File name:

Fortect.exe

Full analysis: https://app.any.run/tasks/add91cc5-a371-47d5-802c-196aa8ec14ff
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: September 27, 2024, 03:09:56
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
pua
adware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

14DF9FBA256D3C2631B991C99761C2A8

SHA1:

D693CD79B37647405D8F072551DA4202DA158CD8

SHA256:

E3AC01ADAEFC2B95819E6FA27DC231AC747B2DD80574B5E67676530BFA67F90C

SSDEEP:

24576:KJ8yll3atDP+ywa3UtM91zdrIQidZAulUVqvuWJmRO5n:KJ8yf3atD+ywa3UtM91zdrIQid+ulUVc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ADWARE has been detected (SURICATA)

      • svchost.exe (PID: 2256)
      • Fortect.exe (PID: 3268)
      • MainDaemon.exe (PID: 6920)
      • MainService.exe (PID: 6324)
      • FortectMain.exe (PID: 6108)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Fortect.exe (PID: 5740)
      • Fortect.exe (PID: 6796)
      • Fortect.exe (PID: 3268)
      • FortectMain.exe (PID: 4032)

    • The process creates files with name similar to system file names

      • Fortect.exe (PID: 5740)
      • Fortect.exe (PID: 3268)

    • Reads security settings of Internet Explorer

      • Fortect.exe (PID: 5740)
      • Fortect.exe (PID: 6796)
      • Fortect.exe (PID: 3268)

    • Application launched itself

      • Fortect.exe (PID: 5740)
      • Fortect.exe (PID: 6796)
      • FortectMain.exe (PID: 4032)

    • Access to an unwanted program domain was detected

      • svchost.exe (PID: 2256)
      • Fortect.exe (PID: 3268)
      • MainDaemon.exe (PID: 6920)
      • FortectMain.exe (PID: 6108)
      • MainService.exe (PID: 6324)

    • Checks Windows Trust Settings

      • Fortect.exe (PID: 3268)

    • Drops 7-zip archiver for unpacking

      • Fortect.exe (PID: 3268)

    • The process drops C-runtime libraries

      • Fortect.exe (PID: 3268)

    • Drops a system driver (possible attempt to evade defenses)

      • Fortect.exe (PID: 3268)

    • Executes as Windows Service

      • MainDaemon.exe (PID: 5492)
      • MainService.exe (PID: 6324)

    • Process drops legitimate windows executable

      • Fortect.exe (PID: 3268)

  • INFO

    • Create files in a temporary directory

      • Fortect.exe (PID: 5740)
      • Fortect.exe (PID: 3268)

    • Checks supported languages

      • Fortect.exe (PID: 5740)
      • Fortect.exe (PID: 6796)
      • Fortect.exe (PID: 3268)

    • Reads the computer name

      • Fortect.exe (PID: 5740)
      • Fortect.exe (PID: 3268)

    • The process uses the downloaded file

      • Fortect.exe (PID: 5740)
      • Fortect.exe (PID: 6796)

    • Process checks computer location settings

      • Fortect.exe (PID: 5740)
      • Fortect.exe (PID: 6796)

    • Creates files or folders in the user directory

      • Fortect.exe (PID: 6796)
      • Fortect.exe (PID: 3268)

    • Reads Environment values

      • Fortect.exe (PID: 3268)

    • Checks proxy server information

      • Fortect.exe (PID: 3268)

    • Reads the software policy settings

      • Fortect.exe (PID: 3268)

    • Reads the machine GUID from the registry

      • Fortect.exe (PID: 3268)

    • Creates files in the program directory

      • Fortect.exe (PID: 3268)

