Overview

overview

8

Static

static

1

FortiClien...er.exe

windows7-x64

3

FortiClien...er.exe

windows10-2004-x64

8

Resubmissions

05-10-2024 06:05

241005-gtcm3szarm 8

05-10-2024 06:02

241005-grrzzstdjh 3

Analysis

  • max time kernel
    300s
  • max time network
    277s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-10-2024 06:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    FortiClientVPNOnlineInstaller.exe

  • Size

    2.7MB

  • MD5

    11bfc265fc53ac4756e4ef2759ca10eb

  • SHA1

    e3d2bf11618c39dfd036bb33ea96aa5f989fed25

  • SHA256

    2e520faa2b71ba56643153b77c2908c0d6da34a2f6f9abaa7cbadab9278dc99e

  • SHA512

    6b1e802f82002c5f8162a48440e09631da12fbfa283fc03bbf405938406955581764cda3ae57021d9e1b821a128b227e77b38dd6994a655f438ac5081f5ae689

  • SSDEEP

    49152:nZ2d2wu+8ewJobcRgEekPZ99ztx5IX0hL5m6bgy:nZ2dnu+AMW9x2O

Score
8/10
discoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Drops file in Drivers directory 10 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 64 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 54 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\FortiClientVPNOnlineInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\FortiClientVPNOnlineInstaller.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2508
    • C:\Users\Admin\AppData\Local\Temp\FortiClientVPN.exe
      C:\Users\Admin\AppData\Local\Temp\FortiClientVPN.exe
      2⤵
      • Enumerates connected drives
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3380
      • C:\Program Files\Common Files\Fortinet\FortiClient\VC_redist.x64.exe
        "C:\Program Files\Common Files\Fortinet\FortiClient\VC_redist.x64.exe" /install /quiet /norestart
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2700
        • C:\Windows\Temp\{465022D1-A9B1-4F13-86D1-F3C93A9CC557}\.cr\VC_redist.x64.exe
          "C:\Windows\Temp\{465022D1-A9B1-4F13-86D1-F3C93A9CC557}\.cr\VC_redist.x64.exe" -burn.clean.room="C:\Program Files\Common Files\Fortinet\FortiClient\VC_redist.x64.exe" -burn.filehandle.attached=536 -burn.filehandle.self=188 /install /quiet /norestart
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1180
          • C:\Windows\Temp\{9EC73601-D193-4EBF-A44D-E932F4AA55AD}\.be\VC_redist.x64.exe
            "C:\Windows\Temp\{9EC73601-D193-4EBF-A44D-E932F4AA55AD}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{E415E60F-309F-4616-9B1D-2E1548EB819B} {D7EDE633-1973-4195-AAF1-769187A4353F} 1180
            5⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3868
            • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
              "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={c649ede4-f16a-4486-a117-dcc2f2a35165} -burn.filehandle.self=988 -burn.embedded BurnPipe.{79DA5A9E-3E4B-4940-937B-DC3F6A58A0B9} {4D690BC8-2430-4149-9A86-4DC6EA98CA6D} 3868
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4404
              • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={c649ede4-f16a-4486-a117-dcc2f2a35165} -burn.filehandle.self=988 -burn.embedded BurnPipe.{79DA5A9E-3E4B-4940-937B-DC3F6A58A0B9} {4D690BC8-2430-4149-9A86-4DC6EA98CA6D} 3868
                7⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:992
                • C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
                  "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{97F810B9-7970-4015-9A34-4534E8A1709D} {01BDAC55-63C7-4AD9-BA45-73FC11D587D5} 992
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:4320
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Drops file in Drivers directory
    • Checks for any installed AV software in registry
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3468
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding E78E1383EFD186431C2B7F1C74426FB7 C
      2⤵
      • Loads dropped DLL
      PID:4916
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 665DF069438C38D1AD525CF37174E4B2
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:3564
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding E91435065266CCF2FEEDCE9E9C9B2661 E Global\MSI0000
      2⤵
      • Drops desktop.ini file(s)
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:2916
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
    1⤵
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Suspicious use of WriteProcessMemory
    PID:3224
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "1" "C:\Program Files\Common Files\Fortinet\FortiClient\7.4.0.1658\ftvnic\ft_vnic.inf" "9" "4877b642b" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files\Common Files\Fortinet\FortiClient\7.4.0.1658\ftvnic"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:3156
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "201" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3205552c47487a89:FTNT.ndi:2020.4.9.0:root\ftvnic_a," "41304937f" "0000000000000180"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      PID:832
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "1" "C:\Program Files\Common Files\Fortinet\FortiClient\7.4.0.1658\ftsvnic\ftsvnic.inf" "9" "40c6594a3" "0000000000000188" "WinSta0\Default" "0000000000000100" "208" "C:\Program Files\Common Files\Fortinet\FortiClient\7.4.0.1658\ftsvnic"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:3492
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "2" "211" "ROOT\NET\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:3205552cbf00c145:ftsvnic.ndi:17.47.11.597:root\ftsvnic," "4219b83e7" "0000000000000188"
      2⤵
      • Drops file in Drivers directory
      • Drops file in Windows directory
      PID:2312
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "4" "1" "C:\Program Files\Common Files\Fortinet\FortiClient\7.4.0.1658\FortiFilter\FortiFilter.inf" "9" "4a03a154b" "0000000000000188" "WinSta0\Default" "0000000000000180" "208" "C:\Program Files\Common Files\Fortinet\FortiClient\7.4.0.1658\FortiFilter"
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:4512
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    PID:972
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:3336
    • C:\Program Files\Fortinet\FortiClient\scheduler.exe
      "C:\Program Files\Fortinet\FortiClient\scheduler.exe"
      1⤵
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1588
      • C:\Program Files\Common Files\Fortinet\FortiClient\VC_redist.x86.exe
        "C:\Program Files\Common Files\Fortinet\FortiClient\VC_redist.x86.exe" /install /quiet /norestart
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4540
        • C:\Windows\Temp\{D8E77DB0-CA8D-4EC9-888B-3B78AE275037}\.cr\VC_redist.x86.exe
          "C:\Windows\Temp\{D8E77DB0-CA8D-4EC9-888B-3B78AE275037}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Program Files\Common Files\Fortinet\FortiClient\VC_redist.x86.exe" -burn.filehandle.attached=540 -burn.filehandle.self=548 /install /quiet /norestart
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:1796
          • C:\Windows\Temp\{7D1DE30C-F62D-4FFD-B49D-CE2CBDFFECFF}\.be\VC_redist.x86.exe
