Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    25/05/2026, 16:15

General

  • Target
    Fortect (1).exe
  • Size 826KB
  • Sample260525-tp87psds6l
  • SHA256 93bf590a2af855ee00af6b488e97ab1b1ddffe10188a9bd73e8a1117f0366958
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Remote Services: SMB/Windows Admin Shares 1 TTPs 1 IoCs

    Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 39 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 20 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies registry class 7 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fortect (1).exe
    "C:\Users\Admin\AppData\Local\Temp\Fortect (1).exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5032
    • C:\Program Files\Fortect\bin\MainDaemon.exe
      "C:\Program Files\Fortect\bin\MainDaemon.exe" --install --hostId 69118c71ccaae656726717fbf1d6f55868f734e615277b7778821ea7ce1d4ebe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4768
    • C:\Program Files\Fortect\MainService.exe
      "C:\Program Files\Fortect\MainService.exe" --install --hostId 69118c71ccaae656726717fbf1d6f55868f734e615277b7778821ea7ce1d4ebe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:712
    • C:\Program Files\Fortect\MainProtection.exe
      "C:\Program Files\Fortect\MainProtection.exe" -install
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      PID:5856
    • C:\Program Files\Fortect\MainProtection.exe
      "C:\Program Files\Fortect\MainProtection.exe" -start
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:5592
  • C:\Program Files\Fortect\bin\MainDaemon.exe
    "C:\Program Files\Fortect\bin\MainDaemon.exe"
    1⤵
    • Executes dropped EXE
    PID:3836
  • C:\Program Files\Fortect\bin\MainDaemon.exe
    "C:\Program Files\Fortect\bin\MainDaemon.exe"
    1⤵
    • Executes dropped EXE
    PID:5476
  • C:\Program Files\Fortect\bin\FortectTray.exe
    "C:\Program Files\Fortect\bin\FortectTray.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3112
  • C:\Program Files\Fortect\MainService.exe
    "C:\Program Files\Fortect\MainService.exe"
    1⤵
    • Maps connected drives based on registry
    • Remote Services: SMB/Windows Admin Shares
    • Writes to the Master Boot Record (MBR)
    • Checks computer location settings
    • Drops file in System32 directory
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    PID:5692
  • C:\Program Files\Fortect\cbfilter24.sys
    "C:\Program Files\Fortect\cbfilter24.sys"
    1⤵
    • Executes dropped EXE
    PID:1752
  • C:\Program Files\Fortect\bin\FortectTray.exe
    "C:\Program Files\Fortect\bin\FortectTray.exe" 0
    1⤵
    • Executes dropped EXE
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4564
  • C:\Program Files\Fortect\cbprocess24.sys
    "C:\Program Files\Fortect\cbprocess24.sys"
    1⤵
    • Executes dropped EXE
    PID:5276
  • C:\Program Files\Fortect\cbregistry24.sys
    "C:\Program Files\Fortect\cbregistry24.sys"
    1⤵
    • Executes dropped EXE
    PID:4944
  • C:\Program Files\Fortect\FortectMain.exe
    "C:\Program Files\Fortect\FortectMain.exe" --lang=en --firstRun --runId=bf007843-49e2-4f84-af2d-bcd9049178ab --vpnRolloutUpgrade
    1⤵
    • Drops file in Windows directory
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4332
    • C:\Program Files\Fortect\FortectMain.exe
      "C:\Program Files\Fortect\FortectMain.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Fortect" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1856,i,12182956021833268936,4482245954555306768,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1852 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2060
    • C:\Program Files\Fortect\FortectMain.exe
      "C:\Program Files\Fortect\FortectMain.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Fortect" --field-trial-handle=1856,i,12182956021833268936,4482245954555306768,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
      2⤵
      • Executes dropped EXE
      PID:1600
    • C:\Program Files\Fortect\FortectMain.exe
      "C:\Program Files\Fortect\FortectMain.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Fortect" --app-user-model-id=" " --app-path="C:\Program Files\Fortect\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1856,i,12182956021833268936,4482245954555306768,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:232

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.dll

        • Path C:\Program Files\Fortect\7z.dll
        • Size 1.6MB
        • SHA256 aab15d2aa72dcf7ed94cfb0e5a01ae61160e7a13fbeb7fc9bb1c5c95e7827d73
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Fortect.exe

        • Path C:\Program Files\Fortect\Fortect.exe
        • Size 826KB
        • SHA256 93bf590a2af855ee00af6b488e97ab1b1ddffe10188a9bd73e8a1117f0366958
        • MD5 SHA1 SHA512 SSDEEP TLSH

        last_server_response_json.json

        • Path C:\ProgramData\Fortect\conf\last_server_response_json.json
        • Size 272B
        • SHA256 7e529abefe200720c8767d80fc24bcc0f8f3647040943f51fae7a91bcbfd5dd1
        • MD5 SHA1 SHA512 TLSH

        license.json

        • Path C:\ProgramData\Fortect\conf\license.json
        • Size 320B
        • SHA256 3dd30ae22e12a3f8b5f6af2bcd6622f9382d69c431cbeda0f697fd4c7d827aea
        • MD5 SHA1 SHA512 TLSH

