File name:

Fortect.exe

Full analysis: https://app.any.run/tasks/6a0322a8-a323-489b-baa9-173d5311e86c
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: September 20, 2024, 07:56:39
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
pua
adware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

14DF9FBA256D3C2631B991C99761C2A8

SHA1:

D693CD79B37647405D8F072551DA4202DA158CD8

SHA256:

E3AC01ADAEFC2B95819E6FA27DC231AC747B2DD80574B5E67676530BFA67F90C

SSDEEP:

24576:KJ8yll3atDP+ywa3UtM91zdrIQidZAulUVqvuWJmRO5n:KJ8yf3atD+ywa3UtM91zdrIQid+ulUVc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ADWARE has been detected (SURICATA)

      • svchost.exe (PID: 2256)
      • Fortect.exe (PID: 2148)
      • MainService.exe (PID: 2576)
      • MainDaemon.exe (PID: 2040)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Fortect.exe (PID: 6532)
      • Fortect.exe (PID: 2148)

    • The process creates files with name similar to system file names

      • Fortect.exe (PID: 6532)

    • Executable content was dropped or overwritten

      • Fortect.exe (PID: 6532)
      • Fortect.exe (PID: 2148)
      • FortectMain.exe (PID: 7068)

    • Application launched itself

      • Fortect.exe (PID: 6532)
      • FortectMain.exe (PID: 7068)

    • Checks Windows Trust Settings

      • Fortect.exe (PID: 2148)

    • Access to an unwanted program domain was detected

      • svchost.exe (PID: 2256)
      • Fortect.exe (PID: 2148)
      • MainDaemon.exe (PID: 2040)
      • MainService.exe (PID: 2576)

    • The process drops C-runtime libraries

      • Fortect.exe (PID: 2148)

    • Drops 7-zip archiver for unpacking

      • Fortect.exe (PID: 2148)

    • Drops a system driver (possible attempt to evade defenses)

      • Fortect.exe (PID: 2148)

    • Process drops legitimate windows executable

      • Fortect.exe (PID: 2148)

    • Executes as Windows Service

      • MainDaemon.exe (PID: 1948)
      • MainService.exe (PID: 2576)

  • INFO

    • Create files in a temporary directory

      • Fortect.exe (PID: 6532)
      • Fortect.exe (PID: 2148)

    • Checks supported languages

      • Fortect.exe (PID: 6532)
      • Fortect.exe (PID: 2148)

    • The process uses the downloaded file

      • Fortect.exe (PID: 6532)

    • Reads the computer name

      • Fortect.exe (PID: 6532)
      • Fortect.exe (PID: 2148)

    • Process checks computer location settings

      • Fortect.exe (PID: 6532)

    • Reads Environment values

      • Fortect.exe (PID: 2148)

    • Reads the machine GUID from the registry

      • Fortect.exe (PID: 2148)

    • Checks proxy server information

      • Fortect.exe (PID: 2148)

    • Reads the software policy settings

      • Fortect.exe (PID: 2148)

    • Creates files or folders in the user directory

      • Fortect.exe (PID: 2148)