            "C:\Windows\Temp\{7D1DE30C-F62D-4FFD-B49D-CE2CBDFFECFF}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{BAAF3CC5-C544-44ED-A719-0E93787CE9BF} {FA22DD08-8E38-42E8-93F4-9708EC2970CE} 1796
            4⤵
            • Adds Run key to start application
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:3204
            • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
              "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={46c3b171-c15c-4137-8e1d-67eeb2985b44} -burn.filehandle.self=872 -burn.embedded BurnPipe.{97BA46D5-DC69-48CE-A602-76F0C90085F2} {B8296D34-7BCF-4760-9D09-29F65B7CFBF6} 3204
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1164
              • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.clean.room="C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 -uninstall -quiet -burn.related.upgrade -burn.ancestors={46c3b171-c15c-4137-8e1d-67eeb2985b44} -burn.filehandle.self=872 -burn.embedded BurnPipe.{97BA46D5-DC69-48CE-A602-76F0C90085F2} {B8296D34-7BCF-4760-9D09-29F65B7CFBF6} 3204
                6⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Modifies data under HKEY_USERS
                • Suspicious use of WriteProcessMemory
                PID:4580
                • C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
                  "C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{5E6C4897-4BAD-4F19-90FB-8153B768277C} {D8E0F719-1DA3-48D0-BFC8-D12713D017E1} 4580
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:2132
      • C:\Program Files\Fortinet\FortiClient\FortiScand.exe
        "C:\Program Files\Fortinet\FortiClient\FortiScand.exe" /regserver
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies registry class
        PID:3160
      • C:\Windows\System32\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\Fortinet\FortiClient\fccomintdll.dll"
        2⤵
        • Loads dropped DLL
        • Modifies registry class
        PID:2376
      • C:\Program Files\Fortinet\FortiClient\fccomint.exe
        "C:\Program Files\Fortinet\FortiClient\fccomint.exe" /regserver
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies registry class
        PID:2364
      • C:\Windows\System32\regsvr32.exe
        "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\Fortinet\FortiClient\FortiCliSh.Dll"
        2⤵
          PID:4700
        • C:\Program Files\Fortinet\FortiClient\FCDBLog.exe
          FCDBLog.exe -s FC_{73EFB30F-1CAD-4a7a-AE2E-150282B6CE25}_000011
          2⤵
          • Drops file in Drivers directory
          • Drops file in Windows directory
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          PID:2340
        • C:\Program Files\Fortinet\FortiClient\FortiTray.exe
          -s FC_{73EFB30F-1CAD-4a7a-AE2E-150282B6CE25}_000008
          2⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:2708
          • C:\Program Files\Fortinet\FortiClient\FortiClient.exe
            "C:\Program Files\Fortinet\FortiClient\FortiClient.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            PID:2700
            • C:\Program Files\Fortinet\FortiClient\FortiClient.exe
              "C:\Program Files\Fortinet\FortiClient\FortiClient.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\FortiClient /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\FortiClient\logs\trace --annotation=_productName=FortiClient --annotation=_version=7.0.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=24.8.3 --initial-client-data=0x574,0x57c,0x580,0x578,0x584,0x7ff68d44dcb0,0x7ff68d44dcc0,0x7ff68d44dcd0
              4⤵
              • Executes dropped EXE
              PID:1832
            • C:\Program Files\Fortinet\FortiClient\FortiClient.exe
              "C:\Program Files\Fortinet\FortiClient\FortiClient.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\FortiClient" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 --field-trial-handle=1980,i,15813759548233160514,8913559000283413265,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
              4⤵
              • Executes dropped EXE
              PID:3188
            • C:\Program Files\Fortinet\FortiClient\FortiElevate.exe
              ./FortiElevate.exe
              4⤵
              • Executes dropped EXE
              PID:1924
            • C:\Program Files\Fortinet\FortiClient\FortiClient.exe
              "C:\Program Files\Fortinet\FortiClient\FortiClient.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\FortiClient" --mojo-platform-channel-handle=2164 --field-trial-handle=1980,i,15813759548233160514,8913559000283413265,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
              4⤵
              • Executes dropped EXE
              PID:4064
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /d /s /c "uname -v"
              4⤵
                PID:3900
              • C:\Program Files\Fortinet\FortiClient\FortiClient.exe
                "C:\Program Files\Fortinet\FortiClient\FortiClient.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\FortiClient" --app-user-model-id=FortiClient --app-path="C:\Program Files\Fortinet\FortiClient\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2976 --field-trial-handle=1980,i,15813759548233160514,8913559000283413265,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
                4⤵
                • Checks computer location settings
                • Executes dropped EXE
                PID:5216
              • C:\Program Files\Fortinet\FortiClient\FortiElevate.exe
                ./FortiElevate.exe -noschedulercheck
                4⤵
                • Checks computer location settings
                • Executes dropped EXE
                PID:4012
                • C:\Program Files\Fortinet\FortiClient\FortiClientSecurity.exe
                  "C:\Program Files\Fortinet\FortiClient\FortiClientSecurity.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5912
          • C:\Program Files\Fortinet\FortiClient\FortiSSLVPNdaemon.exe
            FortiSSLVPNdaemon.exe -s FC_{73EFB30F-1CAD-4a7a-AE2E-150282B6CE25}_000019
            2⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            PID:532
            • C:\Windows\System32\net.exe
              "C:\Windows\System32\net.exe" start dnscache
              3⤵
                PID:180
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 start dnscache
                  4⤵
                    PID:1796
              • C:\Program Files\Fortinet\FortiClient\FortiSettings.exe
                FortiSettings.exe -s FC_{73EFB30F-1CAD-4a7a-AE2E-150282B6CE25}_000024
                2⤵
                • Executes dropped EXE
                PID:4600
              • C:\Program Files\Fortinet\FortiClient\FortiVPN.exe
                FortiVPN.exe -s FC_{73EFB30F-1CAD-4a7a-AE2E-150282B6CE25}_000031
                2⤵
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                PID:1628
              • C:\Program Files\Fortinet\FortiClient\update_task.exe
                update_task.exe -s FC_{73EFB30F-1CAD-4a7a-AE2E-150282B6CE25}_001000
                2⤵
                • Checks computer location settings
                • Drops file in Program Files directory
                • Executes dropped EXE
                PID:4396

            Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            1
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Event Triggered Execution

            1
            T1546

            Component Object Model Hijacking

            1
            T1546.015

            Defense Evasion

            Modify Registry

            2
            T1112

            Subvert Trust Controls

            1
            T1553

            Install Root Certificate

            1
            T1553.004

            Credential Access

            Discovery

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            4
            T1012

            Software Discovery

            1
            T1518

            Security Software Discovery

            1
            T1518.001

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            Lateral Movement

            Collection

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Config.Msi\e59b3fc.rbs
              Filesize

              19KB

              MD5

              9b533c5474ddeb7a8dc5f899f7d4cb0c

              SHA1

              86ccc01c0248b5663c8fecce725462edd4896d5a

              SHA256

              b9e8ccebdbb8add19685298864e45be65f42cd56ed7c348f94095cde7584472e

              SHA512

              e0c1039a43b973e8b9e25c6bc99d21614a4c734f81e32740778c68f12347277186612ddb4078dc60ac7e2bb7b34e0652bf818fb40dcd86194f42543f2b238f94

              Download Submit

            • C:\Config.Msi\e59b408.rbs
              Filesize

              19KB

              MD5

              c365142a713ad5feae980b82e9bb2757

              SHA1

              28e6f349665f89aa11aecd94b7bca2104524452b

              SHA256

              c8289a0a63e28109306eb00b5a36fab28c4c3a153d9c64729257b9617bf14274

              SHA512

              02cce850bee25d9bbc2b73503832e9be2b8ab1e16c47bddcba2882b8a0f99b88f7adbda18124209487c049698ea825f08f8d056c12b14f9c569508249bed7554

              Download Submit

            • C:\Config.Msi\e59b40f.rbs
              Filesize

              21KB

              MD5

              3dc5fc8115a9c7b9dba087f450e66444

              SHA1

              b35fe96375807b32492596ac87465b6052d9044e

              SHA256

              bd5c958e98cbd5e164c69d6865a8394471f3df69a1a8806b6c1231a6c7d0ade1

              SHA512

              15334e3d7d8ef88ac88e368100053685f587373e714cf254ef4b93fc12c7d2f835f654a63bfd0784c387552ceec458f8c08b2d144ac6615dde494468f43821cd

              Download Submit

            • C:\Config.Msi\e59b41e.rbs
              Filesize

              21KB

              MD5

              a722101fe5a739c7d80e705229975111

              SHA1

              7cd38547cd99fa20f59936b19cb21eea505a3d8d

              SHA256

              ce81aa77ef2d2e67fea4401ed784fdf3bc08c8185ac37f5562b558ccdaf7d938

              SHA512

              92fc40740930cb5fd54a64e632e6d21e9dbafdebd6bfa8977f19afdaa6a371d45c4286913760dc46a2f83b53b34a799c5099cc6990126e7bf5d233cac3cf24ea

              Download Submit

            • C:\Config.Msi\e59b425.rbs
              Filesize

              16KB

              MD5

              c75802e0637af0e8e91b453f1aaec117

              SHA1

              6af728dde7d16451949f9fbb59e4fed33542511a

              SHA256

              0f72a852d847f5c45a9c3b026a6c1deb18c2247e8dcbb11f8c7379e8f4f1549f

              SHA512

              b1bf1aba762560cad772499e38dabcda37f05182ff9a866fe1c2e367d190df20b88738e6b336fcc0dfb868e8507e2b0e1f99c2208809c3ab69d940da289adc0f

              Download Submit

            • C:\Config.Msi\e59b42a.rbs
              Filesize

              18KB

              MD5

              d9b8db2cc6a94be7018b7ca41b151372

              SHA1

              ff7565a2ad0b1c025b38a378cac5055e49afe4aa

              SHA256

              a1efa6b5ba0be9e5e6823558d2007a254402eeed7fb2d65638e71a6e65490db0

              SHA512

              43766f538b809d7ef0660b6c887181e058f236de4f465eaebdce337d1ce8e41ab10d87b015b195b292df19f534926635c76d4a00a17795032bb7fdfc4e4c2d38

              Download Submit

            • C:\Config.Msi\e59b437.rbs
              Filesize

              20KB

              MD5

              4a77ab427b478e9424223d5bd9c8335d

              SHA1

              0a375ea1b1f4c40d0fb25580207c66bc7b2c29ce

              SHA256

              0cd9a90956022963f8043fe6d7fb7f1a36c3fce474e3d39efd68a031fc6b16bf

              SHA512

              4f235bd711fe2cba3a2c498d6100dc529a9358fb982095822194232841cd24cf9d9ed1a40166479fdff1eaf7e3a84c04a7d503f71209161757fc5d7bf131e923

              Download Submit

            • C:\Config.Msi\e59b446.rbs
              Filesize

              19KB

              MD5

              9597a2be64e8ecf1f4f79fc19ce38a8a

              SHA1

              d786816ea5588333b7694c164d574738f028d4a4

              SHA256

              ff7fb2ef61d95ecc549e38cd95bafa019fdf12ef9c9183d0a35e0c603b6391cc

              SHA512

              83e49d1e6ee05de763812111e6d4a81907d393dd057ea8e8e29d9b3f6baaefa948a7a3fa7aa97246edca7b01c889b277d3ececc214008a6e7b89e9516eca10d3

              Download Submit

            • C:\Program Files\Fortinet\FortiClient\SoftwareInventory\2686110105.ico
              Filesize

              477B

              MD5

              a4418707a502e64b10089c9ff4462dd6

              SHA1

              eeab6a947b854c5cf309d2ffc866c54a3dd133ef

              SHA256

              3914354dc54e28a203de2fe4cc2303bbbc9dd527e5a44f08f87e6d00870c35e6

              SHA512

              3871cba1d6fcfa5878da51f4f9073d535a2ac703b3a9b530192b6dbcf270c7220f27fbcbb5a5f8e47e20a09dcc3c674f4a5b05e5f87f0fb8514e395d89511477

              Download Submit

            • C:\Program Files\Fortinet\FortiClient\SoftwareInventory\35416844.ico
              Filesize

              426B

              MD5

              5e369b22824c11de956ba55dbbf33906

              SHA1

              62fc5d2cfe520b4bc6ab543a9256d7a88d3b8d5d

              SHA256

              da8591012e64d70d2320065d39b921ceab3a74002f276f5b7052478518c4f331

              SHA512

              266edb9719e7ae85fc7f12956963d97efe8aab3f7fc0d74508af6f26d9c9d438d4c6016721ed2af52f5ac50bbd6cfeb56f1284c2347c61218bf566b3c6aefccf

              Download Submit

            • C:\Program Files\Fortinet\FortiClient\SoftwareInventory\381081779.ico.tmp
              Filesize

              33KB

              MD5

              ec84160b6ec27f7be5ee505ac447cc40

              SHA1

              65abccf5ec556ae7132c03c15fe46f4d8b834e53

              SHA256

              af96c25d75b453e7f959bd7b20be34c831fe1ca774e9ac5f42115f81b9e39a1c

              SHA512

              0a74468faa6ae4e3890743bf9891da594253349e58d9ee5bc574b5ec4e93f68ebb57b1eec42f1f287ce8186dac2f70abf7f0a220c97ee54dd6c8ef33e13d4635

              Download Submit

            • C:\Program Files\Fortinet\FortiClient\SoftwareInventory\381081779.png
              Filesize

              4KB

              MD5

              5ae43b2858d24a9e65ae5be09fae0643

              SHA1

              30b488e1a3b31df76bf487dab345b2d074bbebe9

              SHA256

              802ee584bff90186ac23e3f05f48f43afb6ef4bbbf1269c233e2a273c6707202

              SHA512

              21629c79620a0a7a6d57562ab991350633f26a3fa6c57dc3df832c9f530bee2572e41f86569a5ff22fc62ec12edf133edaf9244f0028f5f145369c735cb0513c

