T1095· Custom network
  • T1102
  • T1106
  • T1496
  • T1497· Sandbox evasion
  • T1518.001· Checks your AV
  • T1542
  • T1542.003
  • T1562.001· Disables security
  • T1564· Hides artifacts
  • T1564.001· Hides artifacts
  • T1573
  • T1574.002· Execution hijack

Observed activity

Processes started
8

Programs the file ran, with their command lines.

  • FORTNITE MACROS EDITOR V2.5.exe"C:\Users\<USER>\AppData\Local\Temp\FORTNITE-MACROS-EDITOR-V2.5-main/FORTNITE MACROS EDITOR V2.5.exe"
  • powershellpowershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Checking for updates...', 'Updater', 'OK', 'Information')"
  • rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\FORTNITE-MACROS-EDITOR-V2.5-main/Family.dll",#1
  • unarchiver.exe"C:\Windows\System32\unarchiver.exe" "C:\Users\user\Desktop\FORTNITE-MACROS-EDITOR-V2.5-main.zip"
  • 7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\pvjrq2vu.acp" "C:\Users\user\Desktop\FORTNITE-MACROS-EDITOR-V2.5-main.zip"
  • cmd.exeC:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\pvjrq2vu.acp\FORTNITE-MACROS-EDITOR-V2.5-main\FORTNITE MACROS EDITOR V2.5.exe"
Show all 8 entries for processes started
  • FORTNITE MACROS EDITOR V2.5.exe"C:\Users\user\AppData\Local\Temp\pvjrq2vu.acp\FORTNITE-MACROS-EDITOR-V2.5-main\FORTNITE MACROS EDITOR V2.5.exe"
  • powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('Checking for updates...', 'Updater', 'OK', 'Information')"
Network contacts
3

3 hosts, listed as 1 domain, 2 addresses. Links show the host and path only.

  • Domainpastebin.com
  • IP address172.67.25.94
  • IP address104.22.68.199
Files
17

Files the file created, changed or deleted.

  • WrittenC:\Users\<USER>\AppData\Roaming\cada220096d3ef400.exe
  • WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • WrittenC:\Users\<USER>\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
  • Written\Device\ConDrv\Connect
  • Written\Device\ConDrv\Server
  • Written\Device\ConDrv\\Reference
Show all 17 entries for files
  • WrittenC:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
  • WrittenC:\ProgramData\Microsoft\Network\Downloader\edb.log
  • WrittenC:\ProgramData\Microsoft\Network\Downloader\qmgr.db
  • WrittenC:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm
  • WrittenC:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
  • WrittenC:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0mtblnav.fmz.psm1
  • WrittenC:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r5v5pqpe.0so.ps1
  • WrittenC:\Users\user\AppData\Local\Temp\pvjrq2vu.acp
  • WrittenC:\Users\user\AppData\Local\Temp\pvjrq2vu.acp\FORTNITE-MACROS-EDITOR-V2.5-main
  • DeletedC:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0mtblnav.fmz.psm1
  • DeletedC:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r5v5pqpe.0so.ps1
Registry and auto-start
2

Settings the file changed, including ways to start again after a restart.

  • SetHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\Config\LastKnownGoodTime
  • SetHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS\PerfMMFileName
Mutexes
2

Named locks a program uses so only one copy runs; malware families often reuse them.

  • \BaseNamedObjects\Local\SM0:5152:304:WilStaging_02
  • \BaseNamedObjects\Global\Instance0: ESENT Performance Data Schema Version 305
Sandbox background — not the file
7

The analysis machine's own processes and connections, recorded in every run.

  • VM processservices.exeC:\Windows\system32\services.exe
  • VM processsvchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p
  • VM processsvchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup
  • VM processsvchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
  • VM processlsass.exeC:\Windows\system32\lsass.exe
  • VM processsvchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time
Show all 7 entries for sandbox background — not the file
  • VM processconhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Dropped payload

Files this sample writes at runtime

The sandbox saw this file drop 10 children. 1 of them is already known-malicious (in our database or listed in MalwareBazaar) — this file is a dropper.

1 malicious9 not checked
  • 71f5d38e9436fb0b2e88…1cd022Not checked
    no saved verdict
  • 775d25d0bc3125ae6df9…cb86e2Malicious
    trust 5listed in MalwareBazaar · not scanned here
  • 4f61acc06a7b4cda80db…739abaNot checked
    no saved verdict
  • 57246c8e89c54b7df951…97d46eNot checked
    no saved verdict
  • 36bca3b5c96433b6a4a0…5c319eNot checked
    no saved verdict
  • bc112c7b85466f7852fe…7d4b60Not checked
    no saved verdict
  • 9b0dc9743d092e5ff0bd…9b5985Not checked
    no saved verdict
  • a8fa7d9e54dd5518ad05…0fa639Not checked
    no saved verdict
  • 27ad01ca09d41494a529…756083Not checked
    no saved verdict
  • afa19385ad7472966689…4c1232Not checked
    no saved verdict

Chapter 04

Technical details

41 of the 69 antivirus engines that checked it flag it.

Sources checked

Every check behind this verdict

6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.

