URL:

https://cloud.fortect.com/app/installation/downloader/6200/Fortect.exe

Full analysis: https://app.any.run/tasks/f982a6a7-cfe2-4aec-bf5b-4eb0ddce3976
Verdict: Malicious activity
Analysis date: April 07, 2024, 11:51:38
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

D490ACD20DB48A99ED61402CF1F6F317

SHA1:

5BD0800E32A8EFD4E43415AB06770355AD40AD31

SHA256:

433E5948553092579A70DB9BFF042F69DCDC06E397C8C61B75E01542C27D0294

SSDEEP:

3:N8ULBLQX5EJKRL+yXqP2GOA:2UBKRLY2k

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Fortect.exe (PID: 1112)
      • FortectMain.exe (PID: 1172)

    • Changes the autorun value in the registry

      • Fortect.exe (PID: 1112)

    • Actions looks like stealing of personal data

      • MainService.exe (PID: 3128)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • Fortect.exe (PID: 1112)

    • Reads security settings of Internet Explorer

      • Fortect.exe (PID: 1112)
      • MainDaemon.exe (PID: 1484)

    • Reads the Internet Settings

      • Fortect.exe (PID: 1112)
      • FortectMain.exe (PID: 1172)
      • FortectMain.exe (PID: 2784)

    • Checks Windows Trust Settings

      • Fortect.exe (PID: 1112)
      • MainDaemon.exe (PID: 1484)
      • MainDaemon.exe (PID: 924)
      • MainService.exe (PID: 3128)

    • Reads settings of System Certificates

      • Fortect.exe (PID: 1112)
      • MainDaemon.exe (PID: 1484)
      • FortectMain.exe (PID: 1172)

    • Drops 7-zip archiver for unpacking

      • Fortect.exe (PID: 1112)

    • Process drops legitimate windows executable

      • Fortect.exe (PID: 1112)

    • Executes as Windows Service

      • MainDaemon.exe (PID: 924)
      • MainService.exe (PID: 3128)

    • Creates a software uninstall entry

      • Fortect.exe (PID: 1112)

    • Searches for installed software

      • MainDaemon.exe (PID: 924)
      • MainService.exe (PID: 3128)

    • Application launched itself

      • FortectMain.exe (PID: 1172)

    • Reads the date of Windows installation

      • MainService.exe (PID: 3128)

    • Reads Microsoft Outlook installation path

      • MainService.exe (PID: 3128)

    • Reads Internet Explorer settings

      • MainService.exe (PID: 3128)

    • Read startup parameters

      • MainService.exe (PID: 3128)

    • Adds/modifies Windows certificates

      • MainService.exe (PID: 3128)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2120)
      • msedge.exe (PID: 3912)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3092)
      • iexplore.exe (PID: 2120)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2120)

    • Reads the computer name

      • Fortect.exe (PID: 1112)
      • MainDaemon.exe (PID: 924)
      • MainDaemon.exe (PID: 1484)
      • MainService.exe (PID: 3128)
      • MainService.exe (PID: 948)
      • FortectMain.exe (PID: 3020)
      • FortectMain.exe (PID: 1172)
      • FortectMain.exe (PID: 3332)
      • FortectMain.exe (PID: 3480)
      • FortectMain.exe (PID: 2784)

    • The process uses the downloaded file

      • iexplore.exe (PID: 2120)
      • Fortect.exe (PID: 1112)

    • Create files in a temporary directory

      • Fortect.exe (PID: 1112)
      • FortectMain.exe (PID: 1172)

    • Reads Environment values

      • Fortect.exe (PID: 1112)
      • MainDaemon.exe (PID: 1484)
      • MainDaemon.exe (PID: 924)
      • FortectMain.exe (PID: 1172)
      • MainService.exe (PID: 3128)
      • MainService.exe (PID: 948)