              Download Submit

            • C:\Program Files\Fortinet\FortiClient\obj_1_a04904
              Filesize

              130B

              MD5

              bb77b5c08b22b11af237c40e715f7c65

              SHA1

              6bd540d37fff299355e9100db93d807b9875d141

              SHA256

              c73564918e7cfc500400cbaff10f66a2cbe40ee4e28626163836b56941ee5630

              SHA512

              b98063d71d0298afd657ae6346d93e8a349c8b6a11b85335fb1de59f98cee009369a39ce5b6c156a4a3e9846954d63880e586cd4b4ae032d11629bf2777f4f61

              Download Submit

            • C:\Program Files\Fortinet\FortiClient\obj_1_a04904__unpacked
              Filesize

              2B

              MD5

              81051bcc2cf1bedf378224b0a93e2877

              SHA1

              ba8ab5a0280b953aa97435ff8946cbcbb2755a27

              SHA256

              7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

              SHA512

              1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d

              Download Submit

            • C:\Program Files\Fortinet\FortiClient\obj_2_a04904
              Filesize

              118KB

              MD5

              fca794a7ed181cd46659c1f12c02498d

              SHA1

              dc027a8c6cdde0e26dc315a8b549b5ea795b2629

              SHA256

              1c40321dd52c83fcd82477355cf9e6595577f3cf1c58f87b5b7cd2e995248db6

              SHA512

              8f0b347eed74d47c74488a551a390f130146d1ef7da2eb11884aea22f4fd2b88a575e2c15c3895a4ba81a7110401e17d7e7832c61b2ae82b1c69de9c65405c1f

              Download Submit

            • C:\Program Files\Fortinet\FortiClient\obj_2_a04904__unpacked
              Filesize

              1.1MB

              MD5

              08418efda7ad36c9ae74b5bcd4975228

              SHA1

              5975c17ee230b53bf5bdedd88cad86ffcd83c853

              SHA256

              d785264ff52713c442a55d674271155a550488473b390964432ff951e5aedf0a

              SHA512

              4fba86ea504a353d9e860a7a0857a672334c00a33575a9259dcfa2b14cd9f6fcc1d52bca3be440fe51e316e70accd99d54cc7e0dd964cc0e4e4ab90eea69e3c2

              Download Submit

            • C:\Program Files\Fortinet\FortiClient\vir_sig\isdb_app.txt.downloaded
              Filesize

              321KB

              MD5

              4c53eab088e0b848413cd95d7d763428

              SHA1

              02988b22acf93da59189d72d2f0b68783dc10dac

              SHA256

              816fbc676cbb9aebbc5ed239a984f71d16992c0ffd8241d8458dbdafcfde6b9a

              SHA512

              b3c1a8684853a2567161740e7cc44b91b6a9418859b83c91f0d32541421bb359b027173fb37a7857e0023b9e38dfea8c898f516676fb286bd1a72a8bf1df1afa

              Download Submit

            • C:\Program Files\Fortinet\FortiClient\vir_sig\isdb_map.dat.downloaded
              Filesize

              34.1MB

              MD5

              6842885da594b18d1fa91c6d3bab96ee

              SHA1

              4b6e654bd0d23a13634b6876d59f7d0dd87a64f5

              SHA256

              b3d249c441a90d62e86de8aae42a8ccb9481fc2620b4ed6d59b2aa367bda7264

              SHA512

              07190161962e921891fb5a708cd34cdb14be445cdd1e5b29c4a3fb1e55a76f773c78e1748e080e8c781363cf68da8fccef5bce44122bccbe841c7f1da3f261a1

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              Filesize

              471B

              MD5

              6639c2b5dd1db67f38a72a3ed252367b

              SHA1

              48d281476b5c4978c5c8e45dde040a3216f64a4b

              SHA256

              6674e8753069b055180d7cd2b3cc97e39b8882facddf72e1e62ec905a68cc90f

              SHA512

              10eef0de30fe9c174b2e18c7b84806e02e890604d4cb678e8ff45c4ce5b8401a45713e6b7cf66fbeffc2119bb10af6b7d92cd947ca46a6e8b616e552ac990abf

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_052D619A1738623B01B6A412349193C8
              Filesize

              727B

              MD5

              d54b761262e51a32ccc1c50c629af7f8

              SHA1

              414c5d40ad4e63354500fcf82a2caf836cec879b

              SHA256

              93c04bd99630a550f11ae52de0a2092210996fcbf5d4046bfce89917fc50cf5c

              SHA512

              f03c9b46ac94a9d9de9fed2ea28c839db0b5338bd73991a9d36e0b894b4398820589287f2e27249a9563e4a5ec6da8881e1924c8a7af758c12c4ebae12a4fede

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1
              Filesize

              1KB

              MD5

              d91299e84355cd8d5a86795a0118b6e9

              SHA1

              7b0f360b775f76c94a12ca48445aa2d2a875701c

              SHA256

              46011ede1c147eb2bc731a539b7c047b7ee93e48b9d3c3ba710ce132bbdfac6b

              SHA512

              6d11d03f2df2d931fac9f47ceda70d81d51a9116c1ef362d67b7874f91bf20915006f7af8ecebaea59d2dc144536b25ea091cc33c04c9a3808eefdc69c90e816

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              Filesize

              727B

              MD5

              cc79c4bec28755dd925ffe87be23f5d5

              SHA1

              a66f705d54fad27c2e4631be3423d1a7ba4f658f

              SHA256

              0ca63209f3a6717f5a88796981244b6490fa948ba4c7c965cad31e34c5d61fd1

              SHA512

              e7bffecedb1e12799390d6624e74694fdf26218ccca4cea850009907bdf755f422e8fd02702a9eef6402b793d8f2447e1f44720d3babd400233c37ef66fcd3b1

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
              Filesize

              400B

              MD5

              93fd28489e568ef892128974347d7381

              SHA1

              858c71902baf74d65842de58eac8cdf2068a2f02

              SHA256

              2596f343c090db2b6bd2aea93a89803af74ddf7b3db87ef1fa077e90fc16b1f7

              SHA512

              8d8dd46cc59b038c71112fb262eb5913774418634b2a5408ab63a06802d06e49872cd25c86cb7261083c5859b9c4b659ae7d177f05b36f92749e5dbf42e36ec2

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_052D619A1738623B01B6A412349193C8
              Filesize

              412B

              MD5

              cceeb94bf748ee37903443106775316d

              SHA1

              aa2071f23e5377fb15cd55eb1c330d07b0e61c3d

              SHA256

              d15a64de115ebfe0b01e94121ebd7a2216212c5330dc9c1dc7e210ca70f10ad9

              SHA512

              70861c0bedd7213461531f372a5bba7220987d3250c480bc6f24aa4f6fcf329446b3a4cbd4ed5ac77f1d9ec777eac19be1a6267cb492884e8b436076bd17d49b

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1
              Filesize

              308B

              MD5

              e8b470605c98cff4aae0a36369e8d2b9

              SHA1

              07ddc0143d64c216b472e61fb7082e667c6d6f67

              SHA256

              7a39a2399981d0191f0b63990e533dcf390814b1ceb577d212592aa957ff5c05

              SHA512

              ed9c2e7e46cb2cb279412dd9b28ae4e5e7e458f33972edf59c4434632a0de2ff0adc7a2424fde9d8bbee29780260fc118b2ab26a37912cbe620bc9ed2636e205

