Analysis

  • max time kernel
    82s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 17:07

General

  • Target
    Fortect.exe
  • Size 826KB
  • Sample260910-vm5xyavyfy
  • SHA256 93bf590a2af855ee00af6b488e97ab1b1ddffe10188a9bd73e8a1117f0366958
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Remote Services: SMB/Windows Admin Shares 1 TTPs 1 IoCs

    Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 38 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 44 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies data under HKEY_USERS 42 IoCs
  • Modifies registry class 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fortect.exe
    "C:\Users\Admin\AppData\Local\Temp\Fortect.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2572
    • C:\Program Files\Fortect\bin\MainDaemon.exe
      "C:\Program Files\Fortect\bin\MainDaemon.exe" --install --hostId ba1076447caa9c8d3003cb2ee2aff772a13c6b42bb2b26e65dfe0164c2382c04
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:5044
    • C:\Program Files\Fortect\MainService.exe
      "C:\Program Files\Fortect\MainService.exe" --install --hostId ba1076447caa9c8d3003cb2ee2aff772a13c6b42bb2b26e65dfe0164c2382c04
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:4384
    • C:\Program Files\Fortect\MainProtection.exe
      "C:\Program Files\Fortect\MainProtection.exe" -install
      2⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies registry class
      PID:4948
    • C:\Program Files\Fortect\MainProtection.exe
      "C:\Program Files\Fortect\MainProtection.exe" -start
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:2908
  • C:\Program Files\Fortect\bin\MainDaemon.exe
    "C:\Program Files\Fortect\bin\MainDaemon.exe"
    1⤵
    • Executes dropped EXE
    PID:816
  • C:\Program Files\Fortect\bin\MainDaemon.exe
    "C:\Program Files\Fortect\bin\MainDaemon.exe"
    1⤵
    • Executes dropped EXE
    PID:4408
  • C:\Program Files\Fortect\bin\FortectTray.exe
    "C:\Program Files\Fortect\bin\FortectTray.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2412
  • C:\Program Files\Fortect\MainService.exe
    "C:\Program Files\Fortect\MainService.exe"
    1⤵
    • Maps connected drives based on registry
    • Remote Services: SMB/Windows Admin Shares
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    PID:2984
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:924
    • C:\Program Files\Fortect\bin\FortectTray.exe
      "C:\Program Files\Fortect\bin\FortectTray.exe" 0
      1⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3220
    • C:\Program Files\Fortect\cbprocess24.sys
      "C:\Program Files\Fortect\cbprocess24.sys"
      1⤵
      • Executes dropped EXE
      PID:5748
    • C:\Program Files\Fortect\cbfilter24.sys
      "C:\Program Files\Fortect\cbfilter24.sys"
      1⤵
      • Executes dropped EXE
      PID:4164
    • C:\Program Files\Fortect\cbregistry24.sys
      "C:\Program Files\Fortect\cbregistry24.sys"
      1⤵
      • Executes dropped EXE
      PID:1152
    • C:\Program Files\Fortect\FortectMain.exe
      "C:\Program Files\Fortect\FortectMain.exe" --lang=en --firstRun --runId=db9efeaa-0f15-4f98-a8fa-a026d42a713f
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4440
      • C:\Program Files\Fortect\FortectMain.exe
        "C:\Program Files\Fortect\FortectMain.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Fortect" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1800,i,17673776322803837356,12354576461363908671,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1796 /prefetch:2
        2⤵
        • Executes dropped EXE
        PID:2716
      • C:\Program Files\Fortect\FortectMain.exe
        "C:\Program Files\Fortect\FortectMain.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Fortect" --field-trial-handle=1800,i,17673776322803837356,12354576461363908671,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:11
        2⤵
        • Executes dropped EXE
        PID:1628
      • C:\Program Files\Fortect\FortectMain.exe
        "C:\Program Files\Fortect\FortectMain.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Fortect" --app-user-model-id=" " --app-path="C:\Program Files\Fortect\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1800,i,17673776322803837356,12354576461363908671,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:1
        2⤵
        • Executes dropped EXE
        PID:3692

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          last_server_response_json.json

          • Path C:\ProgramData\Fortect\conf\last_server_response_json.json
          • Size 272B
          • SHA256 b0774576bcc049584071c049dae73ffb0e4ac7214e5f9819c1d10a8f5b1df278
          • MD5 SHA1 SHA512 TLSH

          license.json

          • Path C:\ProgramData\Fortect\conf\license.json
          • Size 320B
          • SHA256 90bf3b28a715cfd370ef2e4f8b16e5aab5feee6016ec67c6cb6d56d27de40208
          • MD5 SHA1 SHA512 TLSH

          license_witness.json

          • Path C:\ProgramData\Fortect\conf\license_witness.json
          • Size 144B
          • SHA256 919e027a5fa3feff6371d40d0ea65937ed492b80cc0cc0410e9f688f6924cbc3
          • MD5 SHA1 SHA512 TLSH

          settings_user.json

          • Path C:\ProgramData\Fortect\conf\settings_user.json
          • Size 416B
          • SHA256 1ad554a616e44926392afec8a6dde08331c9c9d7048a203c4623d82909adb5d0
          • MD5 SHA1 SHA512 TLSH

          statistics.json

          • Path C:\ProgramData\Fortect\conf\statistics.json
          • Size 1KB
          • SHA256 d7c9774a37060f1ebfb4fd9b6c4a6730ee39090587832ea440dee5de1789b00d
          • MD5 SHA1 SHA512 TLSH