    • Reads the machine GUID from the registry

      • Fortect.exe (PID: 1112)
      • MainDaemon.exe (PID: 1484)
      • MainDaemon.exe (PID: 924)
      • MainService.exe (PID: 3128)
      • FortectMain.exe (PID: 1172)

    • Checks proxy server information

      • Fortect.exe (PID: 1112)

    • Reads the software policy settings

      • Fortect.exe (PID: 1112)
      • MainDaemon.exe (PID: 1484)
      • MainDaemon.exe (PID: 924)
      • FortectMain.exe (PID: 1172)
      • MainService.exe (PID: 3128)

    • Creates files or folders in the user directory

      • Fortect.exe (PID: 1112)
      • FortectMain.exe (PID: 1172)
      • FortectMain.exe (PID: 3020)

    • Dropped object may contain TOR URL's

      • Fortect.exe (PID: 1112)

    • Creates files in the program directory

      • Fortect.exe (PID: 1112)
      • MainDaemon.exe (PID: 1484)
      • MainDaemon.exe (PID: 924)
      • MainService.exe (PID: 3128)
      • MainService.exe (PID: 948)

    • Checks supported languages

      • MainDaemon.exe (PID: 1484)
      • MainDaemon.exe (PID: 924)
      • Fortect.exe (PID: 1112)
      • FortectMain.exe (PID: 1172)
      • fortecttray.exe (PID: 4072)
      • MainService.exe (PID: 3128)
      • MainService.exe (PID: 948)
      • FortectMain.exe (PID: 3332)
      • FortectMain.exe (PID: 3020)
      • FortectMain.exe (PID: 2784)
      • FortectMain.exe (PID: 3480)

    • Manual execution by a user

      • FortectMain.exe (PID: 1172)

    • Reads product name

      • FortectMain.exe (PID: 1172)

    • Process checks computer location settings

      • FortectMain.exe (PID: 1172)
      • FortectMain.exe (PID: 2784)
      • MainService.exe (PID: 3128)

    • Process checks the number of cached credentials

      • MainService.exe (PID: 3128)

    • Reads mouse settings

      • MainService.exe (PID: 3128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
74
Monitored processes
29
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe no specs iexplore.exe fortect.exe no specs fortect.exe maindaemon.exe maindaemon.exe mainservice.exe no specs mainservice.exe fortecttray.exe no specs fortectmain.exe no specs fortectmain.exe no specs fortectmain.exe fortectmain.exe no specs fortectmain.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1664 --field-trial-handle=1352,i,8821779581273277261,13118486205959858648,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
924"C:\Program Files\Fortect\bin\MainDaemon.exe"C:\Program Files\Fortect\bin\MainDaemon.exe
services.exe
User:
SYSTEM
Company:
Fortect Ltd.
Integrity Level:
SYSTEM
Description:
Fortect Daemon
Version:
6.2.0.0
Modules
Images
c:\program files\fortect\bin\maindaemon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
948"C:\Program Files\Fortect\MainService.exe" --installC:\Program Files\Fortect\MainService.exe—Fortect.exe
User:
admin
Company:
Fortect LTD.
Integrity Level:
HIGH
Description:
Fortect Service
Exit code:
0
Version:
6.2.0.0
Modules
Images
c:\program files\fortect\mainservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1112"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Fortect.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Fortect.exe
iexplore.exe
User:
admin
Company:
Fortect
Integrity Level:
HIGH
Description:
Fortect Setup
Exit code:
0
Version:
6.2.0.0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\fortect.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1172"C:\Program Files\Fortect\FortectMain.exe" --lang=en --firstRun --runId=33b887c0-6b4d-487d-bb9b-979635ce3afcC:\Program Files\Fortect\FortectMain.exe—explorer.exe
User:
admin
Company:
Fortect LTD®
Integrity Level:
MEDIUM
Description:
Fortect Main
Version:
6.2.0.0
Modules
Images
c:\program files\fortect\fortectmain.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\fortect\ffmpeg.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1484"C:\Program Files\Fortect\bin\MainDaemon.exe" --installC:\Program Files\Fortect\bin\MainDaemon.exe
Fortect.exe
User:
admin
Company:
Fortect Ltd.
Integrity Level:
HIGH
Description:
Fortect Daemon
Exit code:
0
Version:
6.2.0.0
Modules
Images
c:\program files\fortect\bin\maindaemon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
1496"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1352,i,8821779581273277261,13118486205959858648,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1780"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3932 --field-trial-handle=1352,i,8821779581273277261,13118486205959858648,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1892"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2376 --field-trial-handle=1352,i,8821779581273277261,13118486205959858648,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2064"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1272 --field-trial-handle=1352,i,8821779581273277261,13118486205959858648,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
127 559
Read events
127 247
Write events
261
Delete events
51