              Download Submit

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
              Filesize

              412B

              MD5

              28263b35744b90627fa3a83feab25c13

              SHA1

              62fc89f4a7742b35955fbd02497dba75044dc35b

              SHA256

              5cb77aef2ac82a52d2e523fe6d52b1fdec65886e65576a462d37464ff1e93a40

              SHA512

              d64d6ec62ca98522b900610bf09aea657b0ece4580b20261738bd950d6651052f7488e67522b4fe0a563f711e944d289520561f514bdff3f0011535aa8e5abc0

              Download Submit

            • C:\Users\Admin\AppData\Local\FortiClient\41a72854-d01d-47e5-be10-c51f124befbc.tmp
              Filesize

              161B

              MD5

              d5692ef7fee7c1f543c8a3020591c9ba

              SHA1

              78559605b5eab69927324412265b502626f31968

              SHA256

              9c1aa003ca789f6932a1a4efd6608efcd4dc29d0de97fb5e5ab9b7aa17496265

              SHA512

              4c7a197492dd9d771147797bfdabc33bae84695bf8f0b11ff0cabbd215d299b423370a18245787cf92f2865b0da80bc206541408dddf7199091fdc43585211c8

              Download Submit

            • C:\Users\Admin\AppData\Local\FortiClient\Network\Network Persistent State
              Filesize

              300B

              MD5

              f54c180f622cb97b661237b8bdfd8f04

              SHA1

              49b49eb96b2dffa9feca86583eda91844a717ed2

              SHA256

              142e50bbb254bf3dbe82d1e9f3fc3995298dae8d2265428d6733c5ed775d0a76

              SHA512

              646f576f2554d8cc14058208862e1dfd95de92689fafbd6cac6cee6d8b5dabb527935d0c2c0c4a2e43e48a8245812c676fc4850316bdd26785a4207ad1e19076

              Download Submit

            • C:\Users\Admin\AppData\Local\FortiClient\Network\Network Persistent State~RFe5bfd96.TMP
              Filesize

              59B

              MD5

              2800881c775077e1c4b6e06bf4676de4

              SHA1

              2873631068c8b3b9495638c865915be822442c8b

              SHA256

              226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

              SHA512

              e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

              Download Submit

            • C:\Users\Admin\AppData\Local\FortiClient\Preferences~RFe5bb737.TMP
              Filesize

              86B

              MD5

              d11dedf80b85d8d9be3fec6bb292f64b

              SHA1

              aab8783454819cd66ddf7871e887abdba138aef3

              SHA256

              8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67

              SHA512

              6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0

              Download Submit

            • C:\Users\Admin\AppData\Local\FortiClient\logs\trace\certificates.txt
              Filesize

              931B

              MD5

              e4722c39e345ded88c703067e948c880

              SHA1

              de9739ed9f686e91063e94e21ad0536529e9d45a

              SHA256

              adc9d294c390cce700750eaab7c838378ddeebd78169252095a383d03d238201

              SHA512

              3137ab90642a2699fd41e2d0eefcd3868b85d853487ebf8c4285fa8360a17685144338997d93486b9fde8ee7d8eebcb3fe54c686b119ba8a550f7cfb3871747d

              Download Submit

            • C:\Users\Admin\AppData\Local\FortiClient\logs\trace\certificates.txt
              Filesize

              1KB

              MD5

              8aadb0e3b10757ccc11743082419b2db

              SHA1

              59633f1a7db3c86f4bd489c6debb7b9f79e47b02

              SHA256

              f2fb8d51da6f68a255db374bbd6c81cafa6697ac5afec05f1c358626383d8860

              SHA512

              94f025ff830dbaa45ec0fec706f4f59b415b96866717207b095dc17cd4eec712bb2b5d270424314b3356f1b6f0982ca026c86c78621f24c1c4894a6b79e3a32f

              Download Submit

            • C:\Users\Admin\AppData\Local\FortiClient\logs\trace\certificates.txt
              Filesize

              1KB

              MD5

              c8524c2afcceabcce5d8a3110f39d4ef

              SHA1

              0f196a3063077bf3f7330d6c0a1621d276649d17

              SHA256

              ff3cdc27c4423baf0e02ae247f7e2c9ec74e60cbb76dc7c3258ba33cf856cf02

              SHA512

              2a216f2a6fa25b53694dbb0c6585008e85cd3e4bb130607ebc74c5f2a4ec295852be64380a9d7656e4785367c7fda0f961f8119cbc301bd92bd86e6095d1c144

              Download Submit

            • C:\Users\Admin\AppData\Local\FortiClient\logs\trace\certificates.txt
              Filesize

              1KB

              MD5

              391295189c665a8b55a65e16d3068f91

              SHA1

              cfd26133d65700845a407ac676a842c4e06dee83

              SHA256

              0ede44f84c973b14d669e239ffc1c46db6640ce0680ae0f6d07f54bca6b42699

              SHA512

              2c096b49426dd567fa3a1b2ac02e79e0dd3d6871c9847bcd483ab6a176de1217f2f1bc5d41f5ec7b4cbcb56a5960a5e09d3bd7024f471a9825ea4838bc0299dd

              Download Submit

            • C:\Users\Admin\AppData\Local\FortiClient\logs\trace\certificates.txt
              Filesize

              1KB

              MD5

              00031fc68ac8325fe8ad90e43f84dc5d

              SHA1

              5aeae92d7c60ff7e68459b4d4e268a5b6e9cac8e

              SHA256

              27999d78c53c7f77a00eebdef48671a7b324a2d57408bc360c59218fdd5cfb97

              SHA512

              f3f9fc27b476cea2ca93f590773d3f208bf22cd38a77057a4e871d8e340e62c9930c34019acb9e858f13afed6260ef6f6387c0192b38454ec3e748a581abe923

              Download Submit

            • C:\Users\Admin\AppData\Local\FortiClient\logs\trace\certificates.txt
              Filesize

              2KB

              MD5

              dcb4999673e37f0b300571182855ada4

              SHA1

              30319d24f1da43a284ae462547a5ec101dc18a91

              SHA256

              84d167112229b1db812593f76bf5197245ec3d37cb2e6cde2833d28848da002d

              SHA512

              bb0148990f7b05c388f41f7de3b84f2dbcbad497e32e8d6d81922134e4f217b574cc83a8cd7a7507034c73ef44656163af366f11795ecea0c8701dd8e3c681a1

              Download Submit

            • C:\Users\Admin\AppData\Local\FortiClient\logs\trace\certificates.txt
              Filesize

              2KB

              MD5

              3c5aa38d1ec2907a44575c70481557a3

              SHA1

              63694976b688c2499875a955e6f0a53608a455f3

              SHA256

              b2fc2d641900d4425b72a5205692d3b85f52f9437c214da3f117119c89f8f202

              SHA512

              5237b74c7c39377ee6ae8c9b66d2b5af25c74a001131d7f2951f95a27c88a2891834b052b82972ab010917c5a035ae778f412e16de284347f16b262850dc7ee4