        license_witness.json

        • Path C:\ProgramData\Fortect\conf\license_witness.json
        • Size 144B
        • SHA256 7986a72dd3671a5392ac5f30469ab109efab38fff3610c13086c2928216d87db
        • MD5 SHA1 SHA512 TLSH

        settings_user.json

        • Path C:\ProgramData\Fortect\conf\settings_user.json
        • Size 416B
        • SHA256 579230a2e0da182334d741c9711fce5dee60f00c649b17da1011d8bdcb26a651
        • MD5 SHA1 SHA512 TLSH

        statistics.json

        • Path C:\ProgramData\Fortect\conf\statistics.json
        • Size 864B
        • SHA256 09272346e25c55d5bf595843f761b92cd7c87afdf2b6c059325b75bdc9218b25
        • MD5 SHA1 SHA512 TLSH

        driverUpdater_res.json

        • Path C:\ProgramData\Fortect\res\driverUpdater_res.json
        • Size 96B
        • SHA256 7014dfa6c6c839d1c8cac94bed8d425161f60ab58ff5ebf607febc8b3ee0dea5
        • MD5 SHA1 SHA512 TLSH

        insData.txt

        • Path C:\ProgramData\fortect\logs\insData.txt
        • Size 177B
        • SHA256 e4deea1ebaddef569452dd54f80adf0dae2692859f49fe74c7567f8029347d71
        • MD5 SHA1 SHA512 TLSH

        events[2].htm

        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IJF9A794\events[2].htm
        • Size 2B
        • SHA256 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
        • MD5 SHA1 SHA512

        MainDaemon.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\397854D068C4\programfiles\MainDaemon.exe
        • Size 5.1MB
        • SHA256 26588e7a7ba12c21b286035aa0f07a982e8bbc55def742b7aaf3af3eced361ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        HBEDV.KEY

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programdata\av\HBEDV.KEY
        • Size 1024B
        • SHA256 1fe68946a99b7d6d57cdc7666df1123a9822b2ddab595b22aea5507fb3b98bda
        • MD5 SHA1 SHA512 TLSH

        avupdate.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programdata\av\avupdate.exe
        • Size 5.3MB
        • SHA256 aa48b6fa009600eff64bb7f10ec0eab267a62d0bfad486a525ab67aee839cedf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        avupdate_msg.avr

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programdata\av\avupdate_msg.avr
        • Size 6KB
        • SHA256 17a0c15c839a7be1a57f8abab56efef5983e212c732e0b33b6f012f989ae8d1c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        scew.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programdata\av\scew.dll
        • Size 314KB
        • SHA256 dfa555b946e894757c403a44bed8f50ec42edd27040c4bc2b04d9a9e6c5d611f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        conf.json

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programdata\conf\conf.json
        • Size 348KB
        • SHA256 b7b39f5bf92f6b5bf7c06ed13043114289fdd93723fa117e8cf22b616c717ef7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cron_MainNetShield.json

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programdata\conf\cron_MainNetShield.json
        • Size 1KB
        • SHA256 e22e41dd0e1683201262bf8bcc6e06599de1989e4b1b9aed3362c88a908ee087
        • MD5 SHA1 SHA512 TLSH

        cron_MainService.json

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programdata\conf\cron_MainService.json
        • Size 2KB
        • SHA256 75c28a70b709700376251d42565f54682c9fb7467027b9ddc52524910836afe1
        • MD5 SHA1 SHA512 TLSH

        netShield.json

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programdata\conf\netShield.json
        • Size 4KB
        • SHA256 96d6639f6cd138888fd6dac7179aa2560a8405ae209b74cbb3d595f51fb8d7de
        • MD5 SHA1 SHA512 SSDEEP TLSH

        netshield_user_setting.json

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programdata\conf\netshield_user_setting.json
        • Size 16B
        • SHA256 b1e12a43a5408c7829aa5a6ff7181034a4e485028a7f7c7a9c1d386cbf726376
        • MD5 SHA1 SHA512

        settings.json

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programdata\conf\settings.json
        • Size 69KB
        • SHA256 95b9520b8a5cba561fe4abaaa8c0216378075ace1a93f07d6d3882ac655ef78c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        settings_user.json

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programdata\conf\settings_user.json
        • Size 400B
        • SHA256 bfd410927ef16994229865873aa0c530650a21555682b8b45571167f719c3c3c
        • MD5 SHA1 SHA512 TLSH

        sil.json

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programdata\conf\sil.json
        • Size 209KB
        • SHA256 9f0b69c72c4e7d89e6fef292727a5290e31daa1747bbf5d5ab20b40d89e6104a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vp.json

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programdata\conf\vp.json
        • Size 1KB
        • SHA256 d1d339afbe36471183e96eef1f942836a83ed53b73aff0da400aa6560eb224ae
        • MD5 SHA1 SHA512 TLSH

        AvProxy.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\AvProxy.exe
        • Size 4.6MB
        • SHA256 a4cd3bfa6f7cb388f7f11b9a0d1f424cbf9e2b34de0fb808b0acdf1b77dd260d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSE

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\LICENSE
        • Size 1KB
        • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
        • MD5 SHA1 SHA512 TLSH

