File name:

Fortect.exe

Full analysis: https://app.any.run/tasks/6a0322a8-a323-489b-baa9-173d5311e86c
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: September 20, 2024, 07:56:39
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
pua
adware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

14DF9FBA256D3C2631B991C99761C2A8

SHA1:

D693CD79B37647405D8F072551DA4202DA158CD8

SHA256:

E3AC01ADAEFC2B95819E6FA27DC231AC747B2DD80574B5E67676530BFA67F90C

SSDEEP:

24576:KJ8yll3atDP+ywa3UtM91zdrIQidZAulUVqvuWJmRO5n:KJ8yf3atD+ywa3UtM91zdrIQid+ulUVc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ADWARE has been detected (SURICATA)

      • svchost.exe (PID: 2256)
      • Fortect.exe (PID: 2148)
      • MainDaemon.exe (PID: 2040)
      • MainService.exe (PID: 2576)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • Fortect.exe (PID: 6532)

    • Executable content was dropped or overwritten

      • Fortect.exe (PID: 6532)
      • Fortect.exe (PID: 2148)
      • FortectMain.exe (PID: 7068)

    • Reads security settings of Internet Explorer

      • Fortect.exe (PID: 6532)
      • Fortect.exe (PID: 2148)

    • Application launched itself

      • Fortect.exe (PID: 6532)
      • FortectMain.exe (PID: 7068)

    • Access to an unwanted program domain was detected

      • svchost.exe (PID: 2256)
      • Fortect.exe (PID: 2148)
      • MainDaemon.exe (PID: 2040)
      • MainService.exe (PID: 2576)

    • Drops 7-zip archiver for unpacking

      • Fortect.exe (PID: 2148)

    • The process drops C-runtime libraries

      • Fortect.exe (PID: 2148)

    • Process drops legitimate windows executable

      • Fortect.exe (PID: 2148)

    • Executes as Windows Service

      • MainDaemon.exe (PID: 1948)
      • MainService.exe (PID: 2576)

    • Drops a system driver (possible attempt to evade defenses)

      • Fortect.exe (PID: 2148)

    • Checks Windows Trust Settings

      • Fortect.exe (PID: 2148)

  • INFO

    • Checks supported languages

      • Fortect.exe (PID: 6532)
      • Fortect.exe (PID: 2148)

    • Create files in a temporary directory

      • Fortect.exe (PID: 6532)
      • Fortect.exe (PID: 2148)

    • Reads the computer name

      • Fortect.exe (PID: 6532)
      • Fortect.exe (PID: 2148)

    • The process uses the downloaded file

      • Fortect.exe (PID: 6532)

    • Process checks computer location settings

      • Fortect.exe (PID: 6532)

    • Reads Environment values

      • Fortect.exe (PID: 2148)

    • Checks proxy server information

      • Fortect.exe (PID: 2148)

    • Manual execution by a user

      • FortectMain.exe (PID: 7068)
      • FortectTray.exe (PID: 1236)

    • Reads the machine GUID from the registry

      • Fortect.exe (PID: 2148)

    • Reads the software policy settings

      • Fortect.exe (PID: 2148)

    • Creates files or folders in the user directory

      • Fortect.exe (PID: 2148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:56:47+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x3640
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 7.1.1.1
ProductVersionNumber: 7.1.1.1
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Fortect
FileDescription: Fortect Setup
FileVersion: 7.1.1.1
InternalName: Fortect.exe
LegalCopyright: © Fortect
LegalTrademarks: © Fortect
OriginalFileName: Fortect.exe
ProductName: Fortect
ProductVersion: 7.1.1.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
15
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start fortect.exe #ADWARE fortect.exe sppextcomobj.exe no specs slui.exe #ADWARE svchost.exe slui.exe no specs #ADWARE maindaemon.exe maindaemon.exe no specs mainservice.exe no specs #ADWARE mainservice.exe fortecttray.exe no specs fortectmain.exe fortectmain.exe no specs fortectmain.exe no specs fortectmain.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1236"C:\Program Files\Fortect\bin\FortectTray.exe" trueC:\Program Files\Fortect\bin\FortectTray.exe—explorer.exe
User:
admin
Company:
Fortect Ltd.
Integrity Level:
MEDIUM
Description:
Fortect Tray App
Version:
7.1.1.1
Modules
Images
c:\program files\fortect\bin\fortecttray.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1948"C:\Program Files\Fortect\bin\MainDaemon.exe"C:\Program Files\Fortect\bin\MainDaemon.exe—services.exe
User:
SYSTEM
Company:
Fortect Ltd.
Integrity Level:
SYSTEM
Description:
Fortect Daemon
Version:
7.1.1.1
Modules
Images
c:\program files\fortect\bin\maindaemon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
2040"C:\Program Files\Fortect\bin\MainDaemon.exe" --install --hostId 8a3dee36982280f9964c4c545c7b600246cdea575fb22971dd9699b657fc3036C:\Program Files\Fortect\bin\MainDaemon.exe
Fortect.exe
User:
admin
Company:
Fortect Ltd.
Integrity Level:
HIGH
Description:
Fortect Daemon
Exit code:
0
Version:
7.1.1.1
Modules
Images
c:\program files\fortect\bin\maindaemon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2148"C:\Users\admin\AppData\Local\Temp\Fortect.exe" /UAC=newC:\Users\admin\AppData\Local\Temp\Fortect.exe
Fortect.exe
User:
admin
Company:
Fortect
Integrity Level:
HIGH
Description:
Fortect Setup
Exit code:
0
Version:
7.1.1.1
Modules
Images
c:\users\admin\appdata\local\temp\fortect.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2576"C:\Program Files\Fortect\MainService.exe"C:\Program Files\Fortect\MainService.exe
services.exe
User:
SYSTEM
Company:
Fortect LTD.
Integrity Level:
SYSTEM
Description:
Fortect Service
Version:
7.1.1.1
Modules
Images
c:\program files\fortect\mainservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
3924"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4108C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5072"C:\Program Files\Fortect\FortectMain.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\Fortect" --app-user-model-id=" " --app-path="C:\Program Files\Fortect\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2348 --field-trial-handle=1688,i,7072571606928137105,595126659574397227,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1C:\Program Files\Fortect\FortectMain.exe—FortectMain.exe
User:
admin
Company:
Fortect LTD®
Integrity Level:
MEDIUM
Description:
Fortect Main
Version:
7.1.1.1
5540C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
7 887
Read events
7 857
Write events
30
Delete events
0