              Download Submit

            • C:\Users\Admin\AppData\Local\FortiClient\logs\trace\certificates.txt
              Filesize

              2KB

              MD5

              758a2faf4c57e1ef9d99ef5528563daa

              SHA1

              e0b09a511243931d7bfbd78874faaa20d6551071

              SHA256

              8b5285f79e9fde7be2360076312584ebfc83828005ac0b072f6d6b4a50d5e89a

              SHA512

              0540bd9cbb92220e5e582398487076c5ac079c544758fcd25b3800c9761bca477228fe5adb3f1bbe992a08baa624c41c071229972c07b6e75d043d11f2d22aee

              Download Submit

            • C:\Users\Admin\AppData\Local\FortiClient\logs\trace\certificates.txt
              Filesize

              2KB

              MD5

              e94cd2f3ff87a03681b80d5706ed4c4d

              SHA1

              f62ce8f9775e156045500952478cf043f7e53300

              SHA256

              c007f0e14fdfd48cfd7f50207d545b73386e9359efc488a9a7f8bd32034c3ee8

              SHA512

              a08bc18ce3ca0e87235eb513a76cd9dddaf759f52c820b0e2b4ff8c2e4fa2bc36a202388e4c187d37da64f237829fb16dc8be6c9c4fc3bc7121c14f344c8266e

              Download Submit

            • C:\Users\Admin\AppData\Local\FortiClient\logs\trace\certificates.txt
              Filesize

              2KB

              MD5

              aabcd6953eca92a4c2016bcedc2e8377

              SHA1

              7b3174b16f524fd958ca7aed84c5c1e09b6861bb

              SHA256

              e2776a91595f8ccd2898f8a5a28fbb08f7d8c3f30d4e8a7c483830ca883bebe6

              SHA512

              b5ae5c11ed162fbed9e82f69285ea8628b7c1a02bee018edb6d5babb0c9ed0b37c4cc06ff8a790f2ebf8ae0f59a0434872e6b6b3ec725aac7c97daff0d3f692f

              Download Submit

            • C:\Users\Admin\AppData\Local\FortiClient\logs\trace\certificates.txt
              Filesize

              3KB

              MD5

              88c5196d72e905b3adc0802c778ae882

              SHA1

              91ba7aab028ede3e460e6977b647470a68839a8f

              SHA256

              725585d559302ab5659c5d32a623efbb00ede9062eb0897f922523bb5f7070e4

              SHA512

              390bd8372c5eeef8ec658c2750c34c1b179c32e9ce79a409013e34cc5d9c8bb26aeef6bd90af9e775d7e31ccd7c20d1f19a7528ce2c5025200cb08164cac7838

              Download Submit

            • C:\Users\Admin\AppData\Local\FortiClient\logs\trace\certificates.txt
              Filesize

              3KB

              MD5

              7273ab477030e706564f836f66f38ebe

              SHA1

              a222ade18e9080e9eba5bba0250d90a0b78b98f0

              SHA256

              63ad61a6ff777362440f41890c8ddd7096ec2b423ba2e78610a5ed327e35ad7e

              SHA512

              e62b21396d25b66ba7fa9ff1412364e318ac518af0666d1fc5dc7fef34fab6ea2cee2ba20979339139da7bd528a4afc0a54c8659759abe6d0b6fa795259ef74f

              Download Submit

            • C:\Users\Admin\AppData\Local\FortiClient\logs\trace\certificates.txt
              Filesize

              3KB

              MD5

              d89180e362ce3992af61dd165cf002e6

              SHA1

              5dcc5c30de662a5af384ce0633678870896b125b

              SHA256

              a5b9dc41c9aac92783cec29d45a2e4c389a1804a0fdd534b07b195900bf27cf3

              SHA512

              eeaec139fe96dd36132f8ee51422e73c505055ba181f6167bd4da2480918851395fdd76ddac6eba5f4ab9ce898373700aac4e2cf0229a85bff2965549bd23ead

              Download Submit

            • C:\Users\Admin\AppData\Local\FortiClient\logs\trace\certificates.txt
              Filesize

              4KB

              MD5

              76dd1974dda31c2b4456be98f457b05d

              SHA1

              4a1ad8cb46be227e9a988168e0d9a6ceda895dbd

              SHA256

              60799ae06d370c688db7d2acb06fe928c33934f2eff87f60ec665f7c9dc38a9f

              SHA512

              5e581722f7d14e0a2272cbeb87f40a8bec25b489276d1227f8b52d0c95dc55b71f3ce79074f7d7288467521020f14d86ae28643858449bfa65ad7e6e1a09958a

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\FortiClient00000.log
              Filesize

              99KB

              MD5

              a419e4b73e2a2b332bfd785450f73beb

              SHA1

              81fcab42c0c9435c65dffb3c22745962e945f3d6

              SHA256

              879cb95cd4228f0f8c4e0db169cd8310c3fd269b0785e97d679c5c9070d4109f

              SHA512

              fa873d8aaf21453dc7f0e1b7e371bc90e4d96a4a7541822cb9a2337a1b4bef8d30242f781634e0fa4d08e15fa2d96aab636df31c6c6b2caa55c2ec6a3b3dc132

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\FortiClient00000.log
              Filesize

              858B

              MD5

              5c71123f8298af18c9ba7402144250cb

              SHA1

              f411f30349eb78d2e574e10e52d12b1ca3a104f1

              SHA256

              445a680d42ce62c083bddfcfd06ce478e5330a76db115bd2ac8ad5824fef6dfc

              SHA512

              8275cdea281ba6711a114232913dfe23c8c0646a785a0039e6daa57c60514e31b0de67b8b09924611ae8a86586ea11f9b6f36a63bb326c65790ff5b48e118c98

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\FortiClient00000.log
              Filesize

              1KB

              MD5

              f20f0d5e4835a9f7ae3c3d333475e00c

              SHA1

              22f13fd36829ab39e97aba27520e9c0df050d87b

              SHA256

              e3efc64a02281421573f4b0747018bd3f749ee30c684d98332e905fb3c6d84f2

              SHA512

              d8148a6ed6443b6a7df150db5ca371816c2cf940a140bcfd4ea218a3a83a84a679baefa8035e83f63c8e6cb3e1628a644ea641e80d8fe8cdbd76a15252b0a481

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\FortiClient00000.log
              Filesize

              4KB

              MD5

              93266ab1c134245b8c5e4902ebfccbd8

              SHA1

              46d664724bf5ec73245425abdd599f6c65e5e10b

              SHA256

              83eba83a09641033927edecbe5acd41e9ee608718c9c6a3bf64f78ba5a097a1a

              SHA512

              da32c0d6549f50964b1dadfd8e5eea48b2810fb3ca542eefeb1508f51cea53f6a8a1d8e886efa85a0323c560ae5b0d33054d07d653f077804cd8c3889068e7ed

