Edit tour

Windows Analysis Report
FortiClientVPNOnlineInstaller.exe

Overview

General Information

Sample name:	FortiClientVPNOnlineInstaller.exe
Analysis ID:	1466699
MD5:	11bfc265fc53ac4756e4ef2759ca10eb
SHA1:	e3d2bf11618c39dfd036bb33ea96aa5f989fed25
SHA256:	2e520faa2b71ba56643153b77c2908c0d6da34a2f6f9abaa7cbadab9278dc99e
Infos:

Detection

Score:	20
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Signatures

Drops large PE files

Adds / modifies Windows certificates

Checks for available system drives (often done to infect USB drives)

Drops PE files

Drops certificate files (DER)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores large binary data to the registry

Uses 32bit PE files

Classification

Process Tree

System is w10x64

FortiClientVPNOnlineInstaller.exe (PID: 6036 cmdline: "C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe" MD5: 11BFC265FC53AC4756E4EF2759CA10EB)

FortiClientVPN.exe (PID: 5352 cmdline: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe MD5: 43866BF1847EFD3BEF65E4D9EF603CA7)

msiexec.exe (PID: 1576 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6136 cmdline: C:\Windows\System32\MsiExec.exe -Embedding 451EC6BB5F916B7CCFDA9FD6E2C98FE7 C MD5: E5DA170027542E25EDE42FC54C929077)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: FortiClientVPNOnlineInstaller.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe

File created: C:\Users\user\AppData\Local\Temp\FCTInstall.log

Jump to behavior

Source: FortiClientVPNOnlineInstaller.exe

Static PE information: certificate valid

Source: FortiClientVPNOnlineInstaller.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\jenkins\FCT0\GIT_CLONE_PARENT\FortiClientHS\Installation\WiX\FCT_Enterprise\FCSetupWx\x64\Release\FCSetupWx.pdb source: MSI88FD.tmp.5.dr
Source:	Binary string: C:\jenkins\FCT0\GIT_CLONE_PARENT\FortiClientHS\Release\Bootstrapper_x64.pdb source: FortiClientVPN.exe, 00000005.00000000.3331110950.0000000000239000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\jenkins\EMS0\GIT_CLONE_PARENT\FortiClientEMS\Release\SendFailureReport.pdb source: FortiClientVPNOnlineInstaller.exe, 00000000.00000003.3293930397.000000000701A000.00000004.00000020.00020000.00000000.sdmp, FortiClientVPNOnlineInstaller.exe, 00000000.00000003.3319615964.0000000007279000.00000004.00000020.00020000.00000000.sdmp, FortiClientVPNOnlineInstaller.exe, 00000000.00000003.3322463327.0000000007275000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: Joe Sandbox View

IP Address: 192.229.221.95 192.229.221.95

Source: MSI88FD.tmp.5.dr	String found in binary or memory: \drivers\etc\hostsby Forticlient SafeSearchrestrict.youtube.comwww.youtube.comm.youtube.comyoutubei.googleapis.comyoutube.googleapis.comwww.youtube-nocookie.comrestrictmoderate.youtube.comstrict.bing.comwww.bing.comforcesafesearch.google.comwww.google.comwww.google.adwww.google.aewww.google.com.afwww.google.com.agwww.google.com.aiwww.google.alwww.google.amwww.google.co.aowww.google.com.arwww.google.aswww.google.atwww.google.com.auwww.google.azwww.google.bawww.google.com.bdwww.google.bewww.google.bfwww.google.bgwww.google.com.bhwww.google.biwww.google.bjwww.google.com.bnwww.google.com.bowww.google.com.brwww.google.bswww.google.btwww.google.co.bwwww.google.bywww.google.com.bzwww.google.cawww.google.cdwww.google.cfwww.google.cgwww.google.chwww.google.ciwww.google.co.ckwww.google.clwww.google.cmwww.google.cnwww.google.com.cowww.google.co.crwww.google.com.cuwww.google.cvwww.google.com.cywww.google.czwww.google.dewww.google.djwww.google.dkwww.google.dmwww.google.com.dowww.google.dzwww.google.com.ecwww.google.eewww.google.com.egwww.google.eswww.google.com.etwww.google.fiwww.google.com.fjwww.google.fmwww.google.frwww.google.gawww.google.gewww.google.ggwww.google.com.ghwww.google.com.giwww.google.glwww.google.gmwww.google.grwww.google.com.gtwww.google.gywww.google.com.hkwww.google.hnwww.google.hrwww.google.htwww.google.huwww.google.co.idwww.google.iewww.google.co.ilwww.google.imwww.google.co.inwww.google.iqwww.google.iswww.google.itwww.google.jewww.google.com.jmwww.google.jowww.google.co.jpwww.google.co.kewww.google.com.khwww.google.kiwww.google.kgwww.google.co.krwww.google.com.kwwww.google.kzwww.google.lawww.google.com.lbwww.google.liwww.google.lkwww.google.co.lswww.google.ltwww.google.luwww.google.lvwww.google.com.lywww.google.co.mawww.google.mdwww.google.mewww.google.mgwww.google.mkwww.google.mlwww.google.com.mmwww.google.mnwww.google.mswww.google.com.mtwww.google.muwww.google.mvwww.google.mwwww.google.com.mxwww.google.com.mywww.google.co.mzwww.google.com.nawww.google.com.ngwww.google.com.niwww.google.newww.google.nlwww.google.nowww.google.com.npwww.google.nrwww.google.nuwww.google.co.nzwww.google.com.omwww.google.com.pawww.google.com.pewww.google.com.pgwww.google.com.phwww.google.com.pkwww.google.plwww.google.pnwww.google.com.prwww.google.pswww.google.ptwww.google.com.pywww.google.com.qawww.google.rowww.google.ruwww.google.rwwww.google.com.sawww.google.com.sbwww.google.scwww.google.sewww.google.com.sgwww.google.shwww.google.siwww.google.skwww.google.com.slwww.google.snwww.google.sowww.google.smwww.google.srwww.google.stwww.google.com.svwww.google.tdwww.google.tgwww.google.co.thwww.google.com.tjwww.google.tlwww.google.tmwww.google.tnwww.google.towww.google.com.trwww.google.ttwww.google.com.twwww.google.co.tzwww.google.com.uawww.google.co.ugwww.google.co.ukwww.google.com.uywww.google.co.uzwww.google.com.vcwww.google.co.vewww.google.vgwww.google.co.viwww.google.com.vnwww.google.vuwww.google.wswww.google.rswww.google.co.zawww.google.co.zmwww.google.co.zww
Source: MSI88FD.tmp.5.dr	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)

Source: FortiClientVPNOnlineInstaller.exe, 00000000.00000003.3305843564.0000000002C65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/
Source: FortiClientVPNOnlineInstaller.exe, MSI88FD.tmp.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: FortiClientVPNOnlineInstaller.exe, MSI88FD.tmp.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: FortiClientVPNOnlineInstaller.exe, MSI88FD.tmp.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: FortiClientVPNOnlineInstaller.exe, 00000000.00000003.3305843564.0000000002C59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
Source: FortiClientVPNOnlineInstaller.exe, MSI88FD.tmp.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: FortiClientVPNOnlineInstaller.exe, 00000000.00000003.3305843564.0000000002C65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/l
Source: FortiClientVPNOnlineInstaller.exe, 00000000.00000002.3950911214.0000000002C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/llz
Source: FortiClientVPNOnlineInstaller.exe, MSI88FD.tmp.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: FortiClientVPNOnlineInstaller.exe, MSI88FD.tmp.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: FortiClientVPNOnlineInstaller.exe, MSI88FD.tmp.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: MSI88FD.tmp.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: FortiClientVPNOnlineInstaller.exe, MSI88FD.tmp.5.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: FortiClientVPNOnlineInstaller.exe, 00000000.00000002.3950911214.0000000002BDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: FortiClientVPNOnlineInstaller.exe, 00000000.00000002.3950911214.0000000002C00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: FortiClientVPNOnlineInstaller.exe, MSI88FD.tmp.5.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: FortiClientVPNOnlineInstaller.exe, MSI88FD.tmp.5.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: FortiClientVPNOnlineInstaller.exe, MSI88FD.tmp.5.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: FortiClientVPNOnlineInstaller.exe, MSI88FD.tmp.5.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: FortiClientVPNOnlineInstaller.exe, MSI88FD.tmp.5.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: MSI88FD.tmp.5.dr	String found in binary or memory: https://clients2.google.com/service/update2/crxupdate_urlUrlRatingWithFortiGuardmodify_hostsWebBrows
Source: MSI88FD.tmp.5.dr	String found in binary or memory: https://repo.fortinet.com/repo/forticlient/extensions/pam/firefox/%7B9984e753-9122-4cbc-b198-dccd534

Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4			Jump to dropped file
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1			Jump to dropped file

System Summary

Drops large PE files

Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe

File dump: FortiClientVPN.exe.0.dr 176739392

Jump to dropped file

Source: FortiClientVPN.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: FortiClientVPN.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: FortiClientVPN.exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: FortiClientVPN.exe.0.dr	Static PE information: Resource name: RT_HTML type: PE32 executable (console) Intel 80386, for MS Windows