        LICENSES.chromium.html

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\LICENSES.chromium.html
        • Size 11.7MB
        • SHA256 8df32d3dd7520440f46d7d8693aa57933099c38a242e6ab036095275bdae2757
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MainNetShield.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\MainNetShield.exe
        • Size 5.0MB
        • SHA256 395a12e5f6f33e6a0c7bd4573744e18eb6ad9f3f58cbd2d1bf0f2ff9820b7cac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MainProtection.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\MainProtection.exe
        • Size 4.7MB
        • SHA256 c7c6eb1f2f243bc53e399ddc8c97c4b895f47f8e25755ad2fb86c1fa20ed7493
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MainService.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\MainService.exe
        • Size 7.2MB
        • SHA256 d1c15fcab88f98d22065fc5cf2ab623417f923c2da9764e5e147d95123869db5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ProtocolFilters.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\ProtocolFilters.dll
        • Size 1.3MB
        • SHA256 eafeffdc2a91cd938b3c2d3359a66b6ed307adfd8119638c5ebe27b40cef14b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ams_setup.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\ams_setup.exe
        • Size 192KB
        • SHA256 b5673a04bbda393d3507f56a3aec7c6f0addeae6872cc8e070298c4b61171c89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        amswsccomm.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\amswsccomm.dll
        • Size 326KB
        • SHA256 74b037b15d2850512921b7c66f3a6895d1a1006e8a5cf9a7337664a929999e87
        • MD5 SHA1 SHA512 SSDEEP TLSH

        apc_random_id_generator.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\apc_random_id_generator.exe
        • Size 343KB
        • SHA256 cadd8110928108d983fecc16da4d3594ed3b27bb8c13826cd093f84d9f6f94a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        apcfile.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\apcfile.dll
        • Size 5.9MB
        • SHA256 9296c27eeabc0304dbb539ff2a497935fa7ced0b950553050f7509db2bba67a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        apchash.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\apchash.dll
        • Size 3.6MB
        • SHA256 4dd9939cd5884696352d3417457018741cfe7c94cad83feaa6c0ea9c161b1469
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FortectTray.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\bin\FortectTray.exe
        • Size 3.3MB
        • SHA256 2ee43bd069def824b1a8dc1e07a106d9c81e9283b37f9b934e689aef954d0f38
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cacert.crt

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\cacert.crt
        • Size 5KB
        • SHA256 c38123acd05cd0cfe4375417f766a9a465327117f5025b16e4403cfd2e07f045
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cbfsfilter24.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\cbfsfilter24.dll
        • Size 983KB
        • SHA256 32b370ff90b31185c5cd0631fb93036e628568ea742a41f6bb04dcd53d69e4a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_100_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\chrome_100_percent.pak
        • Size 144KB
        • SHA256 6ce0ccf6a0cc4ea8be11262d168a344bc3ee78a4a6365d755ffb5570bc48d6d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_200_percent.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\chrome_200_percent.pak
        • Size 215KB
        • SHA256 68e92cde2557d68eddcf8df21ce4d1ef7a85581fb28cd5ab93db20812217e073
        • MD5 SHA1 SHA512 SSDEEP TLSH

        d3dcompiler_47.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\d3dcompiler_47.dll
        • Size 4.7MB
        • SHA256 b1e537351e66c6e0347eb039fd11fd991cc26679855d8794c9e2c701e6b32ab1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cbfilter.cab

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\drivers\cbfilter.cab
        • Size 606KB
        • SHA256 679a36fdacb809eba188eb1e54ee3ff5be57b555f44aaadb38031a4de8a2c43e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cbprocess.cab

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\drivers\cbprocess.cab
        • Size 153KB
        • SHA256 459e1460e23cf13426f0656a54fc542535f799c66b8ac80d9458be1c76555f2f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cbregistry.cab

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\drivers\cbregistry.cab
        • Size 221KB
        • SHA256 f75f4898fe17b0c9a47aaa06dc4f9b9f311c024cd6db162ca71da6393bfa3734
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CBFilterInst.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\drivers\installer\x64\CBFilterInst.dll
        • Size 213KB
        • SHA256 8a4965e7e5de1d54556f751983edda5281e13f5f4361ba7fdf3eed127095c83b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CBProcessInst.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\drivers\installer\x64\CBProcessInst.dll
        • Size 209KB
        • SHA256 d9d2080e95d0c08c6b311b3ad67c0387d5a1e97e11f504d488f777442dd20a02
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CBRegistryInst.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\drivers\installer\x64\CBRegistryInst.dll
        • Size 212KB
        • SHA256 fc27ddffb467e15d1bcd0106a590ce3797f1ad681be4cc0c3427edf7eeadaf6a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AMSAgent.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\elam_ppl\AMSAgent.exe
        • Size 1.1MB
        • SHA256 429092df22f0312932d79529a872494cb271888c80de8522b4186b4005775d40
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AMSProtectedService.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\elam_ppl\AMSProtectedService.exe
        • Size 624KB
        • SHA256 98fcbacccd356a5309626a0cfd398702f5f2b582e0ceddbc8aab55dac1a0271d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SecurityProductInformation.ini

