popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Fortect.exe

Emotet Gen1 RedLine stealer Suspicious_Script_Bin NSIS Generic Malware UPX Downloader Antivirus Malicious Library Admin Tool (Sysinternals etc ...) Malicious Packer Javascript_Blob Anti_VM DLL JPEG Format PE File PNG Format OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 July 3, 2024, 9:27 a.m. July 3, 2024, 9:29 a.m.
Size 734.9KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 745dfc19a7a8ce32812211f17b792fa6
SHA256 8cc95ca92f0e702dda28a9177e2f0ec7e38e5fde133542b3d7d1aa92e291da17
CRC32 46FE3FC8
ssdeep 6144:mYa6e2TLtksn9yYx7YthwLBe/Py7M/IArFRTUgsBJxymtDLtq2IK1MX+zLBqGB4l:mYAez7OKNeHy7WTmzxymtlq2IKAYW
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • NSIS_Installer - Null Soft Installer
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
app.fortect.com
A 172.67.75.40
A 104.26.2.16
A 104.26.3.16
104.26.2.16
service.fortect.com
A 172.67.75.40
A 104.26.2.16
A 104.26.3.16
104.26.3.16
cloud.fortect.com
A 172.67.75.40
A 104.26.2.16
A 104.26.3.16
172.67.75.40
IP Address Status Action
104.26.2.16 Active Moloch
104.26.3.16 Active Moloch
164.124.101.2 Active Moloch
172.67.75.40 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49167 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49167 -> 104.26.2.16:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49167 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49167 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49169 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49169 -> 104.26.2.16:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49169 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49171 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49171 -> 104.26.2.16:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49171 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49169 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49171 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
UDP 192.168.56.102:63709 -> 164.124.101.2:53 2048947 ET ADWARE_PUP Observed DNS Query to PC Optimizer Software Domain (fortect .com) Possibly Unwanted Program Detected
TCP 192.168.56.102:49164 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49164 -> 104.26.2.16:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49164 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49163 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49164 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49163 -> 104.26.2.16:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49172 -> 172.67.75.40:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49172 -> 172.67.75.40:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
UDP 192.168.56.102:62846 -> 164.124.101.2:53 2048947 ET ADWARE_PUP Observed DNS Query to PC Optimizer Software Domain (fortect .com) Possibly Unwanted Program Detected
TCP 192.168.56.102:49357 -> 172.67.75.40:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49357 -> 172.67.75.40:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49357 -> 172.67.75.40:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49357 -> 172.67.75.40:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49366 -> 104.26.3.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49368 -> 104.26.3.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49367 -> 104.26.3.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49383 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49383 -> 104.26.2.16:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49377 -> 104.26.3.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49383 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49383 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49374 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49374 -> 104.26.2.16:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49374 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49374 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49365 -> 104.26.3.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49369 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49369 -> 104.26.2.16:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49369 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49369 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
UDP 192.168.56.102:56630 -> 164.124.101.2:53 2048947 ET ADWARE_PUP Observed DNS Query to PC Optimizer Software Domain (fortect .com) Possibly Unwanted Program Detected
TCP 192.168.56.102:49370 -> 104.26.3.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49373 -> 104.26.3.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49380 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49380 -> 104.26.2.16:443 906200054 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) undefined
TCP 192.168.56.102:49380 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected
TCP 192.168.56.102:49380 -> 104.26.2.16:443 2048948 ET ADWARE_PUP Observed PC Optimizer Software Domain (fortect .com in TLS SNI) Possibly Unwanted Program Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLSv1
192.168.56.102:49167
104.26.2.16:443 		None None None
TLSv1
192.168.56.102:49169
104.26.2.16:443 		None None None
TLSv1
192.168.56.102:49171
104.26.2.16:443 		None None None
TLSv1
192.168.56.102:49164
104.26.2.16:443 		None None None
TLSv1
192.168.56.102:49163
104.26.2.16:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=fortect.com e1:5a:ec:76:ca:40:34:3d:d4:20:e8:4f:e7:70:c6:f4:db:f9:92:2e
TLSv1
192.168.56.102:49172
172.67.75.40:443 		C=US, O=Google Trust Services LLC, CN=GTS CA 1P5 CN=fortect.com e1:5a:ec:76:ca:40:34:3d:d4:20:e8:4f:e7:70:c6:f4:db:f9:92:2e
TLSv1
192.168.56.102:49357
172.67.75.40:443 		None None None
TLS 1.3
192.168.56.102:49366
104.26.3.16:443 		None None None
TLS 1.3
192.168.56.102:49368
104.26.3.16:443 		None None None
TLS 1.3
192.168.56.102:49367
104.26.3.16:443 		None None None
TLS 1.3
192.168.56.102:49377
104.26.3.16:443 		None None None
TLSv1
192.168.56.102:49383
104.26.2.16:443 		None None None
TLSv1
192.168.56.102:49374
104.26.2.16:443 		None None None
TLS 1.3
192.168.56.102:49365
104.26.3.16:443 		None None None
TLSv1
192.168.56.102:49369
104.26.2.16:443 		None None None
TLS 1.3
192.168.56.102:49370
104.26.3.16:443 		None None None
TLS 1.3
192.168.56.102:49373
104.26.3.16:443 		None None None
TLSv1
192.168.56.102:49380
104.26.2.16:443 		None None None