Source: FortiClientVPNOnlineInstaller.exe, 00000000.00000003.3293930397.000000000701A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSendFailureReport.exe vs FortiClientVPNOnlineInstaller.exe
Source: FortiClientVPNOnlineInstaller.exe, 00000000.00000003.3319615964.0000000007279000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSendFailureReport.exe vs FortiClientVPNOnlineInstaller.exe
Source: FortiClientVPNOnlineInstaller.exe, 00000000.00000003.3322463327.0000000007275000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSendFailureReport.exe vs FortiClientVPNOnlineInstaller.exe

Source: FortiClientVPNOnlineInstaller.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: FortiClientVPNOnlineInstaller.exe	Binary string: unknown errorXGetProcessImageFileNameWpsapi.dllGetVolumePathNamesForVolumeNameWKernel32.dllNtQueryInformationProcessNtSetInformationProcessNtQueryInformationThread\SystemRoot\SystemRootA:\Device\LanmanRedirectorSeDebugPrivilege
Source: MSI88FD.tmp.5.dr	Binary string: SELECT `Property`.`Value` FROM `Property` WHERE `Property`.`Property`='ProductCode'SELECT `Property`.`Value` FROM `Property` WHERE `Property`.`Property`='ProductVersion'PackageName%s.%s.%s.%04s%s\Applications\Cachemsi_cache_get_folder_and_file, ret=%d, szCacheBasePath=%s szCacheSubFolder=%s szCacheFile=%sCache file already exists.%S%s\Applications\Cache\%s\%s\%SystemRoot%\system32\kernel32.dllSOFTWARE\Microsoft\Windows NT\CurrentVersionCurrentMajorVersionNumberCurrentMinorVersionNumberCurrentBuildNumberGetProductInfoMicrosoft Windows 11 Windows 10 1110Windows Server 2022 2022Windows Server 2019 2019Windows Server 2016 2016Windows 8.1 Windows Server 2012 R2 8.12012 R2Windows 8.0 Windows Server 2012 82012Windows 7 Windows Server 2008 R2 72008 R2Windows Vista Windows Server 2008 Vista2008Windows OS version %d.%dWindows Server OS version %d.%dv%d.%dUltimate EditionHome Premium EditionHome Basic EditionEnterprise EditionBusiness EditionStarter EditionCluster Server EditionDatacenter EditionDatacenter Edition (core installation)Enterprise Edition (core installation)Enterprise Edition for Itanium-based SystemsSmall Business ServerSmall Business Server Premium EditionStandard EditionStandard Edition (core installation)Web Server EditionProfessional Edition, 64-bit, 32-bitWindows Server 2003 R2, Windows Storage Server 2003Windows Home ServerWindows XP Professional x64 EditionWindows Server 2003, Datacenter Edition for Itanium-based SystemsDatacenter x64 EditionEnterprise x64 EditionStandard x64 EditionCompute Cluster EditionWeb EditionWindows XP Home EditionProfessionalWindows 2000 Datacenter ServerAdvanced ServerServer (build %d)Windows %d.%d (build %d)GetProcessImageFileNameWpsapi.dllGetVolumePathNamesForVolumeNameWKernel32.dllNtQueryInformationProcessNtSetInformationProcessNtQueryInformationThread\SystemRoot\A:\Device\LanmanRedirector\Device\SeDebugPrivilegeS-%lu-%02hx%02hx%02hx%02hx%02hx%02hx%lu-%luVolatile EnvironmentUSERDNSDOMAIN

Source: classification engine

Classification label: sus20.winEXE@6/19@0/2

Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe

File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1

Jump to behavior

Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\FC_{22CD96BF-E5B0-41d8-83ED-C73F9BBF9FA8}
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\FC_{4E84B682-0B1B-4826-AA4C-9241DE3920F7}

Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe

File created: C:\Users\user\AppData\Local\Temp\FCTInstall.log

Jump to behavior

Source: FortiClientVPNOnlineInstaller.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MSI88FD.tmp.5.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: MSI88FD.tmp.5.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);

Source: FortiClientVPNOnlineInstaller.exe	String found in binary or memory: id-cmc-addExtensions
Source: FortiClientVPNOnlineInstaller.exe	String found in binary or memory: set-addPolicy

Source: unknown	Process created: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe "C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe"
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Process created: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 451EC6BB5F916B7CCFDA9FD6E2C98FE7 C
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Process created: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding 451EC6BB5F916B7CCFDA9FD6E2C98FE7 C	Jump to behavior

Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56ad4c5d-b908-4f85-8ff1-7940c29b3bcf}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: FortiClientVPNOnlineInstaller.exe

Static PE information: certificate valid

Source: FortiClientVPNOnlineInstaller.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: FortiClientVPNOnlineInstaller.exe

Static file information: File size 2794560 > 1048576

Source: FortiClientVPNOnlineInstaller.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1c4c00

Source: FortiClientVPNOnlineInstaller.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: FortiClientVPNOnlineInstaller.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: FortiClientVPNOnlineInstaller.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: FortiClientVPNOnlineInstaller.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: FortiClientVPNOnlineInstaller.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: FortiClientVPNOnlineInstaller.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: FortiClientVPNOnlineInstaller.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: FortiClientVPNOnlineInstaller.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\jenkins\FCT0\GIT_CLONE_PARENT\FortiClientHS\Installation\WiX\FCT_Enterprise\FCSetupWx\x64\Release\FCSetupWx.pdb source: MSI88FD.tmp.5.dr
Source:	Binary string: C:\jenkins\FCT0\GIT_CLONE_PARENT\FortiClientHS\Release\Bootstrapper_x64.pdb source: FortiClientVPN.exe, 00000005.00000000.3331110950.0000000000239000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\jenkins\EMS0\GIT_CLONE_PARENT\FortiClientEMS\Release\SendFailureReport.pdb source: FortiClientVPNOnlineInstaller.exe, 00000000.00000003.3293930397.000000000701A000.00000004.00000020.00020000.00000000.sdmp, FortiClientVPNOnlineInstaller.exe, 00000000.00000003.3319615964.0000000007279000.00000004.00000020.00020000.00000000.sdmp, FortiClientVPNOnlineInstaller.exe, 00000000.00000003.3322463327.0000000007275000.00000004.00000020.00020000.00000000.sdmp

Source: FortiClientVPNOnlineInstaller.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: FortiClientVPNOnlineInstaller.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: FortiClientVPNOnlineInstaller.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: FortiClientVPNOnlineInstaller.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: FortiClientVPNOnlineInstaller.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: FortiClientVPNOnlineInstaller.exe	Static PE information: section name: .didat
Source: FortiClientInstaller.exe.5.dr	Static PE information: section name: .didat
Source: MSI88FD.tmp.5.dr	Static PE information: section name: _RDATA
Source: MSI8A46.tmp.5.dr	Static PE information: section name: _RDATA
Source: MSI8B12.tmp.5.dr	Static PE information: section name: _RDATA
Source: MSI8C1C.tmp.5.dr	Static PE information: section name: _RDATA

Source: FortiClientVPNOnlineInstaller.exe	Static PE information: section name: .text entropy: 6.849650084467638
Source: FortiClientInstaller.exe.5.dr	Static PE information: section name: .text entropy: 6.8462744100412145

Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	File created: C:\Users\user\AppData\Local\Temp\MSI8C1C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	File created: C:\Users\user\AppData\Local\Temp\MSI88FD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	File created: C:\Users\user\AppData\Local\Temp\MSI8B12.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	File created: C:\Users\user\AppData\Local\Temp\FCT_{625BC4BA-AC3E-4E4B-9996-EEED9D4287C3}\{37F86F81-CEE2-4981-BF24-D0AAFBE74BFB}\FortiClientInstaller.exe	Jump to dropped file
Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe	File created: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	File created: C:\Users\user\AppData\Local\Temp\MSI8A46.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe

File created: C:\Users\user\AppData\Local\Temp\FCTInstall.log

Jump to behavior

Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\7B0F360B775F76C94A12CA48445AA2D2A875701C Blob

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI8C1C.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI88FD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI8B12.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\FCT_{625BC4BA-AC3E-4E4B-9996-EEED9D4287C3}\{37F86F81-CEE2-4981-BF24-D0AAFBE74BFB}\FortiClientInstaller.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI8A46.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe TID: 6096