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\elam_ppl\SecurityProductInformation.ini
        • Size 97B
        • SHA256 b5a28f239fc6367f6bc210805a62c25c909df2351aff10777972d1d29894cd4d
        • MD5 SHA1 SHA512 TLSH

        concrt140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\elam_ppl\concrt140.dll
        • Size 238KB
        • SHA256 6567e9d90e91c3a146f1b9b6f30b2ab6ba04df11991647941b750bc141a718c0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mfc140u.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\elam_ppl\mfc140u.dll
        • Size 4.9MB
        • SHA256 be03d1dabf873ebe9790e955e63229c8d00cf1ffb4f15cf9a114c6951522a7ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        msvcp140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\elam_ppl\msvcp140.dll
        • Size 433KB
        • SHA256 038a419c6225eda86802dd2bfbc636cc4f7d175c64937f51acded8f1785e8a12
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vcruntime140.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\elam_ppl\vcruntime140.dll
        • Size 71KB
        • SHA256 ee2d1077b36102794673334095fc60262cb03d7f66a42a3e9c93804338276987
        • MD5 SHA1 SHA512 SSDEEP TLSH

        amselam.sys

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\elam_ppl\win32\win10RS6\amselam.sys
        • Size 19KB
        • SHA256 9d2479cfe101d6734b01f053398e3ba17154d456c774d8bc619c544831895052
        • MD5 SHA1 SHA512 SSDEEP TLSH

        amselam.sys

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\elam_ppl\win64\win10RS6\amselam.sys
        • Size 21KB
        • SHA256 927fa480ef9d4ffa528e3813604e1373983d3c1bdfd25808d0d886392d43958e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ffmpeg.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\ffmpeg.dll
        • Size 2.9MB
        • SHA256 5211cbe4110570e01104276df30262b2257fcc2c2a820eb5e5d4ba185dfee1ce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fns.cat

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\fns\fns.cat
        • Size 10KB
        • SHA256 3d117cd3d3ba63f801a9af4211a0cf863dbbce8c2dd3142f868bc1e8aae12400
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fns.inf

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\fns\fns.inf
        • Size 1KB
        • SHA256 bdda3a39ee75de412824286509a45e6dfbaca39292c84db63480f0f82a0f12fa
        • MD5 SHA1 SHA512 TLSH

        fns.sys

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\fns\fns.sys
        • Size 107KB
        • SHA256 7c78255f6823b1354ae5b0cb4b5b3e7f2f6200622d635ab18d19330e72a3eec5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icudtl.dat

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\icudtl.dat
        • Size 10.0MB
        • SHA256 a9f6072e858ea29cb66501847856d403c862f23d03cac2656d1e0fa2865fdc7b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libEGL.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\libEGL.dll
        • Size 502KB
        • SHA256 22bb87910a955608d26450c35e6e687381fd1be51d412bbdf36e2cfe63c1704c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libGLESv2.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\libGLESv2.dll
        • Size 7.7MB
        • SHA256 3582d63bdbc630e1ff29d5e1ca61a706dfa5b4f84b097e4e8f4206699f54de2e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libcrypto-3-x64.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\libcrypto-3-x64.dll
        • Size 6.6MB
        • SHA256 95d97a2adbd163c212b8efc8eb4d9e4163483e9cc0889a5affba5e4ce12fc99a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libssl-3-x64.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\libssl-3-x64.dll
        • Size 1.4MB
        • SHA256 c7f19f91fe9db02bb5e24efdec705c9ca73b61e8aed0fec255f7d52ad6b398ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        af.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\af.pak
        • Size 536KB
        • SHA256 842fa605183eb7cb2764af9ef34eade4a6dbf59ffa726b240a799ec4f829cacd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        am.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\am.pak
        • Size 868KB
        • SHA256 ecbadbf260e62099e6140327f0acb40d79ac010676d48f4fd557085f6668f43d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ar.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\ar.pak
        • Size 954KB
        • SHA256 eb80f7d9b8ef4895f4b122616ae97ec63a5123b37ae68d68ecb5f332095ec2ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bg.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\bg.pak
        • Size 991KB
        • SHA256 12b755ee6a50f30b327980e59d086e9f178c6e1bccd0c2bf387696e2c538a5b7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        bn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\bn.pak
        • Size 1.2MB
        • SHA256 43a0c8bf652288c7a1efaf19926d25275507fa03e9134cfe5e3a580e8e7cd203
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ca.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\ca.pak
        • Size 602KB
        • SHA256 5a03f4f7ba62998eabf8ccdbd55a49b06398bf5f7aa3eb3f0ae26cfe8a65c31f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cs.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\cs.pak
        • Size 622KB
        • SHA256 0a11d902fcf7f082ea6d602cba67d2befcc639de500c5fef56a7055a0b444a9f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        da.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\da.pak
        • Size 562KB
        • SHA256 1145dc560e49c746fd7466f064b1dcd1ec25d22b4b38a13261174aad5505caf8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        de.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\de.pak
        • Size 601KB
        • SHA256 3695fb21a7d356c5dbaf7f8393d3e53554e4c19c2979358c0e59411fac67a5e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        el.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\el.pak
        • Size 1.1MB
        • SHA256 55a09ed6d1bd58e73161450c828ac59cf86162a9cd18f83b246fb19ffa50e83c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-GB.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\en-GB.pak
        • Size 487KB
        • SHA256 dedf16f15baa50b05832c27d1f9d030c60bcefac7e4a8cdb30df20fda4e39a7d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-US.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\en-US.pak
        • Size 492KB
        • SHA256 cc7d18d3a6606b645ede826de9417c961d6ebb815f7250bad3a930da89dcd3a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es-419.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\es-419.pak
        • Size 593KB
        • SHA256 ab6f9a95d333e5bb14d5420e49c5636703d8fc965212cb748e2522505b6bec91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        es.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\es.pak
        • Size 592KB
        • SHA256 590238a02b3cc14b05aaf21d5285035b45ff55575dd533264461e5170583cead
        • MD5 SHA1 SHA512 SSDEEP TLSH