    • Manual execution by a user

      • FortectTray.exe (PID: 5172)
      • FortectMain.exe (PID: 4032)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:25 21:56:47+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x3640
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 7.1.1.1
ProductVersionNumber: 7.1.1.1
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Fortect
FileDescription: Fortect Setup
FileVersion: 7.1.1.1
InternalName: Fortect.exe
LegalCopyright: © Fortect
LegalTrademarks: © Fortect
OriginalFileName: Fortect.exe
ProductName: Fortect
ProductVersion: 7.1.1.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
13
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start fortect.exe fortect.exe #ADWARE svchost.exe #ADWARE fortect.exe #ADWARE maindaemon.exe maindaemon.exe no specs mainservice.exe no specs #ADWARE mainservice.exe fortecttray.exe no specs fortectmain.exe fortectmain.exe no specs #ADWARE fortectmain.exe fortectmain.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3268"C:\Users\admin\AppData\Local\Temp\Fortect.exe" /Language=1034 /LangSwitch=true /machine=8a3dee36982280f9964c4c545c7b600246cdea575fb22971dd9699b657fc3036 /run=f917728e-bf37-4daa-a971-d9de2db66108 /scan=1C:\Users\admin\AppData\Local\Temp\Fortect.exe
Fortect.exe
User:
admin
Company:
Fortect
Integrity Level:
HIGH
Description:
Fortect Setup
Exit code:
0
Version:
7.1.1.1
Modules
Images
c:\users\admin\appdata\local\temp\fortect.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3720"C:\Program Files\Fortect\MainService.exe" --install --hostId 8a3dee36982280f9964c4c545c7b600246cdea575fb22971dd9699b657fc3036C:\Program Files\Fortect\MainService.exe—Fortect.exe
User:
admin
Company:
Fortect LTD.
Integrity Level:
HIGH
Description:
Fortect Service
Exit code:
0
Version:
7.1.1.1
Modules
Images
c:\program files\fortect\mainservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
4032"C:\Program Files\Fortect\FortectMain.exe" --lang=es --firstRun --runId=f917728e-bf37-4daa-a971-d9de2db66108C:\Program Files\Fortect\FortectMain.exe
explorer.exe
User:
admin
Company:
Fortect LTD®
Integrity Level:
MEDIUM
Description:
Fortect Main
Version:
7.1.1.1
Modules
Images
c:\program files\fortect\fortectmain.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4528"C:\Program Files\Fortect\FortectMain.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\Fortect" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1888,i,2138607378522765036,9507156960706012730,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2C:\Program Files\Fortect\FortectMain.exe—FortectMain.exe
User:
admin
Company:
Fortect LTD®
Integrity Level:
LOW
Description:
Fortect Main
Version:
7.1.1.1
Modules
Images
c:\program files\fortect\fortectmain.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5060"C:\Program Files\Fortect\FortectMain.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\Fortect" --app-user-model-id=" " --app-path="C:\Program Files\Fortect\resources\app.asar" --no-sandbox --no-zygote --lang=es --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2552 --field-trial-handle=1888,i,2138607378522765036,9507156960706012730,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1C:\Program Files\Fortect\FortectMain.exe—FortectMain.exe
User:
admin
Company:
Fortect LTD®
Integrity Level:
MEDIUM
Description:
Fortect Main
Version:
7.1.1.1
Modules
Images
c:\program files\fortect\fortectmain.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5172"C:\Program Files\Fortect\bin\FortectTray.exe" trueC:\Program Files\Fortect\bin\FortectTray.exe—explorer.exe
User:
admin
Company:
Fortect Ltd.
Integrity Level:
MEDIUM
Description:
Fortect Tray App
Version:
7.1.1.1
Modules
Images
c:\program files\fortect\bin\fortecttray.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5492"C:\Program Files\Fortect\bin\MainDaemon.exe"C:\Program Files\Fortect\bin\MainDaemon.exe—services.exe
User:
SYSTEM
Company:
Fortect Ltd.
Integrity Level:
SYSTEM
Description:
Fortect Daemon
Version:
7.1.1.1
Modules
Images
c:\program files\fortect\bin\maindaemon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
5740"C:\Users\admin\AppData\Local\Temp\Fortect.exe" C:\Users\admin\AppData\Local\Temp\Fortect.exe
explorer.exe
User:
admin
Company:
Fortect
Integrity Level:
MEDIUM
Description:
Fortect Setup
Exit code:
2
Version:
7.1.1.1
Modules
Images
c:\users\admin\appdata\local\temp\fortect.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6108"C:\Program Files\Fortect\FortectMain.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Roaming\Fortect" --mojo-platform-channel-handle=2172 --field-trial-handle=1888,i,2138607378522765036,9507156960706012730,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8C:\Program Files\Fortect\FortectMain.exe
FortectMain.exe
User:
admin
Company:
Fortect LTD®
Integrity Level:
MEDIUM
Description:
Fortect Main
Version:
7.1.1.1
Modules
Images
c:\program files\fortect\fortectmain.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
854 628
Read events
854 598
Write events
30
Delete events
0

Modification events

(PID) Process:(3268) Fortect.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3268) Fortect.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3268) Fortect.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3268) Fortect.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Fortect\Engine
Operation:writeName:lang
Value:
1034
(PID) Process:(3268) Fortect.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Fortect\Daemon
Operation:writeName:Version
Value:
7.1.1.1
(PID) Process:(6920) MainDaemon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Fortect\Daemon\timers
Operation:writeName:daily_license
Value:
(PID) Process:(6920) MainDaemon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Fortect\Daemon\timers
Operation:writeName:ack_event
Value:
(PID) Process:(6920) MainDaemon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Fortect\Daemon\timers
Operation:writeName:notifications
Value:
(PID) Process:(6920) MainDaemon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Fortect\Daemon\timers
Operation:writeName:recheck
Value:
(PID) Process:(6920) MainDaemon.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Fortect\Daemon
Operation:writeName:oiid
Value:
Executable files
112
Suspicious files
209
Text files
29
Unknown types
10