SourceStatusResultChecked
Antivirus enginesVirusTotal · 76 enginesCompleteRisk signal: 41 of 69 engines flagged it · 7 gave no result Details for antivirus engines
Sandbox runVirusTotal sandboxes · CAPE Sandbox, ZenboxComplete2 runs, no sandbox verdict recorded Details for sandbox run
Contacted hostsMalwareTips URL scannerComplete3 contacted hosts checked Details for contacted hosts
Signature rulesYARAify community rules + MalwareTips rulesComplete1 MalwareTips behaviour rule Details for signature rules
Malware sample databaseabuse.ch MalwareBazaarCompleteNot listed
Known-software referenceCIRCL hashlookupCompleteNo match

Engines that flagged it 41

  • Avast (major engine)Win64:MalwareX-gen [Drp]
  • AVG (major engine)Win64:MalwareX-gen [Drp]
  • Avira (major engine)TR/Dldr.Agent.yldvf
  • BitDefender (major engine)Trojan.Generic.37999547
  • DrWeb (major engine)Trojan.DownLoader48.41551
  • Emsisoft (major engine)Trojan.Generic.37999547 (B)
  • ESET-NOD32 (major engine)a variant of WinGo/TrojanDownloader.Agent.MT
  • F-Secure (major engine)Trojan.TR/Dldr.Agent.yldvf
33 more in the full engine list

File fingerprint

Last analyzed
Nov 10, 2026, 9:26 PM UTC
SHA-256
62cd1676fe0ef673a73754d930906bec3c1dbbf4d0c93b9fba35c744117a7d6d
SHA-1
ae2041018d51668743c6851e9a522a7d20128cf0
MD5
b8a3afbfffef99029fa52261a7360888

About this file

FORTNITE-MACROS-EDITOR-V2.5-main.zip is a ZIP file of 8.6 MB.

Type and size
ZIP · 8.6 MB
Signer
Not applicable
First seen
Jul 3, 2025On VirusTotal.
Submitted by
8 distinct sourcesRarely seen: few people have submitted this exact file.

First scanned

Antivirus consensus

41 of 69 engines flagged this file

41 malicious0 suspicious28 not flagged7 no result

7 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

The 41 detections come from 32 independent scan engines: several vendors license the same engine, so their results are one vote.

  • Tier-118 engines
    11flagged
    16 vendors sharing 11 engines
  • Tier-237 engines
    16flagged
    19 vendors sharing 16 engines
  • Low-trust14 engines
    6flagged
View all 76 engine results
  • AhnLab-V3Malicious: Trojan/Win.Generic.R707173
  • ALYacMalicious: Trojan.Generic.37999547
  • Antiy-AVLMalicious: Trojan[Dropper]/Win32.Convagent
  • ArcabitMalicious: Trojan.Generic.D243D3BB
  • AvastMalicious: Win64:MalwareX-gen [Drp]
  • AVGMalicious: Win64:MalwareX-gen [Drp]
  • AviraMalicious: TR/Dldr.Agent.yldvf
  • BitDefenderMalicious: Trojan.Generic.37999547
  • CAT-QuickHealMalicious: Trojan.Ghanarava.17503503787304fc
  • CTXMalicious: zip.trojan.generic
  • CynetMalicious: Malicious (score: 99)
  • DeepInstinctMalicious: MALICIOUS
  • DrWebMalicious: Trojan.DownLoader48.41551
  • ElasticMalicious: malicious (high confidence)
  • EmsisoftMalicious: Trojan.Generic.37999547 (B)
  • ESET-NOD32Malicious: a variant of WinGo/TrojanDownloader.Agent.MT
  • F-SecureMalicious: Trojan.TR/Dldr.Agent.yldvf
  • FortinetMalicious: W32/Agent.MT!tr.dldr
  • GDataMalicious: Win64.Trojan.Agent.4JXPOW
  • GoogleMalicious: Detected
  • IkarusMalicious: Trojan.Win64.Agent
  • K7AntiVirusMalicious: Trojan ( 005c75781 )
  • K7GWMalicious: Trojan ( 005c75781 )
  • KasperskyMalicious: Trojan-PSW.Win32.Lumma.ojg
  • LionicMalicious: Trojan.Win32.Lumma.1u!c
  • MalwarebytesMalicious: Malware.AI.4165244622
  • MaxSecureMalicious: Trojan.Malware.326462246.susgen
  • PandaMalicious: Trj/Chgt.AD
  • RisingMalicious: Dropper.Convagent!8.123ED (CLOUD)
  • SangforMalicious: Trojan.Win32.Save.a
  • SophosMalicious: Mal/Generic-S
  • TrellixENSMalicious: Artemis!1C791F7A8249
  • TrendMicroMalicious: TrojanSpy.Win64.LUMMASTEALER.YXFESZ
  • TrendMicro-HouseCallMalicious: TrojanSpy.Win64.LUMMASTEALER.YXFESZ
  • VaristMalicious: W64/ABTrojan.PKDN-7325
  • VBA32Malicious: TrojanPSW.Lumma
  • VIPREMalicious: Trojan.Generic.37999547
  • VirITMalicious: Trojan.Win64.Agent.IEH
  • ViRobotMalicious: Trojan.Win.Z.Agent.8467456.C
  • XcitiumMalicious: Malware@#3ntfqgaiwbotw
  • ZillyaMalicious: Trojan.Lumma.Win32.2240
  • AcronisClean
  • AlibabaClean
  • alibabacloudClean
  • APEXNo result
  • Avast-MobileClean
  • BaiduClean
  • BitDefenderFalxNo result
  • BkavClean
  • ClamAVClean
  • CMCClean
  • CrowdStrikeClean
  • CylanceNo result
  • GridinsoftClean
  • huorongClean
  • JiangminClean
  • KingsoftClean
  • McAfeeDClean
  • MicrosoftClean
  • MicroWorld-eScanClean
  • NANO-AntivirusClean
  • PaloaltoNo result
  • SentinelOneClean
  • SkyhighClean
  • SUPERAntiSpywareClean
  • SymantecClean
  • SymantecMobileInsightNo result
  • TACHYONClean
  • tehtrisNo result
  • TencentClean
  • TrapmineNo result
  • TrustlookClean
  • WebrootClean
  • YandexClean
  • ZoneAlarmClean
  • ZonerClean
Rule-based evidence