        et.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\et.pak
        • Size 539KB
        • SHA256 605996ff0c8a43f772dc64274ab309c4313ced4e8c936f82bcd797b54cb5c6e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fa.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\fa.pak
        • Size 885KB
        • SHA256 8dd8cb4a8fdcd5833f73ef7947649ec24ed0538b3d5f079d82cf441cf955d6b7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\fi.pak
        • Size 550KB
        • SHA256 1517fe8463e2bfb502e01667d7f9ed0027369f5b976b1e0a38feefe82caa2c7e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fil.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\fil.pak
        • Size 623KB
        • SHA256 b87306fed8f471279c134d460581ecc13d17b533c184be7c1241d6bcf74d32e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\fr.pak
        • Size 642KB
        • SHA256 2ae85ac2b90ebaabe034b979ffb53c50f3dbe2fa9bd7420d370839da5538cef7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\gu.pak
        • Size 1.2MB
        • SHA256 8da2aef78a775083f19573a14e0861a96a8990866920b3dd4b1aa4d43552159a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        he.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\he.pak
        • Size 777KB
        • SHA256 4948fa44871e8ed5a0ed2d553f4dd698548b60618b55619239045181a8ec519e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\hi.pak
        • Size 1.3MB
        • SHA256 8ddded9b2dea1787367869152f2b27f93556ec515f7da6f361a73ac61fdcb73a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\hr.pak
        • Size 599KB
        • SHA256 9a7a1dea1bd0bf594acbc356ddac9fb64d993fa96f5d3cc1f38f9486abc888bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        hu.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\hu.pak
        • Size 645KB
        • SHA256 8e00a8562e32713abf7c99fb9543f65505f8f6d0509ad6b6b7607896f689e2e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        id.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\id.pak
        • Size 532KB
        • SHA256 6d46b40dea9ba42a9ca6dda6e7ff81a3dbcd86b61fb2d7a5fe946d06bdce5d30
        • MD5 SHA1 SHA512 SSDEEP TLSH

        it.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\it.pak
        • Size 585KB
        • SHA256 e5fb1e10e15d55c42cdd937e133a9725739259157b1b3f134333cad7110e5978
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ja.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\ja.pak
        • Size 712KB
        • SHA256 91461c3b4a426688b16926d3279a44590cab75d65d797b6fd2567e0ec5cde60e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kn.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\kn.pak
        • Size 1.4MB
        • SHA256 81a6a8d7f817bb6fbccfdf8d73f1229cd3bf74aeec0a64373a853e8bff744e8e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ko.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\ko.pak
        • Size 602KB
        • SHA256 67f8b13860dfc28eb3ee150750fab39c0b41e8638f06920f240f434ce08ec753
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lt.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\lt.pak
        • Size 650KB
        • SHA256 bae83903640041b5f949398d7af1975d67070467c4925950c7a838edd73ed956
        • MD5 SHA1 SHA512 SSDEEP TLSH

        lv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\lv.pak
        • Size 648KB
        • SHA256 229b518ee95bc1960be7e72c8af33633fc8b9a32ee09900ae6d64b771c40d359
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ml.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\ml.pak
        • Size 1.5MB
        • SHA256 a973e6ce2c5cbba8f41e54d9aecef31bdabb070bf06e470afce1c4ed263be671
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\mr.pak
        • Size 1.2MB
        • SHA256 0eae188c9a81bd3257a21dc28448b5e9e5c3f4f4de4dc8e178e7f13cab06d6f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ms.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\ms.pak
        • Size 558KB
        • SHA256 185a275d0fb6263471ca1844c8df7fe91d2e98b209379b4a7ec18981ae642c53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nb.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\nb.pak
        • Size 539KB
        • SHA256 bc11695694983516a9806eaef25e380a5d705c2c8e91324192a0983a50d1291e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\nl.pak
        • Size 560KB
        • SHA256 124b702f9f31eb34f307cae79074812873307f36c9a72f53696567a26ea13ba8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\pl.pak
        • Size 622KB
        • SHA256 55d1f22dcb6fdea4f641984a386b3497cf6d29fdb4c069d1e906efa4404d9550
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-BR.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\pt-BR.pak
        • Size 584KB
        • SHA256 8ab2fce26c0612520d152147637929c23a979ef059ef37757ac6988a9fdd26e1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pt-PT.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\pt-PT.pak
        • Size 589KB
        • SHA256 56974d3f5c4c614fed58eae2b3889898a79b4cd6a13b3468c4f370e2c09470a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ro.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\ro.pak
        • Size 610KB
        • SHA256 309118023eacfe9aeb3405f2606a323982e75b1e33887e85be9235fc2ceeae5b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ru.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\ru.pak
        • Size 1006KB
        • SHA256 e042ce451d72fc1e2fa10a66fbc0490a4d9fdbc34caad64d06307d787ff5ced0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\sk.pak
        • Size 633KB
        • SHA256 aed563cc711b2b65d4734eb6c21aca2fe5fe4411b47681b31af8996245adadf0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sl.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\sl.pak
        • Size 606KB
        • SHA256 495125af6d3cdc85bb24ea4a211ea808208d19ce7af8dbea44e1e9317e91bd5a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\sr.pak
        • Size 935KB
        • SHA256 9d98eefbf8d84ad054f58a286b4891d51ae8da99f82047a09886e4b661db13d0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sv.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\sv.pak
        • Size 543KB
        • SHA256 e663b723c4dec60526182c70c943c9caa4976de09831ded69d59c9fe4114283e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sw.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\sw.pak
        • Size 574KB
        • SHA256 c83bb0238ca67b1137dd73e2ccdbfdbc3c2312d8c95aa2636940cc7dfac13cf0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ta.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\ta.pak
        • Size 1.5MB
        • SHA256 b76188eff81ffd0a0d9ea7e547eff7bc05069baecd650e1c1e11aa707b40e99c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        te.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\te.pak
        • Size 1.3MB
        • SHA256 471e766e6647e4315c45b15f702dfb2a8253ce91044e141034ce37ca9e0ede68
        • MD5 SHA1 SHA512 SSDEEP TLSH