    • Manual execution by a user

      • FortectMain.exe (PID: 7068)
      • FortectTray.exe (PID: 1236)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:56:47+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x3640
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 7.1.1.1
ProductVersionNumber: 7.1.1.1
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Fortect
FileDescription: Fortect Setup
FileVersion: 7.1.1.1
InternalName: Fortect.exe
LegalCopyright: © Fortect
LegalTrademarks: © Fortect
OriginalFileName: Fortect.exe
ProductName: Fortect
ProductVersion: 7.1.1.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
15
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start fortect.exe #ADWARE fortect.exe sppextcomobj.exe no specs slui.exe #ADWARE svchost.exe slui.exe no specs #ADWARE maindaemon.exe maindaemon.exe no specs mainservice.exe no specs #ADWARE mainservice.exe fortecttray.exe no specs fortectmain.exe fortectmain.exe no specs fortectmain.exe no specs fortectmain.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1236"C:\Program Files\Fortect\bin\FortectTray.exe" trueC:\Program Files\Fortect\bin\FortectTray.exe—explorer.exe
User:
admin
Company:
Fortect Ltd.
Integrity Level:
MEDIUM
Description:
Fortect Tray App
Version:
7.1.1.1
Modules
Images
c:\program files\fortect\bin\fortecttray.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1948"C:\Program Files\Fortect\bin\MainDaemon.exe"C:\Program Files\Fortect\bin\MainDaemon.exe—services.exe
User:
SYSTEM
Company:
Fortect Ltd.
Integrity Level:
SYSTEM
Description:
Fortect Daemon
Version:
7.1.1.1
Modules
Images
c:\program files\fortect\bin\maindaemon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
2040"C:\Program Files\Fortect\bin\MainDaemon.exe" --install --hostId 8a3dee36982280f9964c4c545c7b600246cdea575fb22971dd9699b657fc3036C:\Program Files\Fortect\bin\MainDaemon.exe
Fortect.exe
User:
admin
Company:
Fortect Ltd.
Integrity Level:
HIGH
Description:
Fortect Daemon
Exit code:
0
Version:
7.1.1.1
Modules
Images
c:\program files\fortect\bin\maindaemon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2148"C:\Users\admin\AppData\Local\Temp\Fortect.exe" /UAC=newC:\Users\admin\AppData\Local\Temp\Fortect.exe
Fortect.exe
User:
admin
Company:
Fortect
Integrity Level:
HIGH
Description:
Fortect Setup
Exit code:
0
Version:
7.1.1.1
Modules
Images
c:\users\admin\appdata\local\temp\fortect.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2576"C:\Program Files\Fortect\MainService.exe"C:\Program Files\Fortect\MainService.exe
services.exe
User:
SYSTEM
Company:
Fortect LTD.
Integrity Level:
SYSTEM
Description:
Fortect Service
Version:
7.1.1.1
Modules
Images
c:\program files\fortect\mainservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
3924"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4108C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5072"C:\Program Files\Fortect\FortectMain.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\Fortect" --app-user-model-id=" " --app-path="C:\Program Files\Fortect\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2348 --field-trial-handle=1688,i,7072571606928137105,595126659574397227,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1C:\Program Files\Fortect\FortectMain.exe—FortectMain.exe
User:
admin
Company:
Fortect LTD®
Integrity Level:
MEDIUM
Description:
Fortect Main
Version:
7.1.1.1
5540C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
7 887
Read events
7 857
Write events
30
Delete events
0

Modification events

(PID) Process:(2148) Fortect.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2148) Fortect.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2148) Fortect.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2148) Fortect.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Fortect\Engine
Operation:writeName:lang
Value:
1033
(PID) Process:(2148) Fortect.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Fortect\Daemon
Operation:writeName:Version
Value:
7.1.1.1
(PID) Process:(2040) MainDaemon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Fortect\Daemon\timers
Operation:writeName:daily_license
Value:
(PID) Process:(2040) MainDaemon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Fortect\Daemon\timers
Operation:writeName:ack_event
Value:
(PID) Process:(2040) MainDaemon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Fortect\Daemon\timers
Operation:writeName:notifications
Value:
(PID) Process:(2040) MainDaemon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Fortect\Daemon\timers
Operation:writeName:recheck
Value:
(PID) Process:(2040) MainDaemon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Fortect\Daemon
Operation:writeName:oiid
Value:
Executable files
107
Suspicious files
146
Text files
30
Unknown types
74

Dropped files

PID
Process
Filename
Type
6532Fortect.exeC:\Users\admin\AppData\Local\Temp\Fortect\plugins\LogEx.dllexecutable
MD5:FF2DD47B0478CE26E7FEED13E280EAEE
SHA256:D6149EFB37AED74391AC89914A600E6761E105D0BD823CF144FAD4E9FC323319
2148Fortect.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\FortectSetup64[1].tgz —
MD5:—
SHA256:—
2148Fortect.exeC:\Users\admin\AppData\Local\Temp\Fortect\FortectSetup64.7z —
MD5:—
SHA256:—
2148Fortect.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:8DBD92F54278057D06588B9ECC3864ED
SHA256:FCD2AFE9D9AC1B5185387EDB9EA341ED17D94F7EDBED8BAC9B61DB4A107B4582
6532Fortect.exeC:\Users\admin\AppData\Local\Temp\Fortect\plugins\System.dllexecutable
MD5:A6A9A761F8BF173D4DEA7823195EB97C
SHA256:6C6ED48BE417F931E149185EFF306244A7A82E2113E0F7483CCEF74DAEA78EBD
2148Fortect.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:2B3F59F6E610816969D1BBC846522407
SHA256:377387FE514C5A72F1024044E14A38A9EDD19EE33AC78F76DB56B5C1D8013B05
2148Fortect.exeC:\Users\admin\AppData\Local\Temp\Fortect\plugins\INetC.dllexecutable
MD5:A6674D9F6E0C1E30AFA8007B9E4F211B
SHA256:DBBC53126213C325D209C242FBB6C097E86906A77F8A98896200492CDE19B0B8
2148Fortect.exeC:\Users\admin\AppData\Local\Temp\nscB754.tmp\UserInfo.dllexecutable
MD5:7C12B2DDE3D65C1D4DE5456C2F92AA9D
SHA256:D6360E692B8EDC5CEDA976E9027A917D379B5C62C958227130DD68DE2F5BE3A6
2148Fortect.exeC:\Users\admin\AppData\Local\Temp\Fortect\plugins\fortect-side.bmpimage
MD5:3B4EE5451899C2B00555C573A389AEB8
SHA256:8FBD59EE64AF8A702F7A57657AB1766030885E28090E63E966E31B0358AE11F3
2148Fortect.exeC:\Users\admin\AppData\Local\Temp\Fortect\plugins\fUtil.dllexecutable
MD5:1297CA8428913A757F0783075445E763
SHA256:434D85E0EF451962D2F33B53FB0738B371A699FDD11691FBF6E09C6BD7D4994A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
72
DNS requests
26
Threats
37