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: FortiClientVPNOnlineInstaller.exe	Binary or memory string: default%dbWTSQueryUserTokenWtsapi32.dll\system32\Netapi32.dllNetapi32.dllNetApiBufferFreeNetUserGetInfo\\.\pipe\FC_{F18F86FD-7503-4564-80CF-B6B199519837}Shell_TrayWndSystemDrive%010u%s%sfortisslGlobal\_UID_CHANGE_{0ACCF217-864C-451F-BF79-9C7042DBF423}\\.\PhysicalDrive0software\Fortinet\FortiClient\FA_UIswuid%010u%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02XIsWow64ProcessLCIDSetThreadUILanguageFortinet Technologies (Canada) ULCFortinet Technologies (Canada) Inc.Fortinet TechnologiesFortinet, Inc.Fortinet Inc.Microsoft WindowsMicrosoft Windows PublisherMicrosoft CorporationMicrosoft Windows XP PublisherMicrosoft Windows Component PublisherMicrosoft Windows 2000 PublisherMicrosoft Windows Hardware Compatibility PublisherMacromedia, Inc.Adobe Systems IncorporatedAdobe Systems, IncorporatedMozilla CorporationGoogle IncGoogle LLCSkype Technologies SATeamViewerAdvanced Micro Devices, Inc.Aladdin Knowledge Systems LTDSun Microsystems, Inc.Oracle CorporationDell IncApple Inc.VMware, Inc.Intel Corporation - Software and Firmware ProductsSkype Software SarlOracle America, Inc.wintrust.dllCryptCATAdminAcquireContextWinVerifyTrustWTHelperGetProvSignerFromChainWTHelperProvDataFromStateDataCryptCATAdminReleaseContextCryptCATAdminReleaseCatalogContextCryptCATCatalogInfoFromContextCryptCATAdminEnumCatalogFromHashCryptCATAdminCalcHashFromFileHandleIsCatalogFileWTHelperGetProvCertFromChainWTHelperCertFindIssuerCertificatecrypt32.dllCertGetNameStringWPIPEMSG: client pid=%d tid=%d connect=%ws ret=%d
Source: FortiClientVPNOnlineInstaller.exe, 00000000.00000002.3950911214.0000000002BDD000.00000004.00000020.00020000.00000000.sdmp, FortiClientVPNOnlineInstaller.exe, 00000000.00000002.3951080698.0000000002C7B000.00000004.00000020.00020000.00000000.sdmp, FortiClientVPNOnlineInstaller.exe, 00000000.00000003.3305843564.0000000002C7B000.00000004.00000020.00020000.00000000.sdmp, FortiClientVPNOnlineInstaller.exe, 00000000.00000003.3305843564.0000000002C65000.00000004.00000020.00020000.00000000.sdmp, FortiClientVPNOnlineInstaller.exe, 00000000.00000002.3951080698.0000000002C67000.00000004.00000020.00020000.00000000.sdmp, FortiClientVPNOnlineInstaller.exe, 00000000.00000003.3906369667.0000000002C65000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: MSI88FD.tmp.5.dr	Binary or memory string: Fortinet Technologies (Canada) ULCFortinet Technologies (Canada) Inc.Fortinet TechnologiesFortinet, Inc.Fortinet Inc.Microsoft WindowsMicrosoft Windows PublisherMicrosoft CorporationMicrosoft Windows XP PublisherMicrosoft Windows Component PublisherMicrosoft Windows 2000 PublisherMicrosoft Windows Hardware Compatibility PublisherMacromedia, Inc.Adobe Systems IncorporatedAdobe Systems, IncorporatedMozilla CorporationGoogle IncGoogle LLCSkype Technologies SATeamViewerAdvanced Micro Devices, Inc.Aladdin Knowledge Systems LTDSun Microsystems, Inc.Oracle CorporationDell IncApple Inc.VMware, Inc.Intel Corporation - Software and Firmware ProductsSkype Software SarlOracle America, Inc.`
Source: FortiClientVPN.exe, 00000005.00000000.3331110950.0000000000239000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: Memory allocation errorGetSystemTimePreciseAsFileTimeFortinet Technologies (Canada) ULCFortinet Technologies (Canada) Inc.Fortinet TechnologiesFortinet, Inc.Fortinet Inc.Microsoft WindowsMicrosoft Windows PublisherMicrosoft CorporationMicrosoft Windows XP PublisherMicrosoft Windows Component PublisherMicrosoft Windows 2000 PublisherMicrosoft Windows Hardware Compatibility PublisherMacromedia, Inc.Adobe Systems IncorporatedAdobe Systems, IncorporatedMozilla CorporationGoogle IncGoogle LLCSkype Technologies SATeamViewerAdvanced Micro Devices, Inc.Aladdin Knowledge Systems LTDSun Microsystems, Inc.Oracle CorporationDell IncApple Inc.VMware, Inc.Intel Corporation - Software and Firmware ProductsSkype Software SarlOracle America, Inc.wintrust.dllCryptCATAdminAcquireContextWinVerifyTrustWTHelperGetProvSignerFromChainWTHelperProvDataFromStateDataCryptCATAdminReleaseContextCryptCATAdminReleaseCatalogContextCryptCATCatalogInfoFromContextCryptCATAdminEnumCatalogFromHashCryptCATAdminCalcHashFromFileHandleIsCatalogFileWTHelperGetProvCertFromChainWTHelperCertFindIssuerCertificatecrypt32.dllCertGetNameStringW

Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe

Process information queried: ProcessInformation

Jump to behavior

Source: FortiClientVPNOnlineInstaller.exe	Binary or memory string: default%dbWTSQueryUserTokenWtsapi32.dll\system32\Netapi32.dllNetapi32.dllNetApiBufferFreeNetUserGetInfo\\.\pipe\FC_{F18F86FD-7503-4564-80CF-B6B199519837}Shell_TrayWndSystemDrive%010u%s%sfortisslGlobal\_UID_CHANGE_{0ACCF217-864C-451F-BF79-9C7042DBF423}\\.\PhysicalDrive0software\Fortinet\FortiClient\FA_UIswuid%010u%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02X%02XIsWow64ProcessLCIDSetThreadUILanguageFortinet Technologies (Canada) ULCFortinet Technologies (Canada) Inc.Fortinet TechnologiesFortinet, Inc.Fortinet Inc.Microsoft WindowsMicrosoft Windows PublisherMicrosoft CorporationMicrosoft Windows XP PublisherMicrosoft Windows Component PublisherMicrosoft Windows 2000 PublisherMicrosoft Windows Hardware Compatibility PublisherMacromedia, Inc.Adobe Systems IncorporatedAdobe Systems, IncorporatedMozilla CorporationGoogle IncGoogle LLCSkype Technologies SATeamViewerAdvanced Micro Devices, Inc.Aladdin Knowledge Systems LTDSun Microsystems, Inc.Oracle CorporationDell IncApple Inc.VMware, Inc.Intel Corporation - Software and Firmware ProductsSkype Software SarlOracle America, Inc.wintrust.dllCryptCATAdminAcquireContextWinVerifyTrustWTHelperGetProvSignerFromChainWTHelperProvDataFromStateDataCryptCATAdminReleaseContextCryptCATAdminReleaseCatalogContextCryptCATCatalogInfoFromContextCryptCATAdminEnumCatalogFromHashCryptCATAdminCalcHashFromFileHandleIsCatalogFileWTHelperGetProvCertFromChainWTHelperCertFindIssuerCertificatecrypt32.dllCertGetNameStringWPIPEMSG: client pid=%d tid=%d connect=%ws ret=%d
Source: MSI88FD.tmp.5.dr	Binary or memory string: {768FCDC7-A6E7-424a-BF92-93B5338C9D2F}{34D6AD5A-C03D-45ff-AA8A-8B306E01B96D}{78B904C1-D2FC-4345-81FD-5288D9DAAE7E}{938BAF3B-6B94-4C4E-AB74-0B199110AEE2}{C2FAE67B-9C91-4C88-91C6-37E4D5F50FE9}{7547D35D-57C9-40FD-AA15-FB810B9C945C}{A7384DDC-F7B3-460F-9DC2-E2AA8DC57011}{0DC51760-4FB7-41F3-8967-D3DEC9D320EB}{34CBFE93-A6CB-4063-A16C-B0F28CB3F934}{768FCDC7-A6E7-424A-BF92-93B5338C9D2F}{C93EEA4B-7FBB-4c81-B95E-01B83F34FFD8}{B94FC42D-37A5-4a75-8B14-B18FF20C3492}{5FED163B-78E6-4002-90DE-B4E080C1781C}{12EBD61A-4CE3-41FB-8D05-3115420E90BE}{3D4862D9-4DF7-4DE1-9B5C-D34C960ECDAD}VersionString{1894F2C4-6426-425B-B244-3E4701C803E2}{12ebd61a-4ce3-41fb-8d05-3115420e90be}Global\%s{E09B48B5-E141-427A-AB0C-D3605127224A}{689404D2-1C94-44B3-9203-BEC5594FDA7A}{EFB70B01-B1F3-4960-AB69-4A280084A60C}{C2736CA7-76E1-4D0C-B590-483A7FFD18DA}{FE7E950B-220A-4182-B5CA-19397244DCFD}{7E5C338B-E77E-4CB4-9C1D-FB67B56B3B19}{F07E35BF-8B03-4777-9B5E-AE90E4FF0932}{C5B59406-E985-4187-84E8-68E2D9F89A47}{D7CE240C-0F3B-4C40-9278-C0B90E533652}{A519AE9C-7C79-4C5B-9127-8F46D648D5A4}{4541DA32-2108-43E9-9915-C71B9DE77048}{A5C1C914-4EF7-40ED-9BCE-FCEB4BB0C19D}{9FCE5BBD-D85F-4905-8A0C-12A3A86C2434}{F4E46404-2578-4955-B748-547957F08AB1}{B7300824-E68F-45F1-BAC1-5F15636C346F}{CD59EA85-6CBF-4C08-BE59-6C628B3D8F54}SOFTWARE\Microsoft\MSSQLServer\MSSQLServer\CurrentVersionselect * from SqlServiceAdvancedProperty where SQLServiceType = 1root\Microsoft\SqlServer\ComputerManagementWTSQueryUserTokenWtsapi32.dll\system32\Netapi32.dllNetapi32.dllNetApiBufferFreeNetUserGetInfoShell_TrayWndWTSSendMessageW
Source: FortiClientVPN.exe, 00000005.00000000.3331110950.0000000000239000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: GetProcessImageFileNameWpsapi.dllGetVolumePathNamesForVolumeNameWKernel32.dllNtQueryInformationProcessNtSetInformationProcessNtQueryInformationThread\SystemRoot\SystemRootA:\Device\LanmanRedirectorSeDebugPrivilegeFortipsFortiRdrFortiClient IPSec DriverFortiRdr2FortiClient Redirect DriverFortiClient Application DriverfortiapdFAFileMonfortimon2kFortiClient Realtime Monitor DriverFSFilter AntiVirus324920FltMgrfortimon3fortimon2FortiClient Application Firewall DriverFortiFWFSFilter Content ScreenerFortiFW2324900FortiShield mini-filter driverFortiStat2FortiStatFortiWFFortiClient NAC Filter DriverfortiloaderFortiClient Web Filter Driverfortiloader driverSystem Reservedfortisniff driverfortisniffFSFilter SandboxingFortiAptFilter324930FortiClient Sandboxing DriverFortiClient VPN Traffic ControlFortiTransCtrlav_task.exesoftware\Fortinet\FortiClient\FA_IKEupdate_task.exesoftware\Fortinet\FortiClient\FA_AVRipsec.exesoftware\Fortinet\FortiClient\FA_FMONavrepair.exesoftware\Fortinet\FortiClient\FA_SUBMITfmon.exermon.exeSubmitV.exesoftware\Fortinet\FortiClient\FA_FORTITRAYfortifws.exesoftware\Fortinet\FortiClient\FA_VPNSTARTERFortiTray.exesoftware\Fortinet\FortiClient\FA_WFFortiVPNSt.exeFCDBLog.exeFortiWF.exeFortiProxy.exeFCMgr.exeFortiWaDBd.exesoftware\Fortinet\FortiClient\FA_APPDBsoftware\Fortinet\FortiClient\FA_CONFIGDFortiWad.exeFortiSSLVPNdaemon.exesoftware\Fortinet\FortiClient\FA_SSLVPNFSSOMA.exeFCVbltScan.exefcaptmon.exesoftware\Fortinet\FortiClient\FA_SANDBOXfortiae.exesoftware\Fortinet\FortiClient\FA_AEFortiSSLVPNsys.exesoftware\Fortinet\FortiClient\FA_SETTINGSFortiUSBmon.exesoftware\Fortinet\FortiClient\FA_RMAfcmonitor.exesoftware\Fortinet\FortiClient\FA_FCMONITORFortiTcs.exesoftware\Fortinet\FortiClient\FA_ZTNAFCCryptd.exesoftware\Fortinet\FortiClient\FA_FCCRYPTDFortivrs.exesoftware\Fortinet\FortiClient\FA_PAMFortiVPN.exesoftware\Fortinet\FortiClient\FA_FORTIVPNFortiFS.exesoftware\Fortinet\FortiClient\FA_FS\\.\pipe\FC_{F18F86FD-7503-4564-80CF-B6B199519837}FC_{CFFA4B7C-C730-41af-935C-4DC89655ECB3}Global\FC_{CFFA4B7C-C730-41af-935C-4DC89655ECB3}WTSQueryUserTokenWtsapi32.dllShell_TrayWndGlobal\%ssoftware\Fortinet\FortiClient\FA_FIPSGlobal\_UID_CHANGE_{0ACCF217-864C-451F-BF79-9C7042DBF423}defaultSOFTWARE\Microsoft\Windows NT\CurrentVersion%SystemRoot%\system32\kernel32.dllCurrentMinorVersionNumberCurrentMajorVersionNumberGetProductInfoCurrentBuildNumberWindows 11 Microsoft 11Windows 10 Windows Server 2022 10Windows Server 2019 2022Windows Server 2016 2019Windows 8.1 20168.1Windows Server 2012 R2 Windows 8.0 2012 R28Windows Server 2012 Windows 7 20127Windows Server 2008 R2 Windows Vista 2008 R2VistaWindows Server 2008 Windows OS version %d.%d2008v%d.%dWindows Server OS version %d.%dHome Premium EditionUltimate EditionEnterprise EditionHome Basic EditionStarter EditionBusiness EditionDatacenter EditionCluster Server EditionEnterprise Edition (core installation)Datacenter Edition (core installation)Small Business ServerEnterprise Edition for Itanium-based

Source: C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 Blob

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	2 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	1 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Modify Registry	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Virtualization/Sandbox Evasion	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Disable or Modify Tools	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Process Injection	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
FortiClientVPNOnlineInstaller.exe	0%	ReversingLabs
FortiClientVPNOnlineInstaller.exe	0%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\FCT_{625BC4BA-AC3E-4E4B-9996-EEED9D4287C3}\{37F86F81-CEE2-4981-BF24-D0AAFBE74BFB}\FortiClientInstaller.exe	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\FCT_{625BC4BA-AC3E-4E4B-9996-EEED9D4287C3}\{37F86F81-CEE2-4981-BF24-D0AAFBE74BFB}\FortiClientInstaller.exe	5%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\MSI88FD.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI88FD.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\MSI8A46.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI8A46.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\MSI8B12.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI8B12.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\MSI8C1C.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI8C1C.tmp	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://repo.fortinet.com/repo/forticlient/extensions/pam/firefox/%7B9984e753-9122-4cbc-b198-dccd534	0%	Avira URL Cloud	safe
https://repo.fortinet.com/repo/forticlient/extensions/pam/firefox/%7B9984e753-9122-4cbc-b198-dccd534	0%	Virustotal		Browse

Domains and IPs

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://repo.fortinet.com/repo/forticlient/extensions/pam/firefox/%7B9984e753-9122-4cbc-b198-dccd534	MSI88FD.tmp.5.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
173.243.138.76	unknown	United States		40934	FORTINETUS	false
192.229.221.95	unknown	United States		15133	EDGECASTUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1466699
Start date and time:	2024-07-03 10:05:31 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FortiClientVPNOnlineInstaller.exe
Detection:	SUS
Classification:	sus20.winEXE@6/19@0/2
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Skipping network analysis since amount of network traffic is too extensive

Created / dropped Files

C:\ProgramData\Applications\Cache\{0DC51760-4FB7-41F3-8967-D3DEC9D320EB}\7.4.0.1658\FortiClient.msi

Download File

Process:	C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: FortiClient VPN, Author: Fortinet Technologies Inc, Keywords: Installer, Comments: This installer database contains the logic and data required to install FortiClient VPN., Template: x64;1033, Revision Number: {F999948D-39F6-4A38-BD43-BD7510C19B77}, Create Time/Date: Tue Apr 30 23:57:30 2024, Last Saved Time/Date: Tue Apr 30 23:57:30 2024, Number of Pages: 500, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.8.1128.0), Security: 2
Category:	dropped
Size (bytes):	163995648
Entropy (8bit):	7.916524132801799
Encrypted:	false
SSDEEP:	3145728:rNBEkmvtfi4bJ0t+0xwc1AM5+ENJeQ7Ph3fVjYl4PIWW:rNSkmvs4bJ0Uk9AMQWeSh3pjQWW
MD5:	FA9B2F29C47B8C78E8802BCBB429AD8D
SHA1:	927ACE51A73B3BB726CB74153887764B60FC3905
SHA-256:	7A5B2F8095310BF9E393FB46D47A6A37F475794CE195FBB7D0F2EC4B301D76E9
SHA-512:	6DF21A03201487D6B1A46D97645E52E92E0AE540D654D6B3073BD0554B67F138D2C6A04C055A9F4E2C94691AE05C09BC0EBB398F9D4C07C1E66ACC5CC57EF40D
Malicious:	false
Reputation:	low
Preview:	......................>...................(................................................................ ...$...(...,...0...4...8...<...@...D...H...L...P...T...X...\...`...d...h...l...p...t...x...\|..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1