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
request GET https://app.fortect.com/events/events.php?sessionid=f1b9f267bedbe168cfcb3bfb1c77135727786305941307e07605b667634ea6d5&minorsessionid=1a01b5d2-41ab-4436-85e7-b2c4a1bb783c&os=7&build=7601&architecture=64&version=6502&id=INSST&param=Downloader%20Started<*>
request GET https://app.fortect.com/ev-install-start/ev-install-start.php?sessionid=f1b9f267bedbe168cfcb3bfb1c77135727786305941307e07605b667634ea6d5&minorsessionid=1a01b5d2-41ab-4436-85e7-b2c4a1bb783c&os=7&build=7601&architecture=64&version=6502
request GET https://app.fortect.com/events/version.php?data=json&sessionid=f1b9f267bedbe168cfcb3bfb1c77135727786305941307e07605b667634ea6d5&minorsessionid=1a01b5d2-41ab-4436-85e7-b2c4a1bb783c&os=7&build=7601&architecture=64&version=6502&installed=
request GET https://app.fortect.com/events/events.php?sessionid=f1b9f267bedbe168cfcb3bfb1c77135727786305941307e07605b667634ea6d5&minorsessionid=1a01b5d2-41ab-4436-85e7-b2c4a1bb783c&os=7&build=7601&architecture=64&version=6502&id=LANG&param=1042<*>ko<*>
request GET https://app.fortect.com/events/events.php?sessionid=f1b9f267bedbe168cfcb3bfb1c77135727786305941307e07605b667634ea6d5&minorsessionid=1a01b5d2-41ab-4436-85e7-b2c4a1bb783c&os=7&build=7601&architecture=64&version=6502&id=INSVR&param=6.5.0.2<*>
request GET https://cloud.fortect.com/app/installation/engine/6502/FortectSetup64.7z
request GET https://cloud.fortect.com/app/installation/service/6502/FortectProtection64.7z
request GET https://app.fortect.com/events/evt_scan.php?sessionid=f1b9f267bedbe168cfcb3bfb1c77135727786305941307e07605b667634ea6d5&minorsessionid=1a01b5d2-41ab-4436-85e7-b2c4a1bb783c&os=7&build=7601&architecture=64&version=6502&id=AUINS&param=service%20installed<*>0<*>6.5.0.2<*>
request GET https://app.fortect.com/events/events.php?sessionid=f1b9f267bedbe168cfcb3bfb1c77135727786305941307e07605b667634ea6d5&minorsessionid=1a01b5d2-41ab-4436-85e7-b2c4a1bb783c&os=7&build=7601&architecture=64&version=6502&id=PKAOK&param=ServiceRunning<*>
request GET https://app.fortect.com/ev-install-end/ev-install-end.php?sessionid=f1b9f267bedbe168cfcb3bfb1c77135727786305941307e07605b667634ea6d5&minorsessionid=1a01b5d2-41ab-4436-85e7-b2c4a1bb783c&os=7&build=7601&architecture=64&version=6502
request GET https://app.fortect.com/events/events.php?sessionid=f1b9f267bedbe168cfcb3bfb1c77135727786305941307e07605b667634ea6d5&minorsessionid=1a01b5d2-41ab-4436-85e7-b2c4a1bb783c&os=7&build=7601&architecture=64&version=6502&id=INSRN&param=6.5.0.2<*>
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1236
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000073a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 3048
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefa1b7000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000007fefa1b7000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0004000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0044000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0044000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2548
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000c0084000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
Time & API Arguments Status Return Repeated