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\MSI99C5.tmp
              Filesize

              7.7MB

              MD5

              32efbffda3376ee49d78baff6bce3cc5

              SHA1

              fb1195e34a9034309d8bf4608b65e205cac0b930

              SHA256

              f64e2cad4cdcc53694ca3dbd78b941039064d31ea5892d4ded3a533f0fed627a

              SHA512

              af22120bb60d0e2394c83059b5d2e68afb40c0fd02e613515257bc80dd3cf55c6792df5325cb87ad2046724b24303e6c9e1a3c9eb2219bd776826e03bc738920

              Download Submit

            • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
              Filesize

              2B

              MD5

              f3b25701fe362ec84616a93a45ce9998

              SHA1

              d62636d8caec13f04e28442a0a6fa1afeb024bbb

              SHA256

              b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

              SHA512

              98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

              Download Submit

            • C:\Windows\Installer\MSIB948.tmp
              Filesize

              194KB

              MD5

              b537f8be77054e0d7f4ee4e0e84efba3

              SHA1

              8e4bdc51e1786b51b3ca33ad3da9b5607d974a04

              SHA256

              f8c84d0bc07b625c4749617d70af9e8f371a84e77944284f4b555c88edff2f5f

              SHA512

              38dcd3810c250381ae3ce33e6e5df048024c63f953c7478e4470bf53d884bc9d2034cb356df517dad14a48d2fa98f56dea52c327f9bf7da11b92440f77553884

              Download Submit

            • C:\Windows\Installer\e59b409.msi
              Filesize

              188KB

              MD5

              e312d6be7dee2b8f3737e0a1bc92e3aa

              SHA1

              72487572a3f8b8eff93489997c8a5041ea7a6867

              SHA256

              d48c8e848a219bceb638b2505132756cb908703fe75dee78bdf475435420dc49

              SHA512

              b39a0c18aa242887e3f9ae3d49bc9d6765ce15097718964cccd86b824d13481cbd53175105db29d17e3a08f74fe4d20dfb3f9989eca5276c3f5fbb255b80f8ae

              Download Submit

            • C:\Windows\System32\DriverStore\Temp\{23ec53ed-6204-4146-bec5-4982804b6260}\FortiFilter.inf
              Filesize

              2KB

              MD5

              e584cf96d29072269f06f647e43642de

              SHA1

              26fd25b27b3663334ca4d3dd1d5be99abda629b0

              SHA256

              41533b1919e8f746d7a6af79354cc879e212493536c9a0d348924362a14d906f

              SHA512

              1b6439f5d67bfaf6a2e55ebb923255b80343f1eebfc9fbe021ae5cf945a3971c59d62760656edbb9875241b244cd8dc6aed9d3b9784e4a9e642a3e6c1bee18df

              Download Submit

            • C:\Windows\System32\DriverStore\Temp\{23ec53ed-6204-4146-bec5-4982804b6260}\FortiFilter.sys
              Filesize

              34KB

              MD5

              40aee08dee292af27e5745f34d725987

              SHA1

              06e03b5a11af53f70ec4100256d79fed85414050

              SHA256

              e59576ee6038c0ccedf558aee5b34026ea51d22b633cf28509504da58d0e970b

              SHA512

              e929bbdedaa47d34b0a58e0b33b1a242badd7d6f55df6d201f96f3c707f4859c21c719fd7fa5b3de077d36ce8a9932ce77dfd22a1014b709b3f699f9ccdc20a0

              Download Submit

            • C:\Windows\System32\DriverStore\Temp\{23ec53ed-6204-4146-bec5-4982804b6260}\fortifilter.cat
              Filesize

              9KB

              MD5

              e0441351e09812bbbe2b3983d576b5cc

              SHA1

              1872004e5e519245be2bf36204139b431015afce

              SHA256

              20a578f3f08cdc8010a0555847fc4eaabd31967ec98d6faf2ebc95a396f8dff7

              SHA512

              a82e53107a936c70d08d45862b8756d026d6b0b32da9b358da00e608c9594fe84c920d6754de42ca7fcd1aa7b85c5e0be62db141a587aee01a3bf6b763c6f88c

              Download Submit

            • C:\Windows\System32\DriverStore\Temp\{f3c50fdd-8cd0-be4b-a84f-a17aa9980ec4}\ftsvnic.cat
              Filesize

              10KB

              MD5

              a2ed1b4f7127e0f187da8a87b7d0d8d0

              SHA1

              c0f98772368cefff745a76fee603e4fb85a694c1

              SHA256

              ab6b2f1c8a86f678ce8c50ad0c632688ba4893e6b649a64982b29775de65418d

              SHA512

              117a070b1b268af24ebdf8add2acea9af9b8b5f0574c42a02e534dec0c0609660b54d473a6d6aa3aeabdf0ad0a59527e6ebd1a991af30eb662a5c394b6d4539d

              Download Submit

            • C:\Windows\System32\DriverStore\Temp\{f3c50fdd-8cd0-be4b-a84f-a17aa9980ec4}\ftsvnic.inf
              Filesize

              1KB

              MD5

              db82a0ee5b7132673c09364e75949de6

              SHA1

              2c64d5ede718617a85c7a17586628700e2c0cb5d

              SHA256

              e379ca032e51e0e89839d1185edcf4ebff74b7038023a22de2187fedd22ef59b

              SHA512

              76b580032ad518db42da9c5eda90fae654901f970fdfc8dd8e9027487a87d3e3c5398d809d03ec96f779cc179f8affb23780b5f47542e631287d1eb1512c9129

              Download Submit

            • C:\Windows\System32\DriverStore\Temp\{f3c50fdd-8cd0-be4b-a84f-a17aa9980ec4}\ftsvnic.sys
              Filesize

              82KB

              MD5

              c059171f62f95827c40d5e843c941b32

              SHA1

              c2c12b7b11fa35ce34969cffa45cbd22248c74d7

              SHA256

              1e77d0f6119f6fa3e9d96f95e1b7f4daf82a11f200dbbd5c1327590629ebea75

              SHA512

              f462e2d923cb679f6486a839048f16f03b7edae474402f0d08fac60fdad711304306beae4f5f712c01dcafd66dd4c1ad2ebeae47df67e524d0368e3cfba634ff

              Download Submit

            • C:\Windows\System32\DriverStore\Temp\{f7569c3b-310b-a64b-a47e-e96e53ec156a}\ft_vnic.inf
              Filesize

              12KB

              MD5

              aa00403322652fe26ef34572d2ea186d

              SHA1

              dc0ae42798444f02c70c34f12eeca250132ef8a4

              SHA256

              621ddfb13ffd5a5a5feeda7e908254deb4fcc103d40b46cbab241235f426c63b

              SHA512

              dd99212f70e0f39c19accdc919e1a50b4f85d7938edffe507bcf6189564c9715c31d3088e9162c5f076afcb7a4b5abfc528064a59f72f1f6531c461325ba9a63