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5548
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2120
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2148
Fortect.exe
GET
200
142.250.186.99:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
2148
Fortect.exe
GET
200
142.250.186.99:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6252
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6252
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
172.67.75.40:80
http://app.fortect.com/events/cloud-scan.php?param1=i8wp2mJ8+OVm4ddYzzgWhHed/5PEa3sTxScmqPxgtJkKxKF219ufkAjqWDBXIQDF2L1NXVXDiUGNA5xxxlCiMmUOP8Y87RvlmnwxPpZ7Li3kah3cCj7am14/mgDc1vPBJEZ43mLJvDaLujvQxe/mswXpnCuFU0KO987Dd3uFnYhAWqu8BtWXAsGlfCm1dajiPCSD2VnbVrjqhiwAXKEPaNb3njRhVzKiw6V3Tcqm/mss6r/MiACM06cQfMgKHgcvuJN9zH/G9OTIIJQHJQKlGA==
unknown
—
—
whitelisted
—
—
GET
200
172.67.75.40:80
http://app.fortect.com/events/cloud-scan.php?param1=i8wp2mJ8+OVm4ddYzzgWhOEuYij1X/C4xnMEMR7j6i8sMW9q3MfgCv6G6TL7SPBJhi5T4sBFLOFf1UF7FVPb+u6nOiJFZ6giNlRz4iQwv+B1e8exb2n95N6BY0lH9ABLyr4chu+iuM9MKGauxUsonPvuYL5Hs3Vv4nQ4j0QTYMeByfs+qx4SAvTJNeYPP52XkGMC+rdghyJADkvKZplkoVZBKrp4KtgjonLiOzedyNjGsvKg2FkFTDS3C4zz8HBE5QjC7gPE4z5pYNZ9+/bLvw==
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5472
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2148
Fortect.exe
172.67.75.40:443
app.fortect.com
CLOUDFLARENET
US
unknown
2148
Fortect.exe
142.250.186.99:80
c.pki.goog
GOOGLE
US
whitelisted
5548
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5548
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4324
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.186.46
whitelisted
app.fortect.com
  • 172.67.75.40
  • 104.26.2.16
  • 104.26.3.16
unknown
c.pki.goog
  • 142.250.186.99
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.76
  • 20.190.160.14
  • 40.126.32.134
  • 40.126.32.133
  • 20.190.160.22
  • 40.126.32.138
  • 20.190.160.20
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
cloud.fortect.com
  • 172.67.75.40
  • 104.26.2.16
  • 104.26.3.16
unknown
browser.pipe.aria.microsoft.com
  • 20.189.173.12
whitelisted
www.bing.com
  • 104.126.37.177
  • 104.126.37.171
  • 104.126.37.123
  • 104.126.37.186
  • 104.126.37.170
  • 104.126.37.179
  • 104.126.37.184
  • 104.126.37.169
  • 104.126.37.178
  • 104.126.37.163
  • 104.126.37.161
  • 104.126.37.168
  • 104.126.37.162
whitelisted

Threats

PID
Process
Class
Message
—
—
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed DNS Query to PC Optimizer Software Domain (fortect .com)
2148
Fortect.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
2148
Fortect.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
2256
svchost.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed DNS Query to PC Optimizer Software Domain (fortect .com)
2256
svchost.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed DNS Query to PC Optimizer Software Domain (fortect .com)
2040
MainDaemon.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
2040
MainDaemon.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
2040
MainDaemon.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
2040
MainDaemon.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
2148
Fortect.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
Process
Message
Fortect.exe
ExecShellAsUser: got desktop
Fortect.exe
ExecShellAsUser: elevated process detected
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Fortect.exe