          MainProtection.engine.log

          • Path C:\ProgramData\fortect\logs\MainProtection.engine.log
          • Size 8KB
          • SHA256 1a4cd4d966f46ed8b56f5376005b484b31df27fd5fe7f534f3530ee4e4541f35
          • MD5 SHA1 SHA512 SSDEEP TLSH

          insData.txt

          • Path C:\ProgramData\fortect\logs\insData.txt
          • Size 177B
          • SHA256 f516c91b45e3fef9eebfbdf411145446aabf95c216ef1be8be1a57bb038b79c8
          • MD5 SHA1 SHA512 TLSH

          evt_scan[1].htm

          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ORJBYL4S\evt_scan[1].htm
          • Size 2B
          • SHA256 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
          • MD5 SHA1 SHA512

          MainDaemon.exe

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\11DE16698BAC\programfiles\MainDaemon.exe
          • Size 5.6MB
          • SHA256 39f790e744ea388a9fbe9b7ee0345191f55f697c354a7a65dd7987697bce18f9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          HBEDV.KEY

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programdata\av\HBEDV.KEY
          • Size 1024B
          • SHA256 baec7b8ee7c24906d8ca763cd7ab91fd3487f6e5fc161dea576de3b130136082
          • MD5 SHA1 SHA512 TLSH

          avupdate.exe

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programdata\av\avupdate.exe
          • Size 5.3MB
          • SHA256 aa48b6fa009600eff64bb7f10ec0eab267a62d0bfad486a525ab67aee839cedf
          • MD5 SHA1 SHA512 SSDEEP TLSH

          avupdate_msg.avr

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programdata\av\avupdate_msg.avr
          • Size 6KB
          • SHA256 17a0c15c839a7be1a57f8abab56efef5983e212c732e0b33b6f012f989ae8d1c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          scew.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programdata\av\scew.dll
          • Size 314KB
          • SHA256 dfa555b946e894757c403a44bed8f50ec42edd27040c4bc2b04d9a9e6c5d611f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          conf.json

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programdata\conf\conf.json
          • Size 348KB
          • SHA256 b7b39f5bf92f6b5bf7c06ed13043114289fdd93723fa117e8cf22b616c717ef7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cron_MainNetShield.json

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programdata\conf\cron_MainNetShield.json
          • Size 1KB
          • SHA256 be1b8ed9179e07177a3611a12e277e29ead0e32e3d204dabccc4fa0f94411d90
          • MD5 SHA1 SHA512 TLSH

          cron_MainService.json

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programdata\conf\cron_MainService.json
          • Size 2KB
          • SHA256 c83621090f1c7d7d6fe58c20e230f38739f0506103a9735a3d0c97a480983061
          • MD5 SHA1 SHA512 TLSH

          netShield.json

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programdata\conf\netShield.json
          • Size 4KB
          • SHA256 f65b85c8b5add5c05d8e04aa3b9b4fc47b1a6628c7a481b2dd3f3bdceed66428
          • MD5 SHA1 SHA512 SSDEEP TLSH

          netshield_user_setting.json

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programdata\conf\netshield_user_setting.json
          • Size 16B
          • SHA256 b1e12a43a5408c7829aa5a6ff7181034a4e485028a7f7c7a9c1d386cbf726376
          • MD5 SHA1 SHA512

          settings.json

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programdata\conf\settings.json
          • Size 69KB
          • SHA256 54956ac7ac1eec37f9ec05e05dbd04e0b64440e83581c42756aec44b037f20d0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          settings_user.json

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programdata\conf\settings_user.json
          • Size 400B
          • SHA256 bfd410927ef16994229865873aa0c530650a21555682b8b45571167f719c3c3c
          • MD5 SHA1 SHA512 TLSH

          sil.json

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programdata\conf\sil.json
          • Size 209KB
          • SHA256 9f0b69c72c4e7d89e6fef292727a5290e31daa1747bbf5d5ab20b40d89e6104a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vp.json

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programdata\conf\vp.json
          • Size 1KB
          • SHA256 7c73b9e15afe72968d34a78c5e518d88050025f2b44df11c36b375ebfdcfe857
          • MD5 SHA1 SHA512 TLSH

          7z.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\7z.dll
          • Size 1.8MB
          • SHA256 bfd5c503f491764bf058fde55917fed106cdd372d4e6531c3dc2e7a06b1a3f86
          • MD5 SHA1 SHA512 SSDEEP TLSH

          AvProxy.exe

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\AvProxy.exe
          • Size 4.8MB
          • SHA256 6590507f8b6db7be9887861dc6c11d3791db6ccd63d8a1ba24face4c6b4d5ded
          • MD5 SHA1 SHA512 SSDEEP TLSH

          LICENSE

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\LICENSE
          • Size 1KB
          • SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
          • MD5 SHA1 SHA512 TLSH

          LICENSES.chromium.html

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\LICENSES.chromium.html
          • Size 11.7MB
          • SHA256 8df32d3dd7520440f46d7d8693aa57933099c38a242e6ab036095275bdae2757
          • MD5 SHA1 SHA512 SSDEEP TLSH

          MainNetShield.exe

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\MainNetShield.exe
          • Size 5.1MB
          • SHA256 1dfe8ae422e72e7ccf357973f3a8b7c76467d3dc6bdb889cbbb53bb6f088a51c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          MainProtection.exe