        th.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\th.pak
        • Size 1.1MB
        • SHA256 010ec4d2cf97d45ed2a1934372fa389e49dc32567a97946162271af1c3a6e7e2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tr.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\tr.pak
        • Size 584KB
        • SHA256 801df6a4a8d52b1ebb99da0ea788d933804643cca2bf8bbc46064eb6016e17b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uk.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\uk.pak
        • Size 1009KB
        • SHA256 aa204656b9efbad5069943054f70fc0a6fc1e9f660b4bc59bcfa90cde3c3b0fe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ur.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\ur.pak
        • Size 879KB
        • SHA256 b26fa64bc9d26991d7c2f1d20934e3dbd467d64096053887cde9ce99d7d0456c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vi.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\vi.pak
        • Size 693KB
        • SHA256 06b752bff885c13260adf91b51d56d3ef5048ea0058f69bb24a1db3b45bfa969
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-CN.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\zh-CN.pak
        • Size 498KB
        • SHA256 82717aa331b1ab869046cd691ddc9589882a34715a2522577313f0864acd083b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        zh-TW.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\locales\zh-TW.pak
        • Size 492KB
        • SHA256 61709875e1ede0ecc2582a282896ef6398b0c2f4fec07cfabc68c696ba6dd35a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nfapi.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\nfapi.dll
        • Size 234KB
        • SHA256 bed8b0d01dc93c3588b90e1a7e4a93b56efcf83e9b8c2aeb353e65818dc2ff4f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        README

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\on_access\README
        • Size 526B
        • SHA256 006380095181e4291a88e1edd5c00258cdecd1c34e9d07a54ebca0a67b621578
        • MD5 SHA1 SHA512 TLSH

        avgio.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\on_access\win64\win7\avgio.dll
        • Size 188KB
        • SHA256 17a28a18e578d7e154cc93c29b344f70d9b63ecfc74a147229d0421db6d4b660
        • MD5 SHA1 SHA512 SSDEEP TLSH

        avgntflt.cat

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\on_access\win64\win7\avgntflt.cat
        • Size 9KB
        • SHA256 7f49d676b342ab08d809cac3326e8101c21fb9776d51853a9ce2fb5e8b92c245
        • MD5 SHA1 SHA512 SSDEEP TLSH

        avgntflt.inf

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\on_access\win64\win7\avgntflt.inf
        • Size 2KB
        • SHA256 2d220946e718fbd41e68d9324caf2458a95beb1446e8447edaa2b99c8eb265da
        • MD5 SHA1 SHA512 TLSH

        avgntflt.sys

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\on_access\win64\win7\avgntflt.sys
        • Size 216KB
        • SHA256 31a3f5c4b19040eb20bc15b4609068128fb6028e137e98f2b2c6c679d0311c4d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        avipbb.cat

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\on_access\win64\win7\avipbb.cat
        • Size 9KB
        • SHA256 3ad3712e2d8e420fa4ea033110e202da3b70288b4f42b4f676e12a0b72f4a632
        • MD5 SHA1 SHA512 SSDEEP TLSH

        avipbb.inf

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\on_access\win64\win7\avipbb.inf
        • Size 1KB
        • SHA256 4bdc3b2fb007febf3718c453e08c590d00378fea4e2628431f85ccbb1099605f
        • MD5 SHA1 SHA512 TLSH

        avipbb.sys

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\on_access\win64\win7\avipbb.sys
        • Size 172KB
        • SHA256 e442e66d3e24d54696c8687d1bd1a9ab41ed34b723d2b25af195589d11c4fcde
        • MD5 SHA1 SHA512 SSDEEP TLSH

        avkmgr.cat

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\on_access\win64\win7\avkmgr.cat
        • Size 7KB
        • SHA256 901c32f032fcb4782217c4d2f3f570e932107dda74a173f1f3d8cdb993bd1007
        • MD5 SHA1 SHA512 SSDEEP TLSH

        avkmgr.inf

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\on_access\win64\win7\avkmgr.inf
        • Size 1KB
        • SHA256 f79a54cfa9f0901ff965e577cea1139583d1c73de9568170f895ac2b46c9b305
        • MD5 SHA1 SHA512 TLSH

        avkmgr.sys

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\on_access\win64\win7\avkmgr.sys
        • Size 35KB
        • SHA256 f8d33bbf769786163105c0fa794970054bad34cc5985416af553df1d9a64039b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        avgntflt.cat