Modification events

(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31099105
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
146348874
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31099106
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2120) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
61
Suspicious files
163
Text files
114
Unknown types
114

Dropped files

PID
Process
Filename
Type
3092iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
3092iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:—
SHA256:—
3092iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:—
SHA256:—
3092iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464binary
MD5:—
SHA256:—
3092iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464binary
MD5:—
SHA256:—
3092iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\Fortect[1].exeexecutable
MD5:—
SHA256:—
3092iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Fortect.exe.ha0kfei.partialexecutable
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF9E66C44DBB004D39.TMPbinary
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{347A7ABF-F4D5-11EE-AE0A-12A9866C77DE}.datbinary
MD5:—
SHA256:—
2120iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Fortect.exe.ha0kfei.partial:Zone.Identifiertext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
114
DNS requests
62
Threats
54

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3092
iexplore.exe
GET
304
2.16.100.168:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b150b552b216e1f4
unknown
—
—
unknown
3092
iexplore.exe
GET
304
2.16.100.168:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d3ebf5ce555ba18b
unknown
—
—
unknown
1112
Fortect.exe
GET
304
2.16.100.168:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6838fae63b9d0d3c
unknown
—
—
unknown
3092
iexplore.exe
GET
200
216.58.206.35:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
unknown
3092
iexplore.exe
GET
200
216.58.206.35:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
—
—
unknown
1080
svchost.exe
GET
200
2.16.100.168:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1b8fee253118cbef
unknown
—
—
unknown
3128
MainService.exe
GET
200
172.67.75.40:80
http://app.fortect.com/events/cloud-scan.php?param1=su4W7rMMkzwO7NpxGmPB6H+/cOmB3EGw//ML38Wgt7xwe24SoMKN8gtTIfEk0PCsWFvflk2LD1CbJYE4DRXiq6a3xuoucFvi8VTfmTvzabMZJb9u/Lc5oN4AvOo8EROEXwR5lq7FUDCrfVVOU1CCAi86C8HXbTm6bJ3R+UZzot5luLI2fUAVyK9wyinNkTSet/CPQMn5h8ZrMZug/IycYuPSx7L7b4RLA08FyfFQatfzQiwjw8XI5Bo0DsuflLDW8LR+Q2QxZBgVFNbArtIYUA==
unknown
—
—
unknown
3128
MainService.exe
GET
200
172.67.75.40:80
http://app.fortect.com/events/cloud-scan.php?param1=su4W7rMMkzwO7NpxGmPB6ARg5LehjV8wnJuErb4ivGmCvYhdyTEHObOYXh6xK766fIWmOdd4E9McGiCPeLC7xaLXtoW6J4BmPDVGVb06OPbbQ36AUnv3Ud8GOTeIEe9oO1HQCvosGe4uVgIqQfy+Lrtu/m8x5TwlEIr6dyVaCQlhAfvCuIcxEUshqRsvSu3aOOgQq/K7FowvHIIWQLwXhg+OmVfcYd4eEYdd36IkTqiIWAJgxfMUWU4Krf/bOqRzeERjccCN5bnj9LGPbJ+zNQ==
unknown
—
—
unknown
3128
MainService.exe
GET
200
172.67.75.40:80