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\MainProtection.exe
          • Size 4.7MB
          • SHA256 e5cdea88e3bc1b14fab2ebc4b003a677cd3376d451ec61fff5019c57eb62d3fd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          MainService.exe

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\MainService.exe
          • Size 7.7MB
          • SHA256 b966dc153972c33756cbc7633ccf5708df65a6ed4286356a1603fd93436c772d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          PackMan.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\PackMan.dll
          • Size 323KB
          • SHA256 4b80736747c9e76569e99d935986b29d2a07a01403b480f58bdb0a705961b383
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ProtocolFilters.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\ProtocolFilters.dll
          • Size 1.3MB
          • SHA256 2ad85d3c7f040fc1e3583499c09fc4c024e8f6572015236489a92c41880e1117
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ams_setup.exe

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\ams_setup.exe
          • Size 192KB
          • SHA256 b5673a04bbda393d3507f56a3aec7c6f0addeae6872cc8e070298c4b61171c89
          • MD5 SHA1 SHA512 SSDEEP TLSH

          amswsccomm.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\amswsccomm.dll
          • Size 326KB
          • SHA256 74b037b15d2850512921b7c66f3a6895d1a1006e8a5cf9a7337664a929999e87
          • MD5 SHA1 SHA512 SSDEEP TLSH

          apc_random_id_generator.exe

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\apc_random_id_generator.exe
          • Size 343KB
          • SHA256 cadd8110928108d983fecc16da4d3594ed3b27bb8c13826cd093f84d9f6f94a0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          apcfile.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\apcfile.dll
          • Size 5.9MB
          • SHA256 9296c27eeabc0304dbb539ff2a497935fa7ced0b950553050f7509db2bba67a6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          apchash.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\apchash.dll
          • Size 3.6MB
          • SHA256 4dd9939cd5884696352d3417457018741cfe7c94cad83feaa6c0ea9c161b1469
          • MD5 SHA1 SHA512 SSDEEP TLSH

          FortectTray.exe

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\bin\FortectTray.exe
          • Size 3.4MB
          • SHA256 76704d5a64ed56865eec8d2cf6cb8ddca52db6e6a7ac30ffdfe35ab551d0127e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cacert.crt

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\cacert.crt
          • Size 5KB
          • SHA256 c38123acd05cd0cfe4375417f766a9a465327117f5025b16e4403cfd2e07f045
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cbfsfilter24.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\cbfsfilter24.dll
          • Size 983KB
          • SHA256 32b370ff90b31185c5cd0631fb93036e628568ea742a41f6bb04dcd53d69e4a3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          chrome_100_percent.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\chrome_100_percent.pak
          • Size 144KB
          • SHA256 6ce0ccf6a0cc4ea8be11262d168a344bc3ee78a4a6365d755ffb5570bc48d6d5
          • MD5 SHA1 SHA512 SSDEEP TLSH

          chrome_200_percent.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\chrome_200_percent.pak
          • Size 215KB
          • SHA256 68e92cde2557d68eddcf8df21ce4d1ef7a85581fb28cd5ab93db20812217e073
          • MD5 SHA1 SHA512 SSDEEP TLSH

          d3dcompiler_47.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\d3dcompiler_47.dll
          • Size 4.7MB
          • SHA256 22e771ec7364ee58021bc95f50e098caea7c837fdd07d7d79e1f11dac44656ac
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cbfilter.cab

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\drivers\cbfilter.cab
          • Size 606KB
          • SHA256 679a36fdacb809eba188eb1e54ee3ff5be57b555f44aaadb38031a4de8a2c43e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cbprocess.cab

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\drivers\cbprocess.cab
          • Size 153KB
          • SHA256 459e1460e23cf13426f0656a54fc542535f799c66b8ac80d9458be1c76555f2f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cbregistry.cab

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\drivers\cbregistry.cab
          • Size 221KB
          • SHA256 f75f4898fe17b0c9a47aaa06dc4f9b9f311c024cd6db162ca71da6393bfa3734
          • MD5 SHA1 SHA512 SSDEEP TLSH

          CBFilterInst.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\drivers\installer\x64\CBFilterInst.dll
          • Size 213KB
          • SHA256 8a4965e7e5de1d54556f751983edda5281e13f5f4361ba7fdf3eed127095c83b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          CBProcessInst.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\drivers\installer\x64\CBProcessInst.dll
          • Size 209KB
          • SHA256 d9d2080e95d0c08c6b311b3ad67c0387d5a1e97e11f504d488f777442dd20a02
          • MD5 SHA1 SHA512 SSDEEP TLSH

          CBRegistryInst.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\drivers\installer\x64\CBRegistryInst.dll
          • Size 212KB
          • SHA256 fc27ddffb467e15d1bcd0106a590ce3797f1ad681be4cc0c3427edf7eeadaf6a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          AMSAgent.exe

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\elam_ppl\AMSAgent.exe
          • Size 1.1MB
          • SHA256 429092df22f0312932d79529a872494cb271888c80de8522b4186b4005775d40
          • MD5 SHA1 SHA512 SSDEEP TLSH

          AMSProtectedService.exe

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\elam_ppl\AMSProtectedService.exe
          • Size 624KB
          • SHA256 98fcbacccd356a5309626a0cfd398702f5f2b582e0ceddbc8aab55dac1a0271d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          SecurityProductInformation.ini