Signatures and behavior heuristics

Low-severity pattern matches — worth noting but not on their own cause for alarm.

1 heuristic
MITRE ATT&CK profile
Defense evasion× 1
Behavior heuristics
Deterministic patterns derived from scan data and observed runtime behavior
  • ProcessInjection
    T1055
    low

    VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.

    Evidence
    T1055 (sandbox MITRE mapping)
Prevalence

How widely this file has been seen

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium
Unique uploaders
8
Moderate upload volume.
Total submissions
8
Includes repeat uploads by the same source.
First seen
1y ago
Jul 3, 2025
Prevalence quadrant
Rare · New
Needs evidence-led scrutiny
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Often established software

Chapter 05

Questions & answers

Short answers to the 8 questions people ask most about this file.

Is FORTNITE-MACROS-EDITOR-V2.5-main.zip a virus?
Yes. This copy of FORTNITE-MACROS-EDITOR-V2.5-main.zip (SHA-256 62cd1676…7d6d) is malicious. Other files with the same name can be different, so check the hash. Don't open or extract it. Delete the archive and any files you extracted from it, then empty the Recycle Bin or Trash. 41 of the 69 antivirus engines that checked it flag it, some as Lumma Stealer. Antivirus engines classify it as a password stealer, built to copy saved passwords, cookies and crypto wallets. If you've already opened or extracted it, see the steps below.
What is FORTNITE-MACROS-EDITOR-V2.5-main.zip?
FORTNITE-MACROS-EDITOR-V2.5-main.zip is a ZIP archive, about 8.6 MB. VirusTotal first saw it on Jul 3, 2025.
How many antivirus engines detected FORTNITE-MACROS-EDITOR-V2.5-main.zip?
41 of the 69 antivirus engines that checked it flag FORTNITE-MACROS-EDITOR-V2.5-main.zip, including Kaspersky and ESET. We weigh which engines flagged it and what else the scan found, not just the count. In a test run it also created a file that antivirus engines classify as malicious.
What should I do if I already opened or extracted FORTNITE-MACROS-EDITOR-V2.5-main.zip?
1) Delete the archive and any files you extracted from it, then empty the Recycle Bin or Trash. 2) Run a full scan with your antivirus. 3) If it asked you to enable editing or macros, or a page it opened asked for a password or card details, change that password from another device and call your bank if you paid.
How do I remove FORTNITE-MACROS-EDITOR-V2.5-main.zip?
Delete the archive and any files you extracted from it, then empty the Recycle Bin or Trash. If you ran anything that was inside it, run a full scan with your antivirus.
What kind of malware is FORTNITE-MACROS-EDITOR-V2.5-main.zip?
Antivirus engines classify FORTNITE-MACROS-EDITOR-V2.5-main.zip as a password stealer, built to copy saved passwords, cookies and crypto wallets. Engines attribute it to the Lumma Stealer family.
What is the SHA-256 hash of FORTNITE-MACROS-EDITOR-V2.5-main.zip?
The SHA-256 fingerprint of FORTNITE-MACROS-EDITOR-V2.5-main.zip is 62cd1676fe0ef673a73754d930906bec3c1dbbf4d0c93b9fba35c744117a7d6d, and its MD5 is b8a3afbfffef99029fa52261a7360888. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.
How up to date is this analysis of FORTNITE-MACROS-EDITOR-V2.5-main.zip?
This report reflects the scan on Nov 10, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.
Chapter 06

Community

Member reviews and reports for this exact file hash.

Related file reports

Recent reports on other files with the same rating.

All file reports
Scan another
Check a different file
URL instead?
Check if a link is safe
This report and its SHA-256 fingerprint are public, so the next person who checks the same file gets an instant answer; documents and images are listed by type instead of their file name. A file we had not seen before is uploaded to VirusTotal, whose security partners and subscribers can download it; MalwareTips deletes its own copy after the scan. If you ran this file and are worried, scan your device with up-to-date security software.