              Download Submit

            • C:\Windows\System32\DriverStore\Temp\{f7569c3b-310b-a64b-a47e-e96e53ec156a}\ftvnic.cat
              Filesize

              10KB

              MD5

              a6191a0e5a044e30002d5d74ca602adb

              SHA1

              5d507cdeee986d87103a0fd925cadaafe7b656c8

              SHA256

              f15da3512d52b22426156325072a0319926e36c2dbe116bd8cb73ba47ff9cd03

              SHA512

              6374aa45457522a1e6994aebb0be2c36b08c671bd6de4678b8d3cc2cac58d82212f0b30f16d2c7c108f6d2110a95538ec58e8ef4fc7d48f8c2927113135082aa

              Download Submit

            • C:\Windows\System32\DriverStore\Temp\{f7569c3b-310b-a64b-a47e-e96e53ec156a}\ftvnic.sys
              Filesize

              68KB

              MD5

              5a34b28f7615607bff85a909f6b19a01

              SHA1

              f2fba45f0944ad5f9687b04e442608c0d0055a37

              SHA256

              c3ee9bdd89c8993f3e7f8f64abda1b1a68bb0501a56f06d1c4b339bf6a5fc039

              SHA512

              2b86f3513f5fcc52efb4f389c774fdd7d4355d0d8f9d0c10f0d8eaae6d913124d3cab2eaa3000cdbaf3d116b4cc86f8bbc5245a7b04e59c482006348f9dff3e5

              Download Submit

            • C:\Windows\System32\catroot2\dberr.txt
              Filesize

              19KB

              MD5

              5a5f11296aeb01756d9787db6c547d63

              SHA1

              317be4f63d5ab3a3f37daf8abafe6bd459610a00

              SHA256

              3a380f89c50e52be430c82c652b712beadf142fdf0757cb8440309056c98ec5f

              SHA512

              3c6e42acf043a0158e7b7e4b16dd5ba3915e2c863194a205eaa196549d4dac24583a26d26467038b35bfb4275fa3fb0b8453a138a679270e5b02361e2d6d1088

              Download Submit

            • C:\Windows\Temp\{633A843D-4928-4939-ADE6-76AF3B567B26}\.ba\wixstdba.dll
              Filesize

              191KB

              MD5

              eab9caf4277829abdf6223ec1efa0edd

              SHA1

              74862ecf349a9bedd32699f2a7a4e00b4727543d

              SHA256

              a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041

              SHA512

              45b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2

              Download Submit

            • C:\Windows\Temp\{7D1DE30C-F62D-4FFD-B49D-CE2CBDFFECFF}\.ba\license.rtf
              Filesize

              9KB

              MD5

              04b33f0a9081c10e85d0e495a1294f83

              SHA1

              1efe2fb2d014a731b752672745f9ffecdd716412

              SHA256

              8099dc3cf9502c335da829e5c755948a12e3e6de490eb492a99deb673d883d8b

              SHA512

              d1dbed00df921169dd61501e2a3e95e6d7807348b188be9dd8fc63423501e4d848ece19ac466c3cacfccc6084e0eb2f457dc957990f6f511df10fd426e432685

              Download Submit

            • C:\Windows\Temp\{7D1DE30C-F62D-4FFD-B49D-CE2CBDFFECFF}\.ba\thm.wxl
              Filesize

              2KB

              MD5

              fbfcbc4dacc566a3c426f43ce10907b6

              SHA1

              63c45f9a771161740e100faf710f30eed017d723

              SHA256

              70400f181d00e1769774ff36bcd8b1ab5fbc431418067d31b876d18cc04ef4ce

              SHA512

              063fb6685ee8d2fa57863a74d66a83c819fe848ba3072b6e7d1b4fe397a9b24a1037183bb2fda776033c0936be83888a6456aae947e240521e2ab75d984ee35e

              Download Submit

            • C:\Windows\Temp\{7D1DE30C-F62D-4FFD-B49D-CE2CBDFFECFF}\.ba\thm.xml
              Filesize

              8KB

              MD5

              f62729c6d2540015e072514226c121c7

              SHA1

              c1e189d693f41ac2eafcc363f7890fc0fea6979c

              SHA256

              f13bae0ec08c91b4a315bb2d86ee48fade597e7a5440dce6f751f98a3a4d6916

              SHA512

              cbbfbfa7e013a2b85b78d71d32fdf65323534816978e7544ca6cea5286a0f6e8e7e5ffc4c538200211f11b94373d5658732d5d8aa1d01f9ccfdbf20f154f1471

              Download Submit

            • C:\Windows\Temp\{7D1DE30C-F62D-4FFD-B49D-CE2CBDFFECFF}\.be\VC_redist.x86.exe
              Filesize

              634KB

              MD5

              7bd0b2d204d75012d3a9a9ce107c379e

              SHA1

              41edd6321965d48e11ecded3852eb32e3c13848d

              SHA256

              d4c6f5c74bbb45c4f33d9cb7ddce47226ea0a5ab90b8ff3f420b63a55c3f6dd2

              SHA512

              d85ac030ebb3ba4412e69b5693406fe87e46696ca2a926ef75b6f6438e16b0c7ed1342363098530cdceb4db8e50614f33f972f7995e4222313fcef036887d0f0

              Download Submit

            • C:\Windows\Temp\{9EC73601-D193-4EBF-A44D-E932F4AA55AD}\.ba\logo.png
              Filesize

              1KB

              MD5

              d6bd210f227442b3362493d046cea233

              SHA1

              ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

              SHA256

              335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

              SHA512

              464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

              Download Submit

            • C:\Windows\Temp\{9EC73601-D193-4EBF-A44D-E932F4AA55AD}\.be\VC_redist.x64.exe
              Filesize

              635KB

              MD5

              b73be38096eddc4d427fbbfdd8cf15bd

              SHA1

              534f605fd43cc7089e448e5fa1b1a2d56de14779

              SHA256

              ab1164dcaf6c7d7d4905881f332a7b6f854be46e36b860c44d9eedc96ab6607a

              SHA512

              5af779926d344bc7c4140725f90cddad5eb778f5ca4856d5a31a6084424964d205638815eab4454e0ea34ea56fafca19fadd1eb2779dc6b7f277e4e4ce4b1603

              Download Submit

            • memory/992-1077-0x00000000004F0000-0x0000000000567000-memory.dmp

              Filesize

              476KB

              Download

            • memory/1164-1369-0x00000000004F0000-0x0000000000567000-memory.dmp

              Filesize

              476KB

              Download

            • memory/2132-1331-0x00000000004F0000-0x0000000000567000-memory.dmp

              Filesize

              476KB

              Download

            • memory/4320-1040-0x00000000004F0000-0x0000000000567000-memory.dmp

              Filesize

              476KB

              Download

            • memory/4404-1078-0x00000000004F0000-0x0000000000567000-memory.dmp

              Filesize

              476KB

              Download

            • memory/4580-1368-0x00000000004F0000-0x0000000000567000-memory.dmp

              Filesize

              476KB

              Download