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\elam_ppl\SecurityProductInformation.ini
          • Size 97B
          • SHA256 0a1ad8cac824d8163d63e355f871cc1eabe53309ba6bcd779379d1e8fdca46b8
          • MD5 SHA1 SHA512 TLSH

          concrt140.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\elam_ppl\concrt140.dll
          • Size 238KB
          • SHA256 6567e9d90e91c3a146f1b9b6f30b2ab6ba04df11991647941b750bc141a718c0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          mfc140u.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\elam_ppl\mfc140u.dll
          • Size 4.9MB
          • SHA256 be03d1dabf873ebe9790e955e63229c8d00cf1ffb4f15cf9a114c6951522a7ad
          • MD5 SHA1 SHA512 SSDEEP TLSH

          msvcp140.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\elam_ppl\msvcp140.dll
          • Size 433KB
          • SHA256 038a419c6225eda86802dd2bfbc636cc4f7d175c64937f51acded8f1785e8a12
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vcruntime140.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\elam_ppl\vcruntime140.dll
          • Size 71KB
          • SHA256 ee2d1077b36102794673334095fc60262cb03d7f66a42a3e9c93804338276987
          • MD5 SHA1 SHA512 SSDEEP TLSH

          amselam.sys

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\elam_ppl\win32\win10RS6\amselam.sys
          • Size 19KB
          • SHA256 9d2479cfe101d6734b01f053398e3ba17154d456c774d8bc619c544831895052
          • MD5 SHA1 SHA512 SSDEEP TLSH

          amselam.sys

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\elam_ppl\win64\win10RS6\amselam.sys
          • Size 21KB
          • SHA256 927fa480ef9d4ffa528e3813604e1373983d3c1bdfd25808d0d886392d43958e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ffmpeg.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\ffmpeg.dll
          • Size 2.9MB
          • SHA256 89b7b0e4c902c36f4da34108077918ef3f5eee4e640062dfa1ab1d0975fbc33d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fns.cat

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\fns\1722\fns.cat
          • Size 10KB
          • SHA256 08256cda39e78e51f66f284e4dbf38a0c8b1d05fb570a480922627f513c9b57e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fns.inf

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\fns\1722\fns.inf
          • Size 1KB
          • SHA256 f218f8ac728de1aa858f3bf308f9c630d11d1c0348838e050d5f916cf2630ee8
          • MD5 SHA1 SHA512 TLSH

          fns.sys

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\fns\1722\fns.sys
          • Size 112KB
          • SHA256 41d8176a5eddb0dbdc2931e0bd3d046a0a4593205a7e1b459ec5832b5bc35017
          • MD5 SHA1 SHA512 SSDEEP TLSH

          icudtl.dat

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\icudtl.dat
          • Size 10.0MB
          • SHA256 a9f6072e858ea29cb66501847856d403c862f23d03cac2656d1e0fa2865fdc7b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libEGL.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\libEGL.dll
          • Size 502KB
          • SHA256 57082dc3982b7f720f3221b82665296107080c4b9f44cae7fcf9994e2d9ad529
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libGLESv2.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\libGLESv2.dll
          • Size 7.7MB
          • SHA256 552146b6a3a44332619ea325600a2c45b544c53efa24500962a3042c23293230
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libcrypto-3-x64.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\libcrypto-3-x64.dll
          • Size 6.6MB
          • SHA256 95d97a2adbd163c212b8efc8eb4d9e4163483e9cc0889a5affba5e4ce12fc99a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          libssl-3-x64.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\libssl-3-x64.dll
          • Size 1.4MB
          • SHA256 c7f19f91fe9db02bb5e24efdec705c9ca73b61e8aed0fec255f7d52ad6b398ec
          • MD5 SHA1 SHA512 SSDEEP TLSH

          af.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\af.pak
          • Size 536KB
          • SHA256 842fa605183eb7cb2764af9ef34eade4a6dbf59ffa726b240a799ec4f829cacd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          am.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\am.pak
          • Size 868KB
          • SHA256 ecbadbf260e62099e6140327f0acb40d79ac010676d48f4fd557085f6668f43d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ar.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\ar.pak
          • Size 954KB
          • SHA256 eb80f7d9b8ef4895f4b122616ae97ec63a5123b37ae68d68ecb5f332095ec2ab
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bg.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\bg.pak
          • Size 991KB
          • SHA256 12b755ee6a50f30b327980e59d086e9f178c6e1bccd0c2bf387696e2c538a5b7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          bn.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\bn.pak
          • Size 1.2MB
          • SHA256 43a0c8bf652288c7a1efaf19926d25275507fa03e9134cfe5e3a580e8e7cd203
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ca.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\ca.pak
          • Size 602KB
          • SHA256 5a03f4f7ba62998eabf8ccdbd55a49b06398bf5f7aa3eb3f0ae26cfe8a65c31f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          cs.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\cs.pak
          • Size 622KB
          • SHA256 0a11d902fcf7f082ea6d602cba67d2befcc639de500c5fef56a7055a0b444a9f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          da.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\da.pak
          • Size 562KB
          • SHA256 1145dc560e49c746fd7466f064b1dcd1ec25d22b4b38a13261174aad5505caf8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          de.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\de.pak
          • Size 601KB
          • SHA256 3695fb21a7d356c5dbaf7f8393d3e53554e4c19c2979358c0e59411fac67a5e3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          el.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\el.pak
          • Size 1.1MB
          • SHA256 55a09ed6d1bd58e73161450c828ac59cf86162a9cd18f83b246fb19ffa50e83c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-GB.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\en-GB.pak
          • Size 487KB
          • SHA256 dedf16f15baa50b05832c27d1f9d030c60bcefac7e4a8cdb30df20fda4e39a7d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          en-US.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\en-US.pak
          • Size 492KB
          • SHA256 cc7d18d3a6606b645ede826de9417c961d6ebb815f7250bad3a930da89dcd3a3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es-419.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\es-419.pak
          • Size 593KB
          • SHA256 ab6f9a95d333e5bb14d5420e49c5636703d8fc965212cb748e2522505b6bec91
          • MD5 SHA1 SHA512 SSDEEP TLSH