Dropped files

PID
Process
Filename
Type
5740Fortect.exeC:\Users\admin\AppData\Local\Temp\Fortect\plugins\System.dllexecutable
MD5:A6A9A761F8BF173D4DEA7823195EB97C
SHA256:6C6ED48BE417F931E149185EFF306244A7A82E2113E0F7483CCEF74DAEA78EBD
6796Fortect.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8der
MD5:971C514F84BBA0785F80AA1C23EDFD79
SHA256:F157ED17FCAF8837FA82F8B69973848C9B10A02636848F995698212A08F31895
5740Fortect.exeC:\Users\admin\AppData\Local\Temp\nsy857A.tmp\UserInfo.dllexecutable
MD5:7C12B2DDE3D65C1D4DE5456C2F92AA9D
SHA256:D6360E692B8EDC5CEDA976E9027A917D379B5C62C958227130DD68DE2F5BE3A6
5740Fortect.exeC:\Users\admin\AppData\Local\Temp\Fortect\plugins\LogEx.dllexecutable
MD5:FF2DD47B0478CE26E7FEED13E280EAEE
SHA256:D6149EFB37AED74391AC89914A600E6761E105D0BD823CF144FAD4E9FC323319
6796Fortect.exeC:\Users\admin\AppData\Local\Temp\Fortect\plugins\fUtil.dllexecutable
MD5:1297CA8428913A757F0783075445E763
SHA256:434D85E0EF451962D2F33B53FB0738B371A699FDD11691FBF6E09C6BD7D4994A
6796Fortect.exeC:\Users\admin\AppData\Local\Temp\Fortect\plugins\modern-header.bmpimage
MD5:1E608F54C109218745C0D7A06BCD5235
SHA256:843BB7E3A52E3EEB58A0EF385F21D80383C8E5E65DAF12BC297D570BC6722F22
6796Fortect.exeC:\Users\admin\AppData\Local\Temp\Fortect\plugins\INetC.dllexecutable
MD5:A6674D9F6E0C1E30AFA8007B9E4F211B
SHA256:DBBC53126213C325D209C242FBB6C097E86906A77F8A98896200492CDE19B0B8
6796Fortect.exeC:\Users\admin\AppData\Local\Temp\nsk8B84.tmp\UserInfo.dllexecutable
MD5:7C12B2DDE3D65C1D4DE5456C2F92AA9D
SHA256:D6360E692B8EDC5CEDA976E9027A917D379B5C62C958227130DD68DE2F5BE3A6
6796Fortect.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12der
MD5:7FB5FA1534DCF77F2125B2403B30A0EE
SHA256:33A39E9EC2133230533A686EC43760026E014A3828C703707ACBC150FE40FD6F
6796Fortect.exeC:\Users\admin\AppData\Local\Temp\Fortect\plugins\Banner.dllexecutable
MD5:297E0EB8AC76B69B873C26A8532A6AAC
SHA256:64BA1AFEBFD0CA81D294D6001A358711E8E8992C08E40181050A3D465ACB4030
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
80
DNS requests
27
Threats
34

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2112
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
—
—
GET
200
142.250.185.67:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
6572
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
142.250.185.67:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
6460
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6460
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2968
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl%20
unknown
—
—
whitelisted
2968
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
6324
MainService.exe
GET
200
104.26.3.16:80
http://app.fortect.com/events/cloud-scan.php?param1=i8wp2mJ8+OVm4ddYzzgWhHed/5PEa3sTxScmqPxgtJkKxKF219ufkAjqWDBXIQDF2L1NXVXDiUGNA5xxxlCiMmUOP8Y87RvlmnwxPpZ7Li3kah3cCj7am14/mgDc1vPBJEZ43mLJvDaLujvQxe/mswXpnCuFU0KO987Dd3uFnYhAWqu8BtWXAsGlfCm1dajiPCSD2VnbVrjqhiwAXKEPaNb3njRhVzKiw6V3Tcqm/mss6r/MiACM06cQfMgKHgcvuJN9zH/G9OTIIJQHJQKlGA==
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5148
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6732
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5336
SearchApp.exe
52.182.143.211:443
browser.pipe.aria.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2112
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
  • 51.124.78.146
  • 4.231.128.59
whitelisted
browser.pipe.aria.microsoft.com
  • 52.182.143.211
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
google.com
  • 142.250.186.142
whitelisted
app.fortect.com
  • 104.26.3.16
  • 104.26.2.16
  • 172.67.75.40
unknown
c.pki.goog
  • 142.250.185.67
whitelisted
go.microsoft.com
  • 184.30.17.189
whitelisted
cloud.fortect.com
  • 172.67.75.40
  • 104.26.2.16
  • 104.26.3.16
unknown
login.live.com
  • 40.126.32.140
  • 40.126.32.74
  • 40.126.32.138
  • 40.126.32.134
  • 40.126.32.68
  • 20.190.160.17
  • 20.190.160.14
  • 40.126.32.76
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed DNS Query to PC Optimizer Software Domain (fortect .com)
—
—
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
3268
Fortect.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
2256
svchost.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed DNS Query to PC Optimizer Software Domain (fortect .com)
3268
Fortect.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
2256
svchost.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed DNS Query to PC Optimizer Software Domain (fortect .com)
6920
MainDaemon.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
6920
MainDaemon.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
6920
MainDaemon.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
6920
MainDaemon.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI)
Process
Message
Fortect.exe
ExecShellAsUser: got desktop
Fortect.exe
ExecShellAsUser: elevated process detected
Fortect.exe
ExecShellAsUser: thread finished
Fortect.exe
ExecShellAsUser: DLL_PROCESS_DETACH
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Fortect.exe