Download File

Process:	C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.596259519827648
Encrypted:	false
SSDEEP:	48:GL3d+gG48zmf8grQcPJ27AcYG7i47V28Tl4JZG0FWk8ZHJ:GTd0PmfrrQG28cYG28CEJ
MD5:	D91299E84355CD8D5A86795A0118B6E9
SHA1:	7B0F360B775F76C94A12CA48445AA2D2A875701C
SHA-256:	46011EDE1C147EB2BC731A539B7C047B7EE93E48B9D3C3BA710CE132BBDFAC6B
SHA-512:	6D11D03F2DF2D931FAC9F47CEDA70D81D51A9116C1EF362D67B7874F91BF20915006F7AF8ECEBAEA59D2DC144536B25EA091CC33C04C9A3808EEFDC69C90E816
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0...0............@.`.L.^.....0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...210429000000Z..360428235959Z0i1.0...U....US1.0...U....DigiCert, Inc.1A0?..U...8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10.."0....H.............0........./B.(.x.].9Y...B.3..=..p..&0...h.\..4$..KO.xC........g.RO..W.......>Mp$d....}4}L.W.kC....;....GZ..L.. %............e....I5.=Q..!xE...,.......IpB2......eh..ML..HRh....W]...e...O.,H.V.5........7.....\|...2........t..9..`.....1.......#GG...n..m.....jg-.D......;...2Z..j`T.I....\.o.&....8........o.a4\..E(.6*f(_.s.&%....\...L.b.^3........+..6y.....u.e..HP.w....P.F.aX..\|..<.(.9....S..G.u0..0.v..[K]taM?..v.X.r.)A...m&vh.A.X..&+..MY.x.J>@G_.Ps..#!Y`.dT..!..8.\|f..x8E0.O.cOL....SA\|X=G....2...l<.V.........Y0..U0...U.......0.......0...U......h7..;._....a{..e.NB0...U.#..0.......q]dL..g?....O0...U...........0...U.%..0...+.......0w..+........k0i0$..+.....0...http:/

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4

Download File

Process:	C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	7.688784034406474
Encrypted:	false
SSDEEP:	24:nIGWnSIGWnSGc9VIyy0KuiUQ+7n0TCDZJCCAyuIqwmCFUZnPQ1LSdT:nIL7LJSRQ+QgAyuxwfynPQmR
MD5:	78F2FCAA601F2FB4EBC937BA532E7549
SHA1:	DDFB16CD4931C973A2037D3FC83A4D7D775D05E4
SHA-256:	552F7BDCF1A7AF9E6CE672017F4F12ABF77240C78E761AC203D1D9D20AC89988
SHA-512:	BCAD73A7A5AFB7120549DD54BA1F15C551AE24C7181F008392065D1ED006E6FA4FA5A60538D52461B15A12F5292049E929CFFDE15CC400DEC9CDFCA0B36A68DD
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0...0..x..........W..!2.9...wu\0....H........0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40...130801120000Z..380115120000Z0b1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1!0...U....DigiCert Trusted Root G40.."0....H.............0..........sh..]J<0"0i3..%..!=..Y..).=X.v..{....0....8..V.m...y....._..<R.R....~...W.YUr.h.p..u.js2...D.......t;mq.-... .. .c)-..^N..!a.4...^.[......4@_.zf.w.H.fWW.TX..+.O.0.V..{]..O^.5.1..^......@.y.x...j.8.....7...}...>..p.U.A2...sn..\|!L....u]xf.:1D.3@...ZI...g.'..O9..X..$\F.d..i.v.v=Y]Bv...izH....f.t..K...c....:.=...E%...D.+~....am.3...K...}....!........p,A`..c.D..vb~.....d.3....C....w.....!..T)%.l..RQGt.&..Au.z._.?..A..[..P.1..r."..\|Lu?c.!_. Qko....O..E_. ........~.&...i/..-............B0@0...U.......0....0...U...........0...U..........q]dL..g?....O0....H..............a.}.l.........dh.V.w.p...J...x\.._...)V.6I]Dc...f.#.=y.mk.T..<.C@..P.R..;...ik.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1

Download File

Process:	C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe
File Type:	data
Category:	dropped
Size (bytes):	308
Entropy (8bit):	3.184395242784626
Encrypted:	false
SSDEEP:	3:kkFklQcfllXlE/YXlzX/RDvcalXl+RAIdA31y+NW0y1YboOai2WelVJUTMVDXlVn:kKqzNcalgRAOAUSW0P3PeXJUwh8lmi3Y
MD5:	D2885E991D3984185AEDF3C539B6C335
SHA1:	BEA8843A120C6102295A385AE95581E3A351970E
SHA-256:	C3389E72794625767508CFF592B06DD634433910E2F63F8D2C55DFC55B63AFE1
SHA-512:	17426ACA0C7B6871C3C4BDDFCC4E63F77F610B9808E079CC8EB9EFCA3858C323453D96BE57077B6D9BC40DA77F0C98AA43F5F8D7A02E5FA9B87C52D865EEADCE
Malicious:	false
Reputation:	low
Preview:	p...... ........g.G/ ...(....................................................... ........}.-@@......................h.t.t.p.:././.c.a.c.e.r.t.s...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.G.4.C.o.d.e.S.i.g.n.i.n.g.R.S.A.4.0.9.6.S.H.A.3.8.4.2.0.2.1.C.A.1...c.r.t...".6.0.9.0.3.0.2.2.-.6.b.4."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4

Download File

Process:	C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.0371508354751655
Encrypted:	false
SSDEEP:	6:kK+c5LDcJgjcalgRAOAUSW0PTKDXMOXISKlUp:5LYS4tWOxSW0PAMsZp
MD5:	716856F9CB2BDB927ED69CBD54928E59
SHA1:	6CAE788917A5BCB85AC34D2755954E113C1CCB16
SHA-256:	EE4EEB5E5D7AA9A31D0C59AD5A02F7FAFAF7A0089F9E8F8E543E54330943B076
SHA-512:	488067910FA9956B85D253F5A21D92C87D58851BA49F57AD9779320A9A527E4D7E4207AE3F0321CBA477CDC1CF8ECBD9BEDF25A590F1AC3F2D5D110B19FBAF70
Malicious:	false
Reputation:	low
Preview:	p...... ....l.....f/ ...(....................................................... ............n......................h.t.t.p.:././.c.a.c.e.r.t.s...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.T.r.u.s.t.e.d.R.o.o.t.G.4...c.r.t...".5.a.2.8.6.4.1.7.-.5.9.4."...

C:\Users\user\AppData\Local\Temp\FCTInstall.log

Download File

Process:	C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	857
Entropy (8bit):	4.948897482770105
Encrypted:	false
SSDEEP:	24:/LVYLmLmNLMLOLtudKATrX8uqbSEnPWaKPY:TCLmLmNLMLOLIdKATzVqbSEPWaUY
MD5:	8181CF0001ADC2FA1358CC984B76D2BA
SHA1:	8E299073E95E37802C8A7163AAB95BE859629A0D
SHA-256:	1A77E0AD4A825403C1BF8BAC24E7EA50D813F37592C1004D4C22E72F86487A47
SHA-512:	E3112384629C93157D57FBDF3E7243F9E660AC4E625060DA3AAFCD2BCF73FFC2BCDAA0CDBCF9BB7F6D4690E4B2EB404141578C957FE507FDFCC93637266EA801
Malicious:	false
Reputation:	low
Preview:	Wed Jul 3 05:18:53 2024 - Server list:..Wed Jul 3 05:18:53 2024 - .173.243.138.76 TZ3..Wed Jul 3 05:18:53 2024 - .208.184.237.75 TZ3..Wed Jul 3 05:18:53 2024 - begin download...Wed Jul 3 05:18:53 2024 - downloading server list...Wed Jul 3 05:18:53 2024 - downloading image table, server 173.243.138.76..Wed Jul 3 05:18:54 2024 - Highest available image found: 07004000FIMG03028-00004.00000...Wed Jul 3 05:18:54 2024 - This image is version: 7.4.0...Wed Jul 3 05:18:54 2024 - downloading image 07004000FIMG03028-00004.00000..Wed Jul 3 05:18:54 2024 - downloading image from server: 173.243.138.76..Wed Jul 3 05:20:42 2024 - unpacking downloaded image...Wed Jul 3 05:20:49 2024 - end download...Wed Jul 3 05:20:52 2024 - Installer filename is: FortiClientVPN.exe..Wed Jul 3 05:20:52 2024 - C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe..