GetDiskFreeSpaceExW

 total_number_of_free_bytes: 0
free_bytes_available: 8724328448
root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer
total_number_of_bytes: 0
1 1 0
file C:\Users\Public\Desktop\Fortect.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fortect\Fortect.lnk
file C:\Users\test22\Desktop\Fortect.lnk
file C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fortect\Uninstall.lnk
file C:\Users\test22\AppData\Local\Temp\Fortect\plugins\Banner.dll
file C:\Users\test22\AppData\Local\Temp\Fortect\plugins\nsDialogs.dll
file C:\Users\test22\AppData\Local\Temp\Fortect\plugins\INetC.dll
file C:\Users\test22\AppData\Local\Temp\Fortect\plugins\ExecDos.dll
file C:\Users\test22\AppData\Local\Temp\Fortect\plugins\nsProcess.dll
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\uninst.exe
file C:\Users\test22\AppData\Local\Temp\Fortect\plugins\LogEx.dll
file C:\Users\test22\AppData\Local\Temp\Fortect\plugins\EnVar.dll
file C:\Users\test22\AppData\Local\Temp\Fortect\plugins\Crypto.dll
file C:\Users\test22\AppData\Local\Temp\Fortect\plugins\nsJSON.dll
file C:\Users\test22\AppData\Local\Temp\nsf293F.tmp\UserInfo.dll
file C:\Users\test22\AppData\Local\Temp\Fortect\D2FA106B920C\programfiles\FortectUpdater.exe
file C:\Users\test22\AppData\Local\Temp\Fortect\plugins\ShellExecAsUser.dll
file C:\Users\test22\AppData\Local\Temp\Fortect\plugins\System.dll
file C:\Users\test22\AppData\Local\Temp\Fortect\plugins\nsis7z.dll
wmi ASSOCIATORS OF{Win32_LogicalDisk.DeviceID='C:'} WHERE AssocClass = Win32_LogicalDiskToPartition
wmi SELECT * FROM Win32_ComputerSystemProduct
wmi SELECT * FROM Win32_BIOS
wmi SELECT * FROM Win32_DiskDrive WHERE DeviceID like '%PHYSICALDRIVE0'
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x0000000000000238
process_name: tvnserver.exe
process_identifier: 2576
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000238
process_name: taskhost.exe
process_identifier: 2872
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000238
process_name: Fortect.exe
process_identifier: 3036
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000238
process_name: WmiPrvSE.exe
process_identifier: 2204
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000238
process_name: taskhost.exe
process_identifier: 2420
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000238
process_name: sppsvc.exe
process_identifier: 2484
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000238
process_name: MainDaemon.exe
process_identifier: 2788
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000238
process_name: cmd.exe
process_identifier: 2968
1 1 0

Process32NextW

 snapshot_handle: 0x0000000000000238
process_name: conhost.exe
process_identifier: 2996
1 1 0

Process32NextW

 snapshot_handle: 0x000000000000016c
process_name: MainService.exe
process_identifier: 2740
1 1 0

Process32NextW

 snapshot_handle: 0x000000000000016c
process_name: dllhost.exe
process_identifier: 2444
1 1 0
ESET-NOD32 Win32/Fortect.A potentially unwanted
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x00000000bfff0000
process_handle: 0xffffffffffffffff
1 0 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeShutdownPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeShutdownPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeShutdownPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeShutdownPrivilege
1 1 0
wmi ASSOCIATORS OF{Win32_LogicalDisk.DeviceID='C:'} WHERE AssocClass = Win32_LogicalDiskToPartition
wmi SELECT * FROM Win32_BIOS
wmi SELECT * FROM Win32_ComputerSystemProduct
wmi SELECT * FROM Win32_DiskDrive WHERE DeviceID like '%PHYSICALDRIVE0'
service_name FortectDaemon service_path C:\Program Files\Fortect\bin\"C:\Program Files\Fortect\bin\MainDaemon.exe"
service_name FortectService service_path C:\Program Files\Fortect\bin\"C:\Program Files\Fortect\MainService.exe"
Time & API Arguments Status Return Repeated

CreateServiceW

 service_start_name:
start_type: 2
password:
display_name: FortectDaemon
filepath: C:\Program Files\Fortect\bin\"C:\Program Files\Fortect\bin\MainDaemon.exe"
service_name: FortectDaemon
filepath_r: "C:\Program Files\Fortect\bin\MainDaemon.exe"
desired_access: 983551
service_handle: 0x00000000004b2880
error_control: 1
service_type: 16
service_manager_handle: 0x00000000004b28e0
1 4925568 0

CreateServiceW

 service_start_name:
start_type: 2
password:
display_name: FortectService
filepath: C:\Program Files\Fortect\bin\"C:\Program Files\Fortect\MainService.exe"
service_name: FortectService
filepath_r: "C:\Program Files\Fortect\MainService.exe"
desired_access: 983551
service_handle: 0x000000000030cc60
error_control: 1
service_type: 16
service_manager_handle: 0x000000000030cd50
1 3198048 0
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\es.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\resources\app.asar
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\bn.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\kn.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\ko.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\en-US.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\fi.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programdata\av\HBEDV.KEY
file C:\ProgramData\Fortect\url_settings.json
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\af.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\ru.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\am.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\it.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programdata\conf\settings.json
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\el.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\lv.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\icudtl.dat
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\ta.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\hr.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\nb.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\chrome_200_percent.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\snapshot_blob.bin
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\ms.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\sv.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\id.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\da.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\ca.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programdata\conf\cron_MainService.json
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\zh-TW.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\th.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programdata\conf\conf.json
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\v8_context_snapshot.bin
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\sw.pak
file C:\ProgramData\Fortect\conf\cron_MainService.json
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\nl.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\ja.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\he.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\bg.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\tr.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\te.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\ur.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\chrome_100_percent.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\en-GB.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\pt-PT.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\sk.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\gu.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programdata\av\avupdate_msg.avr
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\es-419.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programfiles\locales\pt-BR.pak
file C:\Users\test22\AppData\Local\Temp\Fortect\EBB2B7109925\programdata\conf\vp.json
Process injection Process 1236 resumed a thread in remote process 2548
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000000000000c24
suspend_count: 1
process_identifier: 2548
1 0 0