          es.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\es.pak
          • Size 592KB
          • SHA256 590238a02b3cc14b05aaf21d5285035b45ff55575dd533264461e5170583cead
          • MD5 SHA1 SHA512 SSDEEP TLSH

          et.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\et.pak
          • Size 539KB
          • SHA256 605996ff0c8a43f772dc64274ab309c4313ced4e8c936f82bcd797b54cb5c6e6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fa.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\fa.pak
          • Size 885KB
          • SHA256 8dd8cb4a8fdcd5833f73ef7947649ec24ed0538b3d5f079d82cf441cf955d6b7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\fi.pak
          • Size 550KB
          • SHA256 1517fe8463e2bfb502e01667d7f9ed0027369f5b976b1e0a38feefe82caa2c7e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fil.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\fil.pak
          • Size 623KB
          • SHA256 b87306fed8f471279c134d460581ecc13d17b533c184be7c1241d6bcf74d32e3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\fr.pak
          • Size 642KB
          • SHA256 2ae85ac2b90ebaabe034b979ffb53c50f3dbe2fa9bd7420d370839da5538cef7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          gu.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\gu.pak
          • Size 1.2MB
          • SHA256 8da2aef78a775083f19573a14e0861a96a8990866920b3dd4b1aa4d43552159a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          he.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\he.pak
          • Size 777KB
          • SHA256 4948fa44871e8ed5a0ed2d553f4dd698548b60618b55619239045181a8ec519e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\hi.pak
          • Size 1.3MB
          • SHA256 8ddded9b2dea1787367869152f2b27f93556ec515f7da6f361a73ac61fdcb73a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\hr.pak
          • Size 599KB
          • SHA256 9a7a1dea1bd0bf594acbc356ddac9fb64d993fa96f5d3cc1f38f9486abc888bd
          • MD5 SHA1 SHA512 SSDEEP TLSH

          hu.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\hu.pak
          • Size 645KB
          • SHA256 8e00a8562e32713abf7c99fb9543f65505f8f6d0509ad6b6b7607896f689e2e7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          id.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\id.pak
          • Size 532KB
          • SHA256 6d46b40dea9ba42a9ca6dda6e7ff81a3dbcd86b61fb2d7a5fe946d06bdce5d30
          • MD5 SHA1 SHA512 SSDEEP TLSH

          it.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\it.pak
          • Size 585KB
          • SHA256 e5fb1e10e15d55c42cdd937e133a9725739259157b1b3f134333cad7110e5978
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ja.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\ja.pak
          • Size 712KB
          • SHA256 91461c3b4a426688b16926d3279a44590cab75d65d797b6fd2567e0ec5cde60e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          kn.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\kn.pak
          • Size 1.4MB
          • SHA256 81a6a8d7f817bb6fbccfdf8d73f1229cd3bf74aeec0a64373a853e8bff744e8e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ko.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\ko.pak
          • Size 602KB
          • SHA256 67f8b13860dfc28eb3ee150750fab39c0b41e8638f06920f240f434ce08ec753
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lt.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\lt.pak
          • Size 650KB
          • SHA256 bae83903640041b5f949398d7af1975d67070467c4925950c7a838edd73ed956
          • MD5 SHA1 SHA512 SSDEEP TLSH

          lv.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\lv.pak
          • Size 648KB
          • SHA256 229b518ee95bc1960be7e72c8af33633fc8b9a32ee09900ae6d64b771c40d359
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ml.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\ml.pak
          • Size 1.5MB
          • SHA256 a973e6ce2c5cbba8f41e54d9aecef31bdabb070bf06e470afce1c4ed263be671
          • MD5 SHA1 SHA512 SSDEEP TLSH