C:\Users\user\AppData\Local\Temp\FCT_{625BC4BA-AC3E-4E4B-9996-EEED9D4287C3}\{37F86F81-CEE2-4981-BF24-D0AAFBE74BFB}\FortiClient.msi

Download File

Process:	C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: FortiClient VPN, Author: Fortinet Technologies Inc, Keywords: Installer, Comments: This installer database contains the logic and data required to install FortiClient VPN., Template: x64;1033, Revision Number: {F999948D-39F6-4A38-BD43-BD7510C19B77}, Create Time/Date: Tue Apr 30 23:57:30 2024, Last Saved Time/Date: Tue Apr 30 23:57:30 2024, Number of Pages: 500, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.8.1128.0), Security: 2
Category:	dropped
Size (bytes):	163995648
Entropy (8bit):	7.916524132801799
Encrypted:	false
SSDEEP:	3145728:rNBEkmvtfi4bJ0t+0xwc1AM5+ENJeQ7Ph3fVjYl4PIWW:rNSkmvs4bJ0Uk9AMQWeSh3pjQWW
MD5:	FA9B2F29C47B8C78E8802BCBB429AD8D
SHA1:	927ACE51A73B3BB726CB74153887764B60FC3905
SHA-256:	7A5B2F8095310BF9E393FB46D47A6A37F475794CE195FBB7D0F2EC4B301D76E9
SHA-512:	6DF21A03201487D6B1A46D97645E52E92E0AE540D654D6B3073BD0554B67F138D2C6A04C055A9F4E2C94691AE05C09BC0EBB398F9D4C07C1E66ACC5CC57EF40D
Malicious:	false
Reputation:	low
Preview:	......................>...................(................................................................ ...$...(...,...0...4...8...<...@...D...H...L...P...T...X...\...`...d...h...l...p...t...x...\|..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FCT_{625BC4BA-AC3E-4E4B-9996-EEED9D4287C3}\{37F86F81-CEE2-4981-BF24-D0AAFBE74BFB}\FortiClientInstaller.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2812928
Entropy (8bit):	6.809998338407615
Encrypted:	false
SSDEEP:	49152:urA7P9lj6QcwvwMd9DHyfYzF6PoDLzC3b6KwYpclyfZu:urAr9wQqYFDk
MD5:	7FE438A216894635F875753EC12D40D6
SHA1:	F0330D0920A8B2534832F56F49A188E08615FAAE
SHA-256:	CFF7751167B939EE4EEACB4C101ACBC8E67BF3C6D998DC5FB74A15BE033466D0
SHA-512:	66759294766E3A7CD7EFE35CEA221AF3A15034526EED86C3189F84C03BFDF2D66740B67A23B28D25ECBD54A7568C2904CBCE20D507433F2421A94658D10B1C11
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 5%, Browse
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......x._.<.1.<.1.<.1..$..,.1..$...1..$. .1..G.=.1.)..6.1.).5./.1.).2.&.1..G..;.1.<.1.+.1.(.5...1..88...1.).4.Y.1..G..9.1.<.0.:.1..85.8.1..84.1.1..81.=.1..8.=.1..83.=.1.Rich<.1.........................PE..L....NZf...............%.............B............@...........................+...........@.........................@.&. ...`.&.<.....&..".....................$s..@.%.......................%......,..@.....................%......................text...=........................... ..`.rdata...u.......v..................@..@.data...4....0&..8....&.............@....didat..H.....&......P&.............@....rsrc...."....&..$...T&.............@..@.reloc..$s......t...x).............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FCT_{625BC4BA-AC3E-4E4B-9996-EEED9D4287C3}\{37F86F81-CEE2-4981-BF24-D0AAFBE74BFB}\configuration.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	98
Entropy (8bit):	4.714178217320593
Encrypted:	false
SSDEEP:	3:vFWWMNHU8LdgC4vXMlGDDQIMOokMlGDDQIMOn:TMVBdYUCDQIzMCDQIT
MD5:	EA8A176DBAAA5CC38807513FC8E82F7C
SHA1:	9C07B57CA363CE9CBCEA94DE7FF997B0F1C31C36
SHA-256:	0B9D879350811936414F744CD253F967AF3F64D1636730BB9DAEBBF28238E36C
SHA-512:	EAA2D0C8349FBF8EE27605E66E88D4754FA9A690F75667A17AA6DB6BCC691D794073E13C3FC4F53BE24CF02297C0C3E1675140D8A1D6B5B82E50388E717F05B0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" ?>..<forticlient_configuration>..</forticlient_configuration>

C:\Users\user\AppData\Local\Temp\FCT_{625BC4BA-AC3E-4E4B-9996-EEED9D4287C3}\{37F86F81-CEE2-4981-BF24-D0AAFBE74BFB}\orchestrator.json

Download File

Process:	C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	725
Entropy (8bit):	4.986555138528995
Encrypted:	false
SSDEEP:	12:YcJp85WLoKjGA4fxT1FtNXlzTX4UjPuKmfufLLD9QVw+XLFWg1/jPY575LuLFTXA:YLEjx4d3TBHjPuKOuf3D9Q1XLFWg1/jC
MD5:	C5C17A08C93BC0F19F012DEECDDEE005
SHA1:	9D21AA24672BE8950EFF4761BC70858069724C7C
SHA-256:	84F94B3F08FB26A3F164C9613357C4B40EE49DACEE4E9BB4CE1E144B8C6C9383
SHA-512:	D19AEDC252E6748B60FE5429A2EA23770576E7AA526BF254FCF02EA220A03F1FD19CAFF9BC5DD40A7A3A56492353E9A9F46C3D85DE1931664FEB17F2D3491B87
Malicious:	false
Preview:	{"ems_settings":{"LogPath":"","StartTime":"","ScheduledInstall":false,"Unsupervised":false,"UsersControlReboot":false,"RebootWhenNeeded":true,"AutoReboot0Users":true,"Uninstall":false,"EMSServer":"emserver.fortinet.net","SchId":"","DeviceId":"","EMSFCTConfig":"configuration.xml","vdom":"default","installer_guid":"0"},"FCTMSI":{"Features":[],"LogFile":"FortiClient00000.log","DesktopShortcut":true,"StartMenuShortcut":true,"ProductName":"FortiClient VPN","ProductCode":"{0DC51760-4FB7-41F3-8967-D3DEC9D320EB}","Version":"7.4.0.1658","Filename":"FortiClient.msi"},"KeepCleanroom":false,"FCTConfig":"","FORTIMONITORMSI":{"integrated":true,"ProductName":"","ProductCode":"","Version":"","Filename":"FortiMonitorInstaller.msi"}}

C:\Users\user\AppData\Local\Temp\FortiClient00000.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (500), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	95816
Entropy (8bit):	3.793641374311521
Encrypted:	false
SSDEEP:	1536:wG5yrBfeG4HEYyfECoVWtbVzob+omXl5+oasewO5GUWgWMWgWYuasewO5GUWgWMe:fSSslkzwX
MD5:	24F9BF4DBA753DF8AD025275FF86DFCC
SHA1:	02F5904066037BDC8A55B90DD3F24AE3866EC923
SHA-256:	7CF9BC238DB2F5169D55492FFF2C0838641D5972F0F2C3681AEEB5FACA6425CF
SHA-512:	8CA577D8025AE698AD4013109F0E1B1C5563F9D865AB2BD497F0A9A7CB362F5E583BF9547E40415DEBAF4797156C389E25D31DC9D32E14A4FB6DEDC5EE41AE7C
Malicious:	false
Preview:	..[.S.E.T.U.P.E.X.E. .5.3.5.2.]. . .2.0.2.4.-.0.7.-.0.3. .0.5.:.2.0.:.5.6. . .s.e.t.u.p.e.x.e.:.:.m.s.i._.l.o.g.g.i.n.g.:.:.I.n.i.t.i.a.l.i.s.e.(.).,. .m.y. .v.e.r.s.i.o.n. .i.s. .7...4...0...1.6.5.8.....[.S.E.T.U.P.E.X.E. .5.3.5.2.]. . .2.0.2.4.-.0.7.-.0.3. .0.5.:.2.0.:.5.6. . .s.e.t.u.p.e.x.e.:.:.C.l.e.a.n.r.o.o.m.:.:.C.l.e.a.n.r.o.o.m.....[.S.E.T.U.P.E.X.E. .5.3.5.2.]. . .2.0.2.4.-.0.7.-.0.3. .0.5.:.2.0.:.5.6. . .s.e.t.u.p.e.x.e.:.:.u.t.i.l.s.:.:.G.e.n.e.r.a.t.e.G.u.i.d.....[.S.E.T.U.P.E.X.E. .5.3.5.2.]. . .2.0.2.4.-.0.7.-.0.3. .0.5.:.2.0.:.5.6. . .s.e.t.u.p.e.x.e.:.:.C.l.e.a.n.r.o.o.m.:.:.C.l.e.a.n.r.o.o.m. .=. .C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.F.C.T._.{.6.2.5.B.C.4.B.A.-.A.C.3.E.-.4.E.4.B.-.9.9.9.6.-.E.E.E.D.9.D.4.2.8.7.C.3.}.\.{.3.7.F.8.6.F.8.1.-.C.E.E.2.-.4.9.8.1.-.B.F.2.4.-.D.0.A.A.F.B.E.7.4.B.F.B.}.....[.S.E.T.U.P.E.X.E. .5.3.5.2.]. . .2.0.2.4.-.0.7.-.0.3. .0.5.:.2.0.:.5.6. . .s.e.t.u.p.e.x.e.:.:.C.l.e.a.n.r.o.o.m.:.:.D.e.l.e.t.e.C.l.e.a.n.