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\on_access\win64\win8\avgntflt.cat
        • Size 9KB
        • SHA256 099e028f17154e5dafdf66a9963dbccb25442b0c570c29aeaae1e9d02539a8be
        • MD5 SHA1 SHA512 SSDEEP TLSH

        avgntflt.inf

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\on_access\win64\win8\avgntflt.inf
        • Size 2KB
        • SHA256 c17477ce4372a43268b01e398f438efa52729bb3718324be9ee1508849374f09
        • MD5 SHA1 SHA512 TLSH

        avgntflt.sys

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\on_access\win64\win8\avgntflt.sys
        • Size 204KB
        • SHA256 868ecdf543865035a3703e8837869441683b8ab396eaadf6aaa0e455e8393c5e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        avipbb.cat

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\on_access\win64\win8\avipbb.cat
        • Size 9KB
        • SHA256 f456a7783dfe46bb46547464579498f7b4801258424b4caa264d8c6f57c1150f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        avipbb.sys

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\on_access\win64\win8\avipbb.sys
        • Size 194KB
        • SHA256 80d9d7444623175794a51b6710f99e911943bb58a7a9621bc53d0d4bde304daa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        avkmgr.cat

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\on_access\win64\win8\avkmgr.cat
        • Size 9KB
        • SHA256 71e8546ba1c9716ffc8072f97feb945cc466d832ddbf53b090af179094d473bf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        avkmgr.inf

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\on_access\win64\win8\avkmgr.inf
        • Size 1KB
        • SHA256 bf526004b80b6698f782082cd3da58abf4e52a5f390d2f8d0d131b80f19775d2
        • MD5 SHA1 SHA512 TLSH

        avkmgr.sys

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\on_access\win64\win8\avkmgr.sys
        • Size 45KB
        • SHA256 c754dd80f8f3e19144ffb01a17aace2176cb5a8dd404a38ce6ec4ed88b6af759
        • MD5 SHA1 SHA512 SSDEEP TLSH

        remediation.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\remediation.exe
        • Size 4.5MB
        • SHA256 ea8ef0d8cd1998f30964cbb4c4e45a30b4beda1d5ca88da5d0d0e9aed16ecfab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        resources.pak

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\resources.pak
        • Size 5.7MB
        • SHA256 a22d25e6d4fcfd8e3f86f925beaf6fd2ab1e2b6c5f54cdfe8d2a7f5e56f335f0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        savapi.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\savapi.dll
        • Size 5.6MB
        • SHA256 4a39ddf931fb3a7bbb74e19cd6887cb537af6d998570e69b18fb2a945923d0b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        snapshot_blob.bin

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\snapshot_blob.bin
        • Size 324KB
        • SHA256 69d9b2ecbc649fed6c41ca18e94f3a36b6770ff7038e9a0d07ae1ab824d9f7fb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        sqlite.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\sqlite.dll
        • Size 1.1MB
        • SHA256 9cbb1d0bcfce5061fea3478b5c865eda15e8c5c821fc68b01c4e826f4c68af17
        • MD5 SHA1 SHA512 SSDEEP TLSH

        uninst.exe

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\uninst.exe
        • Size 565KB
        • SHA256 ca3fd34297b91bee464be18741783ac755eec2a4c309ca74c8d437bed17b66f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        v8_context_snapshot.bin

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\v8_context_snapshot.bin
        • Size 685KB
        • SHA256 462919f1b49c9e913042f9e9a738e9510884d5920a426a8a5f1b188e28c4da91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\vk_swiftshader.dll
        • Size 5.3MB
        • SHA256 41c5d04f407184e32db40a42c79173be9fe48cc99ee8c43aaf1b5929786095c6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        vk_swiftshader_icd.json

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\vk_swiftshader_icd.json
        • Size 106B
        • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
        • MD5 SHA1 SHA512 TLSH

        vulkan-1.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\40B1F849AE75\programfiles\vulkan-1.dll
        • Size 903KB
        • SHA256 21a23748d30dc735e2aae5a8727b19d78dc4c2c878c56ef099ad00b21cb9b63c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FortectProtection64.7z