Modification events

(PID) Process:(2148) Fortect.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2148) Fortect.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2148) Fortect.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2148) Fortect.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Fortect\Engine
Operation:writeName:lang
Value:
1033
(PID) Process:(2148) Fortect.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Fortect\Daemon
Operation:writeName:Version
Value:
7.1.1.1
(PID) Process:(2040) MainDaemon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Fortect\Daemon\timers
Operation:writeName:daily_license
Value:
(PID) Process:(2040) MainDaemon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Fortect\Daemon\timers
Operation:writeName:ack_event
Value:
(PID) Process:(2040) MainDaemon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Fortect\Daemon\timers
Operation:writeName:notifications
Value:
(PID) Process:(2040) MainDaemon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Fortect\Daemon\timers
Operation:writeName:recheck
Value:
(PID) Process:(2040) MainDaemon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Fortect\Daemon
Operation:writeName:oiid
Value:
Executable files
107
Suspicious files
146
Text files
30
Unknown types
74

Dropped files

PID
Process
Filename
Type
2148Fortect.exeC:\Users\admin\AppData\Local\Temp\Fortect\plugins\fUtil.dllexecutable
MD5:1297CA8428913A757F0783075445E763
SHA256:434D85E0EF451962D2F33B53FB0738B371A699FDD11691FBF6E09C6BD7D4994A
2148Fortect.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\FortectSetup64[1].tgz —
MD5:—
SHA256:—
2148Fortect.exeC:\Users\admin\AppData\Local\Temp\Fortect\FortectSetup64.7z —
MD5:—
SHA256:—
2148Fortect.exeC:\Users\admin\AppData\Local\Temp\Fortect\plugins\INetC.dllexecutable
MD5:A6674D9F6E0C1E30AFA8007B9E4F211B
SHA256:DBBC53126213C325D209C242FBB6C097E86906A77F8A98896200492CDE19B0B8
6532Fortect.exeC:\Users\admin\AppData\Local\Temp\Fortect\plugins\System.dllexecutable
MD5:A6A9A761F8BF173D4DEA7823195EB97C
SHA256:6C6ED48BE417F931E149185EFF306244A7A82E2113E0F7483CCEF74DAEA78EBD
6532Fortect.exeC:\Users\admin\AppData\Local\Temp\Fortect\plugins\LogEx.dllexecutable
MD5:FF2DD47B0478CE26E7FEED13E280EAEE
SHA256:D6149EFB37AED74391AC89914A600E6761E105D0BD823CF144FAD4E9FC323319
2148Fortect.exeC:\Users\admin\AppData\Local\Temp\nscB754.tmp\UserInfo.dllexecutable
MD5:7C12B2DDE3D65C1D4DE5456C2F92AA9D
SHA256:D6360E692B8EDC5CEDA976E9027A917D379B5C62C958227130DD68DE2F5BE3A6
6532Fortect.exeC:\Users\admin\AppData\Local\Temp\nsuAEF8.tmp\UserInfo.dllexecutable
MD5:7C12B2DDE3D65C1D4DE5456C2F92AA9D
SHA256:D6360E692B8EDC5CEDA976E9027A917D379B5C62C958227130DD68DE2F5BE3A6
2148Fortect.exeC:\Users\admin\AppData\Local\Temp\Fortect\plugins\nsDialogs.dllexecutable
MD5:4FC86CDC469A813B8A176902EC70047D
SHA256:9A28E0A4E9BA16A488234880359AFF55B2B5DFEBAC7A86299EE797B072A524FA
2148Fortect.exeC:\Users\admin\AppData\Local\Temp\Fortect\Fortect.jsonbinary
MD5:F2BE83BD70D19F448A6F35AD3EB1D60C
SHA256:36A77BF28508CC554E490596FD5D61768E85B28BC7C456A412CF13C95086ADEC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
72
DNS requests
26
Threats
37