C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe

Download File

Process:	C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	176739392
Entropy (8bit):	7.873996762320648
Encrypted:	false
SSDEEP:	3145728:gNBEkmvtfi4bJ0t+0xwc1AM5+ENJeQ7Ph3fVjYl4PIWW/:gNSkmvs4bJ0Uk9AMQWeSh3pjQWW/
MD5:	43866BF1847EFD3BEF65E4D9EF603CA7
SHA1:	0FFD188F983424DF23639FE3F6F824F64241E180
SHA-256:	C38A00AE39F38ADE3B665F947EA38EBA69B761DE9FFAA130B9F6177F164C5658
SHA-512:	9468A30ED40ECC506A8577DCDAFA92BA01C65129893FCDAC6F2DE85C162918A82A24165AEA349492A97F241FCF71BC1D095BF31BD5566AD1C0A3A3C0F7FDE38E
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......)_..m>..m>..m>.....c>.....>.....q>..xA..j>..xA..~>..xA..v>..[...i>..xA..3>... .o>...>.l>...%.d>..m>..z>..yA...<..m>..?..[...$>..[...l>..[...l>..Richm>..................PE..L....OZf...............%.x ..0h......w........ ...@.......................... .......K....@..................................1.P.....-.D.\.............@(...p........).p...................@.).......'.@............. ......$......................text....w ......x ................. ..`.rdata........ ......\| .............@..@.data........P..J...0.............@....rsrc...D.\...-...\..z*.............@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI88FD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8071256
Entropy (8bit):	6.6396644310554604
Encrypted:	false
SSDEEP:	196608:id7MMQBIPmLghZHTzPA+Y2UNGz2LwVI6mb:ideBIPmLqZHTzPA+Y2/2LwV1mb
MD5:	32EFBFFDA3376EE49D78BAFF6BCE3CC5
SHA1:	FB1195E34A9034309D8BF4608B65E205CAC0B930
SHA-256:	F64E2CAD4CDCC53694CA3DBD78B941039064D31EA5892D4DED3A533F0FED627A
SHA-512:	AF22120BB60D0E2394C83059B5D2E68AFB40C0FD02E613515257BC80DD3CF55C6792DF5325CB87AD2046724B24303E6C9E1A3C9EB2219BD776826E03BC738920
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.........?"..Qq..Qq..Qq...q..Qq...q\|.Qq...q..Qq..q..Qq..Tp.Qq..Up..Qq..Rp..Qq..Xp..Qqbo.q..Qqbo.q..Qq..UpA.Qq..Qq..Qqbo.q..Qq..Pq..Qq..Up..Qq..Tp..Qq..Qp..Qq...q..Qq...q..Qq..Sp..QqRich..Qq........PE..d...3LZf.........." ...%..[..........IP.......................................{.......\|...`A........................................ .t.P...p.t.......z......0v.Hn....{.@(....z.....p.m.T.....................m.(...0.m.@.............[.h............................text.....[.......[................. ..`.rdata........[.......[.............@..@.data....^....t.......t.............@....pdata..Hn...0v..p....u.............@..@_RDATA..\.....z......&z.............@..@.rsrc.........z......(z.............@..@.reloc........z......:z.............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI8A46.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8071256
Entropy (8bit):	6.6396644310554604
Encrypted:	false
SSDEEP:	196608:id7MMQBIPmLghZHTzPA+Y2UNGz2LwVI6mb:ideBIPmLqZHTzPA+Y2/2LwV1mb
MD5:	32EFBFFDA3376EE49D78BAFF6BCE3CC5
SHA1:	FB1195E34A9034309D8BF4608B65E205CAC0B930
SHA-256:	F64E2CAD4CDCC53694CA3DBD78B941039064D31EA5892D4DED3A533F0FED627A
SHA-512:	AF22120BB60D0E2394C83059B5D2E68AFB40C0FD02E613515257BC80DD3CF55C6792DF5325CB87AD2046724B24303E6C9E1A3C9EB2219BD776826E03BC738920
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.........?"..Qq..Qq..Qq...q..Qq...q\|.Qq...q..Qq..q..Qq..Tp.Qq..Up..Qq..Rp..Qq..Xp..Qqbo.q..Qqbo.q..Qq..UpA.Qq..Qq..Qqbo.q..Qq..Pq..Qq..Up..Qq..Tp..Qq..Qp..Qq...q..Qq...q..Qq..Sp..QqRich..Qq........PE..d...3LZf.........." ...%..[..........IP.......................................{.......\|...`A........................................ .t.P...p.t.......z......0v.Hn....{.@(....z.....p.m.T.....................m.(...0.m.@.............[.h............................text.....[.......[................. ..`.rdata........[.......[.............@..@.data....^....t.......t.............@....pdata..Hn...0v..p....u.............@..@_RDATA..\.....z......&z.............@..@.rsrc.........z......(z.............@..@.reloc........z......:z.............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI8B12.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8071256
Entropy (8bit):	6.6396644310554604
Encrypted:	false
SSDEEP:	196608:id7MMQBIPmLghZHTzPA+Y2UNGz2LwVI6mb:ideBIPmLqZHTzPA+Y2/2LwV1mb
MD5:	32EFBFFDA3376EE49D78BAFF6BCE3CC5
SHA1:	FB1195E34A9034309D8BF4608B65E205CAC0B930
SHA-256:	F64E2CAD4CDCC53694CA3DBD78B941039064D31EA5892D4DED3A533F0FED627A
SHA-512:	AF22120BB60D0E2394C83059B5D2E68AFB40C0FD02E613515257BC80DD3CF55C6792DF5325CB87AD2046724B24303E6C9E1A3C9EB2219BD776826E03BC738920
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.........?"..Qq..Qq..Qq...q..Qq...q\|.Qq...q..Qq..q..Qq..Tp.Qq..Up..Qq..Rp..Qq..Xp..Qqbo.q..Qqbo.q..Qq..UpA.Qq..Qq..Qqbo.q..Qq..Pq..Qq..Up..Qq..Tp..Qq..Qp..Qq...q..Qq...q..Qq..Sp..QqRich..Qq........PE..d...3LZf.........." ...%..[..........IP.......................................{.......\|...`A........................................ .t.P...p.t.......z......0v.Hn....{.@(....z.....p.m.T.....................m.(...0.m.@.............[.h............................text.....[.......[................. ..`.rdata........[.......[.............@..@.data....^....t.......t.............@....pdata..Hn...0v..p....u.............@..@_RDATA..\.....z......&z.............@..@.rsrc.........z......(z.............@..@.reloc........z......:z.............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI8C1C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8071256
Entropy (8bit):	6.6396644310554604
Encrypted:	false
SSDEEP:	196608:id7MMQBIPmLghZHTzPA+Y2UNGz2LwVI6mb:ideBIPmLqZHTzPA+Y2/2LwV1mb
MD5:	32EFBFFDA3376EE49D78BAFF6BCE3CC5
SHA1:	FB1195E34A9034309D8BF4608B65E205CAC0B930
SHA-256:	F64E2CAD4CDCC53694CA3DBD78B941039064D31EA5892D4DED3A533F0FED627A
SHA-512:	AF22120BB60D0E2394C83059B5D2E68AFB40C0FD02E613515257BC80DD3CF55C6792DF5325CB87AD2046724B24303E6C9E1A3C9EB2219BD776826E03BC738920
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.........?"..Qq..Qq..Qq...q..Qq...q\|.Qq...q..Qq..q..Qq..Tp.Qq..Up..Qq..Rp..Qq..Xp..Qqbo.q..Qqbo.q..Qq..UpA.Qq..Qq..Qqbo.q..Qq..Pq..Qq..Up..Qq..Tp..Qq..Qp..Qq...q..Qq...q..Qq..Sp..QqRich..Qq........PE..d...3LZf.........." ...%..[..........IP.......................................{.......\|...`A........................................ .t.P...p.t.......z......0v.Hn....{.@(....z.....p.m.T.....................m.(...0.m.@.............[.h............................text.....[.......[................. ..`.rdata........[.......[.............@..@.data....^....t.......t.............@....pdata..Hn...0v..p....u.............@..@_RDATA..\.....z......&z.............@..@.rsrc.........z......(z.............@..@.reloc........z......:z.............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Temp\obj_1_a05988

Download File

Process:	C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe
File Type:	data
Category:	dropped
Size (bytes):	154724440
Entropy (8bit):	7.999998823657705
Encrypted:	true
SSDEEP:	3145728:VoCOI/FGuBFom7xkUneQ59ZBJnfD/H47MlANntBP9BRcYEs4x6Nx:jYuBFomFteQ5rfzYm+lf2YEv0z
MD5:	C0DC5687957AC1CB3BCC1A9414940980
SHA1:	6565EEF783C58A59E884DF1232A5CEA6AF49194E
SHA-256:	A3BCCC962218951B007E5B3742D289FFDBC4BB069BFAC2C2EC3CB04C89C82E26
SHA-512:	A1929BBEBC7AEC4C9DE966CD0E2A0650A65A3C254FDC9873303A2D1E9233B7030ABFF0D40AE5387B1BBF0F48D9CE902B7F945C9ABEC5FCF8F1F2606506B436B5
Malicious:	false
Preview:	FIMGFirmware Image......04000240603215728030......8.....0700400000000.......MR4-GA-P0....................................7.h.3.b.@..j....$Re..Q..R...x.Jq.....x[..}......c..C.....]...2I"..V..Qv..Em..'..o.~...S1?\|QUG/T2%+.auh0..C...W_.....S....%..^mC......ALC.]..E..=..Y....L.9...1j..D..t4.+..uN3../^p..C...$.zW..F...5...Un.V...o6..._.Pk9@ ....%...{...L........=Y...\|$vN{.........V=,...4.\|p.:.i....i..U..z..\|iv\|cR.Zo)K..c...aD.}..w....&...!7o.....X4.9..y.x..VP.....;.o...\9p<.....0.i.yS.uq.G.....X..iB...3.M.>.(..,...Q...k..+T._.ys..x...[H. ./.J3...7%.KA.._.A..Fu.r......Gs....iK)...{.?9....?...1./.}5kY.N.7..$D.....5.......3....r....#...XF^4.<.K..G...]....uc...tQL.(..................;....Q..)..^ .M%;5.u...q.,.....r..,7{.%...H....0..S9\|,...i?..Z...<.Yu..>..$..+..?..:).U...{....IXr;.e?q[=F U.^"K..BJ.-.....mQ.:.I......t.........v.G...#.s.. .B.....eM.0Oud...[~..~@.J.#...L......+.;..{...W...7I......8p.1....,..e.Z.r.q..N.7l...:.9)y....\|...A.....-..(........s.....