          mr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\mr.pak
          • Size 1.2MB
          • SHA256 0eae188c9a81bd3257a21dc28448b5e9e5c3f4f4de4dc8e178e7f13cab06d6f7
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ms.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\ms.pak
          • Size 558KB
          • SHA256 185a275d0fb6263471ca1844c8df7fe91d2e98b209379b4a7ec18981ae642c53
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nb.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\nb.pak
          • Size 539KB
          • SHA256 bc11695694983516a9806eaef25e380a5d705c2c8e91324192a0983a50d1291e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\nl.pak
          • Size 560KB
          • SHA256 124b702f9f31eb34f307cae79074812873307f36c9a72f53696567a26ea13ba8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\pl.pak
          • Size 622KB
          • SHA256 55d1f22dcb6fdea4f641984a386b3497cf6d29fdb4c069d1e906efa4404d9550
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-BR.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\pt-BR.pak
          • Size 584KB
          • SHA256 8ab2fce26c0612520d152147637929c23a979ef059ef37757ac6988a9fdd26e1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          pt-PT.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\pt-PT.pak
          • Size 589KB
          • SHA256 56974d3f5c4c614fed58eae2b3889898a79b4cd6a13b3468c4f370e2c09470a9
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ro.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\ro.pak
          • Size 610KB
          • SHA256 309118023eacfe9aeb3405f2606a323982e75b1e33887e85be9235fc2ceeae5b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ru.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\ru.pak
          • Size 1006KB
          • SHA256 e042ce451d72fc1e2fa10a66fbc0490a4d9fdbc34caad64d06307d787ff5ced0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sk.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\sk.pak
          • Size 633KB
          • SHA256 aed563cc711b2b65d4734eb6c21aca2fe5fe4411b47681b31af8996245adadf0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sl.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\sl.pak
          • Size 606KB
          • SHA256 495125af6d3cdc85bb24ea4a211ea808208d19ce7af8dbea44e1e9317e91bd5a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\sr.pak
          • Size 935KB
          • SHA256 9d98eefbf8d84ad054f58a286b4891d51ae8da99f82047a09886e4b661db13d0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sv.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\sv.pak
          • Size 543KB
          • SHA256 e663b723c4dec60526182c70c943c9caa4976de09831ded69d59c9fe4114283e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sw.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\sw.pak
          • Size 574KB
          • SHA256 c83bb0238ca67b1137dd73e2ccdbfdbc3c2312d8c95aa2636940cc7dfac13cf0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ta.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\ta.pak
          • Size 1.5MB
          • SHA256 b76188eff81ffd0a0d9ea7e547eff7bc05069baecd650e1c1e11aa707b40e99c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          te.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\te.pak
          • Size 1.3MB
          • SHA256 471e766e6647e4315c45b15f702dfb2a8253ce91044e141034ce37ca9e0ede68
          • MD5 SHA1 SHA512 SSDEEP TLSH

          th.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\th.pak
          • Size 1.1MB
          • SHA256 010ec4d2cf97d45ed2a1934372fa389e49dc32567a97946162271af1c3a6e7e2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          tr.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\tr.pak
          • Size 584KB
          • SHA256 801df6a4a8d52b1ebb99da0ea788d933804643cca2bf8bbc46064eb6016e17b6
          • MD5 SHA1 SHA512 SSDEEP TLSH

          uk.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\uk.pak
          • Size 1009KB
          • SHA256 aa204656b9efbad5069943054f70fc0a6fc1e9f660b4bc59bcfa90cde3c3b0fe
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ur.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\ur.pak
          • Size 879KB
          • SHA256 b26fa64bc9d26991d7c2f1d20934e3dbd467d64096053887cde9ce99d7d0456c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vi.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\vi.pak
          • Size 693KB
          • SHA256 06b752bff885c13260adf91b51d56d3ef5048ea0058f69bb24a1db3b45bfa969
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-CN.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\zh-CN.pak
          • Size 498KB
          • SHA256 82717aa331b1ab869046cd691ddc9589882a34715a2522577313f0864acd083b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          zh-TW.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\locales\zh-TW.pak
          • Size 492KB
          • SHA256 61709875e1ede0ecc2582a282896ef6398b0c2f4fec07cfabc68c696ba6dd35a
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nfapi.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\nfapi.dll
          • Size 214KB
          • SHA256 a21b9a4d75f7473f35f60bd9bfd35ece99f0d9301e8003bfbe744977e8023b91
          • MD5 SHA1 SHA512 SSDEEP TLSH

          README

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\on_access\README
          • Size 526B
          • SHA256 006380095181e4291a88e1edd5c00258cdecd1c34e9d07a54ebca0a67b621578
          • MD5 SHA1 SHA512 TLSH

          avgio.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\on_access\win64\win7\avgio.dll
          • Size 188KB
          • SHA256 17a28a18e578d7e154cc93c29b344f70d9b63ecfc74a147229d0421db6d4b660
          • MD5 SHA1 SHA512 SSDEEP TLSH

          avgntflt.cat

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\on_access\win64\win7\avgntflt.cat
          • Size 9KB
          • SHA256 7f49d676b342ab08d809cac3326e8101c21fb9776d51853a9ce2fb5e8b92c245
          • MD5 SHA1 SHA512 SSDEEP TLSH

          avgntflt.inf

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\on_access\win64\win7\avgntflt.inf
          • Size 2KB
          • SHA256 2d220946e718fbd41e68d9324caf2458a95beb1446e8447edaa2b99c8eb265da
          • MD5 SHA1 SHA512 TLSH

          avgntflt.sys

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\on_access\win64\win7\avgntflt.sys
          • Size 216KB
          • SHA256 31a3f5c4b19040eb20bc15b4609068128fb6028e137e98f2b2c6c679d0311c4d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          avipbb.cat