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2148
Fortect.exe
GET
200
142.250.186.99:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5548
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6252
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6252
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
172.67.75.40:80
http://app.fortect.com/events/cloud-scan.php?param1=i8wp2mJ8+OVm4ddYzzgWhHed/5PEa3sTxScmqPxgtJkKxKF219ufkAjqWDBXIQDF2L1NXVXDiUGNA5xxxlCiMmUOP8Y87RvlmnwxPpZ7Li3kah3cCj7am14/mgDc1vPBJEZ43mLJvDaLujvQxe/mswXpnCuFU0KO987Dd3uFnYhAWqu8BtWXAsGlfCm1dajiPCSD2VnbVrjqhiwAXKEPaNb3njRhVzKiw6V3Tcqm/mss6r/MiACM06cQfMgKHgcvuJN9zH/G9OTIIJQHJQKlGA==
unknown
—
—
whitelisted
—
—
GET
200
172.67.75.40:80
http://app.fortect.com/events/cloud-scan.php?param1=i8wp2mJ8+OVm4ddYzzgWhP7SL7zIZQ8luBnCBmpXvPe7pnnW8UZMpVN218A2R4GiQ6RhB0aEWnAXpiM/KhYWkyF1p4Mj6E3aPCFI+6HbSP4KaCCHOcGpiDy8g4xGLc5lqQBUrNYXRis/9TqLFR77FqRqZqvQq6Ed9YPtD66eBrVWslwEAILV3S8NU3OnVnOF6xKyb5I6MiI2TWxGf4CXMkg9tAcO0OTlbi+wajgE3awEdO01Aah9GvyU55WTk7qU4+487R/c4a/rgTyWjqfdAQ==
unknown
—
—
whitelisted
—
—
GET
200
172.67.75.40:80
http://app.fortect.com/events/cloud-scan.php?param1=i8wp2mJ8+OVm4ddYzzgWhOEuYij1X/C4xnMEMR7j6i8sMW9q3MfgCv6G6TL7SPBJhi5T4sBFLOFf1UF7FVPb+u6nOiJFZ6giNlRz4iQwv+B1e8exb2n95N6BY0lH9ABLyr4chu+iuM9MKGauxUsonPvuYL5Hs3Vv4nQ4j0QTYMeByfs+qx4SAvTJNeYPP52XkGMC+rdghyJADkvKZplkoVZBKrp4KtgjonLiOzedyNjGsvKg2FkFTDS3C4zz8HBE5QjC7gPE4z5pYNZ9+/bLvw==
unknown
—
—
whitelisted
2120
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5472
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2148
Fortect.exe
172.67.75.40:443
app.fortect.com
CLOUDFLARENET
US
unknown
2148
Fortect.exe
142.250.186.99:80
c.pki.goog
GOOGLE
US
whitelisted
5548
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5548
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4324
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.186.46
whitelisted
app.fortect.com
  • 172.67.75.40
  • 104.26.2.16
  • 104.26.3.16
unknown
c.pki.goog
  • 142.250.186.99
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.76
  • 20.190.160.14
  • 40.126.32.134
  • 40.126.32.133
  • 20.190.160.22
  • 40.126.32.138
  • 20.190.160.20
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
cloud.fortect.com
  • 172.67.75.40
  • 104.26.2.16
  • 104.26.3.16
unknown
browser.pipe.aria.microsoft.com
  • 20.189.173.12
whitelisted
www.bing.com
  • 104.126.37.177
  • 104.126.37.171
  • 104.126.37.123
  • 104.126.37.186
  • 104.126.37.170
  • 104.126.37.179
  • 104.126.37.184
  • 104.126.37.169
  • 104.126.37.178
  • 104.126.37.163
  • 104.126.37.161
  • 104.126.37.168
  • 104.126.37.162
whitelisted

Threats

PID
Process
Class
Message
—
—
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed DNS Query to PC Optimizer Software Domain (fortect .com)
2148
Fortect.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
2148
Fortect.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
2256
svchost.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed DNS Query to PC Optimizer Software Domain (fortect .com)
2256
svchost.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed DNS Query to PC Optimizer Software Domain (fortect .com)
2040
MainDaemon.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
2040
MainDaemon.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
2040
MainDaemon.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
2040
MainDaemon.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
2148
Fortect.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
Process
Message
Fortect.exe
ExecShellAsUser: got desktop
Fortect.exe
ExecShellAsUser: elevated process detected
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Fortect.exe