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\FortectProtection64.7z
        • Size 1.6MB
        • SHA256 de8c8cef1f5142e35cd71b96e11df8ad29c2ec36e2f81aa34147c1c85dbe26b0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Banner.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\Banner.dll
        • Size 24KB
        • SHA256 6e09be529a79118083e62132e891b9b09abc2027dc90b2a14e6fd0d2271c7f9d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Crypto.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\Crypto.dll
        • Size 24KB
        • SHA256 490ec3a42d0353a3dca7fdb3f4d2392487a1e7cb2dd30927710e31c7baa75cf8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EnVar.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\EnVar.dll
        • Size 30KB
        • SHA256 c8f7a62d677301e465b808fae51f4a78d11c4a1ac835daf778f3a3c9e65a6ed1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ExecDos.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\ExecDos.dll
        • Size 27KB
        • SHA256 511b74f60f5da3ee22f869340f5f2250ab13e7a1f3322e98ad4aad888304c4f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        INetC.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\INetC.dll
        • Size 45KB
        • SHA256 1b5e463950832acb7f9c0706e844182e63496c09984db8d73bb9beb20fd37183
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LogEx.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\LogEx.dll
        • Size 64KB
        • SHA256 91a421c5ef3f37bf82b351fff7881c6b4e02c216617dcb88e598e432810aea9c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ShellExecAsUser.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\ShellExecAsUser.dll
        • Size 63KB
        • SHA256 c9fa24f38a92a005ef34996ab6862c442226e62c66e346c5068ec208118cfd19
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\System.dll
        • Size 32KB
        • SHA256 afa34914c1fb8c094d21c62d8395f5d1ea2e2a1ca4ec91caf565d92ac61cb318
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UserInfo.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\UserInfo.dll
        • Size 24KB
        • SHA256 211bc1bdf322751acd5cc2b2fcfe6fd3f88cecb662d687ce1655d8f02a4f14b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        fUtil.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\fUtil.dll
        • Size 243KB
        • SHA256 34208ce8735852fd589010c51f18be1814a1e48c59eda19475324eb68045ad2f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsDialogs.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\nsDialogs.dll
        • Size 30KB
        • SHA256 c8e3952e66bbe4947dee852592a40d362dc7e33eed5b9b85a761801ed5e51798
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsJSON.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\nsJSON.dll
        • Size 44KB
        • SHA256 767d08af275a46029feda2db75055027cc692eebb69199afee15be1b519556f3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsProcess.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\nsProcess.dll
        • Size 26KB
        • SHA256 d805b5712b959b350d695dd520720284f20be7fb1aab7043ae8e85864b912a91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsis7z.dll

        • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\nsis7z.dll
        • Size 479KB
        • SHA256 fd572b7d3a4be030f68a661461ce66831ef56237b5d0635010b4e29e4dfa328d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cbfilterEvtMsg.dll

        • Path C:\Users\Admin\AppData\Local\Temp\{9708314C-3899-4815-8C18-89EAB63250DF}\cbfilterEvtMsg.dll
        • Size 11KB
        • SHA256 fec1e009231cb8167e1c3f6aecde9ee684f585d1f35e3c2b5c0bb2d5ed6b775c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cbprocessEvtMsg.dll

        • Path C:\Users\Admin\AppData\Local\Temp\{9708314C-3899-4815-8C18-89EAB63250DF}\cbprocessEvtMsg.dll
        • Size 11KB
        • SHA256 96e5e431a61c7ab4144920ed855f1aca05f395aa65620babe0954d2f66aef4fd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cbregistryEvtMsg.dll

        • Path C:\Users\Admin\AppData\Local\Temp\{9708314C-3899-4815-8C18-89EAB63250DF}\cbregistryEvtMsg.dll
        • Size 11KB
        • SHA256 15727012f3bf0ad831cc4496cbae958bf1d4e4deb35c420b579eafe3cd2ba779
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cbfilter24.sys

        • Path C:\Users\Admin\AppData\Local\Temp\{9708314C-3899-4815-8C18-89EAB63250DF}\x64\cbfilter24.sys
        • Size 397KB
        • SHA256 d1b5fdb8340a568588dab928f62167b133a686b9f648626a54d77d952181afb0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cbprocess24.sys

        • Path C:\Users\Admin\AppData\Local\Temp\{9708314C-3899-4815-8C18-89EAB63250DF}\x64\cbprocess24.sys
        • Size 89KB
        • SHA256 7649a6acaee5b8cc1cfbef2f40ab7253fde82d842df3217ca2989825e97df195
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cbregistry24.sys

        • Path C:\Users\Admin\AppData\Local\Temp\{9708314C-3899-4815-8C18-89EAB63250DF}\x64\cbregistry24.sys
        • Size 140KB
        • SHA256 2d8312d29146a6dc6edde1aa8aa298889854a66565afa8f63f9bf920a3f0a3ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        default.dic

        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
        • Size 2B
        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
        • MD5 SHA1 SHA512

        machine.PNF

        • Path C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_726cea1f0f349cf7\machine.PNF
        • Size 151KB
        • SHA256 f97389d3b25323793d18cbad42a1a56df5da2ded55bc25f01fd42447c7ed931a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        printqueue.PNF

        • Path C:\Windows\System32\DriverStore\FileRepository\printqueue.inf_amd64_c5faa879d518215d\printqueue.PNF
        • Size 7KB
        • SHA256 dce4113d128134f27fcdbfc6d7fc38d95883acabba982f8fd90b7014c2a21896
        • MD5 SHA1 SHA512 SSDEEP TLSH