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\on_access\win64\win7\avipbb.cat
          • Size 9KB
          • SHA256 3ad3712e2d8e420fa4ea033110e202da3b70288b4f42b4f676e12a0b72f4a632
          • MD5 SHA1 SHA512 SSDEEP TLSH

          avipbb.inf

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\on_access\win64\win7\avipbb.inf
          • Size 1KB
          • SHA256 4bdc3b2fb007febf3718c453e08c590d00378fea4e2628431f85ccbb1099605f
          • MD5 SHA1 SHA512 TLSH

          avipbb.sys

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\on_access\win64\win7\avipbb.sys
          • Size 172KB
          • SHA256 e442e66d3e24d54696c8687d1bd1a9ab41ed34b723d2b25af195589d11c4fcde
          • MD5 SHA1 SHA512 SSDEEP TLSH

          avkmgr.cat

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\on_access\win64\win7\avkmgr.cat
          • Size 7KB
          • SHA256 901c32f032fcb4782217c4d2f3f570e932107dda74a173f1f3d8cdb993bd1007
          • MD5 SHA1 SHA512 SSDEEP TLSH

          avkmgr.inf

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\on_access\win64\win7\avkmgr.inf
          • Size 1KB
          • SHA256 f79a54cfa9f0901ff965e577cea1139583d1c73de9568170f895ac2b46c9b305
          • MD5 SHA1 SHA512 TLSH

          avkmgr.sys

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\on_access\win64\win7\avkmgr.sys
          • Size 35KB
          • SHA256 f8d33bbf769786163105c0fa794970054bad34cc5985416af553df1d9a64039b
          • MD5 SHA1 SHA512 SSDEEP TLSH

          avgntflt.cat

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\on_access\win64\win8\avgntflt.cat
          • Size 9KB
          • SHA256 099e028f17154e5dafdf66a9963dbccb25442b0c570c29aeaae1e9d02539a8be
          • MD5 SHA1 SHA512 SSDEEP TLSH

          avgntflt.inf

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\on_access\win64\win8\avgntflt.inf
          • Size 2KB
          • SHA256 c17477ce4372a43268b01e398f438efa52729bb3718324be9ee1508849374f09
          • MD5 SHA1 SHA512 TLSH

          avgntflt.sys

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\on_access\win64\win8\avgntflt.sys
          • Size 204KB
          • SHA256 868ecdf543865035a3703e8837869441683b8ab396eaadf6aaa0e455e8393c5e
          • MD5 SHA1 SHA512 SSDEEP TLSH

          avipbb.cat

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\on_access\win64\win8\avipbb.cat
          • Size 9KB
          • SHA256 f456a7783dfe46bb46547464579498f7b4801258424b4caa264d8c6f57c1150f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          avipbb.sys

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\on_access\win64\win8\avipbb.sys
          • Size 194KB
          • SHA256 80d9d7444623175794a51b6710f99e911943bb58a7a9621bc53d0d4bde304daa
          • MD5 SHA1 SHA512 SSDEEP TLSH

          avkmgr.cat

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\on_access\win64\win8\avkmgr.cat
          • Size 9KB
          • SHA256 71e8546ba1c9716ffc8072f97feb945cc466d832ddbf53b090af179094d473bf
          • MD5 SHA1 SHA512 SSDEEP TLSH

          avkmgr.inf

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\on_access\win64\win8\avkmgr.inf
          • Size 1KB
          • SHA256 bf526004b80b6698f782082cd3da58abf4e52a5f390d2f8d0d131b80f19775d2
          • MD5 SHA1 SHA512 TLSH

          avkmgr.sys

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\on_access\win64\win8\avkmgr.sys
          • Size 45KB
          • SHA256 c754dd80f8f3e19144ffb01a17aace2176cb5a8dd404a38ce6ec4ed88b6af759
          • MD5 SHA1 SHA512 SSDEEP TLSH

          remediation.exe

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\remediation.exe
          • Size 4.5MB
          • SHA256 36b2516e194d33539f6d600d6c3db1a76cf8f9abd3e9d2db75f00610b4fcdb73
          • MD5 SHA1 SHA512 SSDEEP TLSH

          resources.pak

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\resources.pak
          • Size 5.7MB
          • SHA256 a22d25e6d4fcfd8e3f86f925beaf6fd2ab1e2b6c5f54cdfe8d2a7f5e56f335f0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          savapi.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\savapi.dll
          • Size 5.6MB
          • SHA256 4a39ddf931fb3a7bbb74e19cd6887cb537af6d998570e69b18fb2a945923d0b3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          snapshot_blob.bin

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\snapshot_blob.bin
          • Size 324KB
          • SHA256 69d9b2ecbc649fed6c41ca18e94f3a36b6770ff7038e9a0d07ae1ab824d9f7fb
          • MD5 SHA1 SHA512 SSDEEP TLSH

          sqlite.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\sqlite.dll
          • Size 1.1MB
          • SHA256 09bb7ba356f228ccb8fc76541815e7120d7698e1f59dbaf1366d12c92e0f3468
          • MD5 SHA1 SHA512 SSDEEP TLSH

          uninst.exe

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\uninst.exe
          • Size 565KB
          • SHA256 60cf598f9b41c4ae018386d8020755f51abd4f00c9c3e950be7cc53cf50dae59
          • MD5 SHA1 SHA512 SSDEEP TLSH

          v8_context_snapshot.bin

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\v8_context_snapshot.bin
          • Size 685KB
          • SHA256 462919f1b49c9e913042f9e9a738e9510884d5920a426a8a5f1b188e28c4da91
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vk_swiftshader.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\vk_swiftshader.dll
          • Size 5.3MB
          • SHA256 f856516e118707014bee030a64e119c8f0ac6eb55e9ec3e21cddff1e5fd6730d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          vk_swiftshader_icd.json