http://app.fortect.com/events/cloud-scan.php?param1=su4W7rMMkzwO7NpxGmPB6FRtAyZ0imDfuTWfROu7ZC0ySnKnzHEsnIcUY5uQtJKy/uoI7bE/lsEvRwFR9VaqNoR8K8NMS+No18vOfUGceUyw8HF9VIwibbE3XW46PmDzIAVzF+qdVT/9Fs+9V7hpmV+4zMkB299f/xQw/MCUA2WACSF5ZZZsiBui23IcrYyISVZdbriS6mk+xnfHEmbv44m8Zuywymu9QJFma6pR5Jdchc0UERpu6hRtA5NmhtqzY2m73z1sb0vdtBbaJom43g==
unknown
—
—
unknown
3128
MainService.exe
GET
200
172.67.75.40:80
http://app.fortect.com/events/cloud-scan.php?param1=su4W7rMMkzwO7NpxGmPB6ADuTU29OXWF8zJmb2N7QXqJ3SbFrXvmzmEMbZwdjgVDRmnp8oVysv4TqnpFkbRkFHVPVaA8964EvrUtAl/r5mVxBTmiVpTFkDhB18g2S7LdHQeH9Z1CiiCUHMVYuTvnJlQLPBEFTJ+bOiAa2xOJtlq3vigr0FmcWkUUmL1GAIN9PQDDOUs6R9SE+3dKNOpfY9RJSu1m/u6iFA68Mnh9+860Ay3JZFJKoougMtvnwILkeFNARlM4a4sPzKXg3Jd3CGHEsB0X66yJSPfQgfvasJUR3MS9VUXVlXTpH1COz8FX
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
3092
iexplore.exe
172.67.75.40:443
cloud.fortect.com
CLOUDFLARENET
US
unknown
3092
iexplore.exe
2.16.100.168:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
whitelisted
3092
iexplore.exe
216.58.206.35:80
ocsp.pki.goog
GOOGLE
US
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1112
Fortect.exe
172.67.75.40:443
cloud.fortect.com
CLOUDFLARENET
US
unknown
1112
Fortect.exe
2.16.100.168:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
whitelisted
1080
svchost.exe
2.16.100.168:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
cloud.fortect.com
  • 172.67.75.40
  • 104.26.2.16
  • 104.26.3.16
unknown
ctldl.windowsupdate.com
  • 2.16.100.168
  • 88.221.110.121
whitelisted
ocsp.pki.goog
  • 216.58.206.35
whitelisted
app.fortect.com
  • 172.67.75.40
  • 104.26.3.16
  • 104.26.2.16
unknown
service.fortect.com
  • 104.26.3.16
  • 104.26.2.16
  • 172.67.75.40
unknown
redirector.gvt1.com
  • 216.58.212.142
whitelisted
r1---sn-5hneknek.gvt1.com
  • 74.125.8.134
whitelisted
fonts.googleapis.com
  • 142.250.186.106
  • 142.250.185.138
whitelisted
fonts.gstatic.com
  • 142.250.186.35
whitelisted
secure.fortect.com
  • 104.26.3.16
  • 104.26.2.16
  • 172.67.75.40
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed DNS Query to PC Optimizer Software Domain (fortect .com)
3092
iexplore.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
3092
iexplore.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
1080
svchost.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed DNS Query to PC Optimizer Software Domain (fortect .com)
1112
Fortect.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
1112
Fortect.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
1080
svchost.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed DNS Query to PC Optimizer Software Domain (fortect .com)
1484
MainDaemon.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
1484
MainDaemon.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
1484
MainDaemon.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
Process
Message
Fortect.exe
ExecShellAsUser: got desktop
Fortect.exe
ExecShellAsUser: elevated process detected
Fortect.exe
ExecShellAsUser: thread finished
Fortect.exe
ExecShellAsUser: DLL_PROCESS_DETACH
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://cloud.fortect.com/app/installation/downloader/6200/Fortect.exe