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\vk_swiftshader_icd.json
          • Size 106B
          • SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
          • MD5 SHA1 SHA512 TLSH

          vulkan-1.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\EEF2597C6D16\programfiles\vulkan-1.dll
          • Size 903KB
          • SHA256 5f83b9d849296f3d2f55825ee99fed32df42b65c52d524a99f438108285d93a0
          • MD5 SHA1 SHA512 SSDEEP TLSH

          FortectProtection64.7z

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\FortectProtection64.7z
          • Size 1.7MB
          • SHA256 a1a48f95f8d807976cb064d50b577f3690d112a2949fb1474c484117ba405cb1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          Banner.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\Banner.dll
          • Size 24KB
          • SHA256 6e09be529a79118083e62132e891b9b09abc2027dc90b2a14e6fd0d2271c7f9d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          Crypto.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\Crypto.dll
          • Size 24KB
          • SHA256 490ec3a42d0353a3dca7fdb3f4d2392487a1e7cb2dd30927710e31c7baa75cf8
          • MD5 SHA1 SHA512 SSDEEP TLSH

          EnVar.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\EnVar.dll
          • Size 30KB
          • SHA256 c8f7a62d677301e465b808fae51f4a78d11c4a1ac835daf778f3a3c9e65a6ed1
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ExecDos.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\ExecDos.dll
          • Size 27KB
          • SHA256 511b74f60f5da3ee22f869340f5f2250ab13e7a1f3322e98ad4aad888304c4f2
          • MD5 SHA1 SHA512 SSDEEP TLSH

          INetC.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\INetC.dll
          • Size 45KB
          • SHA256 1b5e463950832acb7f9c0706e844182e63496c09984db8d73bb9beb20fd37183
          • MD5 SHA1 SHA512 SSDEEP TLSH

          LogEx.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\LogEx.dll
          • Size 64KB
          • SHA256 91a421c5ef3f37bf82b351fff7881c6b4e02c216617dcb88e598e432810aea9c
          • MD5 SHA1 SHA512 SSDEEP TLSH

          ShellExecAsUser.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\ShellExecAsUser.dll
          • Size 63KB
          • SHA256 c9fa24f38a92a005ef34996ab6862c442226e62c66e346c5068ec208118cfd19
          • MD5 SHA1 SHA512 SSDEEP TLSH

          System.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\System.dll
          • Size 32KB
          • SHA256 afa34914c1fb8c094d21c62d8395f5d1ea2e2a1ca4ec91caf565d92ac61cb318
          • MD5 SHA1 SHA512 SSDEEP TLSH

          UserInfo.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\UserInfo.dll
          • Size 24KB
          • SHA256 211bc1bdf322751acd5cc2b2fcfe6fd3f88cecb662d687ce1655d8f02a4f14b4
          • MD5 SHA1 SHA512 SSDEEP TLSH

          fUtil.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\fUtil.dll
          • Size 243KB
          • SHA256 34208ce8735852fd589010c51f18be1814a1e48c59eda19475324eb68045ad2f
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nsDialogs.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\nsDialogs.dll
          • Size 30KB
          • SHA256 c8e3952e66bbe4947dee852592a40d362dc7e33eed5b9b85a761801ed5e51798
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nsJSON.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\nsJSON.dll
          • Size 44KB
          • SHA256 767d08af275a46029feda2db75055027cc692eebb69199afee15be1b519556f3
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nsProcess.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\nsProcess.dll
          • Size 26KB
          • SHA256 d805b5712b959b350d695dd520720284f20be7fb1aab7043ae8e85864b912a91
          • MD5 SHA1 SHA512 SSDEEP TLSH

          nsis7z.dll

          • Path C:\Users\Admin\AppData\Local\Temp\Fortect\plugins\nsis7z.dll
          • Size 479KB
          • SHA256 fd572b7d3a4be030f68a661461ce66831ef56237b5d0635010b4e29e4dfa328d
          • MD5 SHA1 SHA512 SSDEEP TLSH

          Network Persistent State

          • Path C:\Users\Admin\AppData\Roaming\Fortect\Network\Network Persistent State
          • Size 742B
          • SHA256 0da80071076dd9ee3c69651993c5dc136bcb16cbab7beeb83d66272cfa7c1760
          • MD5 SHA1 SHA512 TLSH

          Network Persistent State~RFe5acd34.TMP

          • Path C:\Users\Admin\AppData\Roaming\Fortect\Network\Network Persistent State~RFe5acd34.TMP
          • Size 59B
          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
          • MD5 SHA1 SHA512 TLSH

          default.exc

          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
          • Size 2B
          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
          • MD5 SHA1 SHA512

          cdrom.PNF

          • Path C:\Windows\System32\DriverStore\FileRepository\cdrom.inf_amd64_dc7b0d8271e8847c\cdrom.PNF
          • Size 11KB
          • SHA256 bfae2e4ce0b16a4c07ecfc10e5cd8959f1c3beb2ba6bf6f1f3a40295fd42d2bf
          • MD5 SHA1 SHA512 SSDEEP TLSH

          machine.PNF

          • Path C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_d807fc8146278f4c\machine.PNF
          • Size 151KB
          • SHA256 88d6496a0fecb50ea374ef88abbb981543aa2dca82a5e737028c187a2940ae51
          • MD5 SHA1 SHA512 SSDEEP TLSH