C:\Users\user\AppData\Local\Temp\obj_1_a05988__unpacked

Download File

Process:	C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1101522
Entropy (8bit):	4.030758515495095
Encrypted:	false
SSDEEP:	3072:rMcwaCPQFBxJ08FUOAB6kHq+bmnhmliVK7Ce0ZmL7KES/AtWz0ZspYfMp+jI9382:7AZbyDO9MdK2
MD5:	2B0BDB593E9900A4F5EE728283F63D7D
SHA1:	7412E34976283D086B247846E756AD2388CF9DDA
SHA-256:	FF2498CD2C9AC62774A6B33EFB0354D6B7A2D1F7FD6CB7AB8ACC6A6771B44744
SHA-512:	8FBE78FC2D78D9075D7D864167142220DABA0A1585246373DA4F23A5B2B8D5B9223427BDC907A1E7B68069F11208AA8D4EBB2A9C4154C19738EAAC9D5A4509D5
Malicious:	false
Preview:	L FAP F432FR FIMG 7.2.3 07002000FIMG05075-00002.00003 MR2-GA-P3.L FAP F432FR FIMG 7.2.4 07002000FIMG05075-00002.00004 MR2-GA-P4.L FAP F432FR FIMG 7.2.5 07002000FIMG05075-00002.00005 MR2-GA-P5.L FAP F432FR FIMG 7.4.1 07004000FIMG05075-00004.00001 MR4-GA-P1.L FAP F432FR FIMG 7.4.2 07004000FIMG05075-00004.00002 MR4-GA-P2.L FAP F432FR FIMG 7.4.3 07004000FIMG05075-00004.00003 MR4-GA-P3.L FAP FAP11C FIMG 5.0.7 05000000FIMG05005-00000.00007 MR0-GA-P07.L FAP FAP11C FIMG 5.0.8 05000000FIMG05005-00000.00008 MR0-GA-P08.L FAP FAP11C FIMG 5.0.9 05000000FIMG05005-00000.00009 MR0-GA-P09.L FAP FAP11C FIMG 5.0.10 05000000FIMG05005-00000.00010 MR0-GA-P10.L FAP FAP11C FIMG 5.2.0 05002000FIMG05005-00002.00000 MR0-GA-P00.L FAP FAP11C FIMG 5.2.2 05002000FIMG05005-00002.00002 MR0-GA-P02.L FAP FAP11C FIMG 5.2.3 05002000FIMG05005-00002.00003 MR0-GA-P03.L FAP FAP11C FIMG 5.2.4 05002000FIMG05005-00002.00004 MR0-GA-P04.L FAP FAP11C FIMG 5.2.6 05002000FIMG05005-00002.00006 MR0-GA-P06.L FAP FAP11C FIMG 5.2.7 050020

C:\Users\user\AppData\Local\Temp\~DFB96228BA219DC387.TMP

Download File

Process:	C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

HeapAlloc, SetConsoleMode, VerSetConditionMask, GetCommandLineW, DecodePointer, CloseHandle, RaiseException, GetLastError, SetLastError, InitializeCriticalSectionEx, DeleteCriticalSection, CreateMutexW, OpenMutexW, GetCurrentProcess, GetCurrentProcessId, OpenProcess, GetSystemDirectoryW, FreeLibrary, GetModuleFileNameW, GetModuleHandleW, GetProcAddress, LoadLibraryExW, LoadResource, SizeofResource, SetDefaultDllDirectories, LocalFree, lstrcmpiW, LoadLibraryW, FindResourceW, SetSearchPathMode, VerifyVersionInfoW, MultiByteToWideChar, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, DeleteFileW, FindClose, FindFirstFileW, FindNextFileW, GetFileAttributesW, SetFileAttributesW, SetEvent, WaitForSingleObject, CreateEventW, TerminateThread, ProcessIdToSessionId, Sleep, CreateThread, GetTickCount, WaitForMultipleObjects, GetTimeZoneInformation, WideCharToMultiByte, GetLocaleInfoW, ExpandEnvironmentStringsW, SetCurrentDirectoryW, GetFullPathNameW, GetTempPathW, CancelIo, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, SetWaitableTimer, CancelWaitableTimer, GetExitCodeProcess, GetCurrentThreadId, CreateProcessW, CreateWaitableTimerW, GetUserDefaultLCID, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, GetEnvironmentVariableW, CreateFileW, GetCurrentDirectoryW, QueryPerformanceCounter, ReadFile, FileTimeToSystemTime, DeviceIoControl, GetVersionExW, ReleaseMutex, OutputDebugStringW, ResetEvent, GetOverlappedResult, FlushFileBuffers, GetLongPathNameW, K32EnumProcesses, GetWindowsDirectoryW, GetVolumeInformationW, SetThreadLocale, GetUserDefaultUILanguage, GetACP, SetNamedPipeHandleState, WriteFile, WaitNamedPipeW, TlsSetValue, GetFileAttributesExW, TlsAlloc, TlsGetValue, GetDriveTypeW, QueryDosDeviceW, GetLogicalDrives, FindFirstVolumeMountPointW, FindFirstVolumeW, HeapFree, FindVolumeMountPointClose, TerminateProcess, K32GetModuleFileNameExW, GetVolumePathNameW, HeapSize, GetVolumeNameForVolumeMountPointW, FindNextVolumeMountPointW, HeapReAlloc, ReadConsoleA, FindVolumeClose, GetProcessHeap, FindNextVolumeW, GetSystemDirectoryA, GetLocalTime, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsProcessorFeaturePresent, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, IsDebuggerPresent, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, EncodePointer, InterlockedPopEntrySList, InterlockedPushEntrySList, FlushInstructionCache, VirtualAlloc, VirtualFree, GetSystemTime, SystemTimeToFileTime, GlobalMemoryStatus, FormatMessageA, GetStringTypeW, CreateDirectoryW, FindFirstFileExW, SetFileInformationByHandle, AreFileApisANSI, MoveFileExW, GetFileInformationByHandleEx, GetLocaleInfoEx, LCMapStringEx, InitializeSRWLock, GetCPInfo, RtlUnwind, InitializeCriticalSectionAndSpinCount, TlsFree, GetFileType, PeekNamedPipe, SystemTimeToTzSpecificLocalTime, ExitProcess, GetModuleHandleExW, GetStdHandle, SetFilePointerEx, GetConsoleMode, ReadConsoleW, GetConsoleCP, GetDateFormatW, GetTimeFormatW, CompareStringW, LCMapStringW, IsValidLocale, EnumSystemLocalesW, SetStdHandle, SetEndOfFile, IsValidCodePage, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetConsoleCtrlHandler, WaitForSingleObjectEx, WriteConsoleW, ReleaseSRWLockShared, AcquireSRWLockShared, LoadLibraryA

ncrypt.dll

BCryptGenRandom

Exports

Name	Ordinal	Address
BeginHttpRequest	1	0x467270
BeginHttpResponse	2	0x467300
FCP_add_param	3	0x4643e0
FCP_append_objdata_ff	4	0x464430
FCP_break_obj_header	5	0x464780
FCP_breakup_data_item	6	0x464880
FCP_calculate_obj_head_chksum	7	0x466720
FCP_chk_partial_obj_files	8	0x464900
FCP_cleanup	9	0x464b90
FCP_clear_object_storage	10	0x464ba0
FCP_clear_package	11	0x464c20
FCP_clear_params	12	0x464c90
FCP_clear_request	13	0x464cd0
FCP_clear_response	14	0x464d30
FCP_combine_params	15	0x464da0
FCP_create_package_hdr	16	0x466750
FCP_del_param	17	0x464ef0
FCP_delete_file	18	0x464f30
FCP_get_file_size	19	0x464f60
FCP_get_obj_resume_info	20	0x464fb0
FCP_get_object_desc	21	0x465160
FCP_get_param	22	0x4651a0
FCP_init_object_storage	23	0x4651e0
FCP_init_package	24	0x465210
FCP_init_params	25	0x465250
FCP_init_request	26	0x465280
FCP_init_request_for_sending	27	0x4652b0
FCP_init_response	28	0x465340
FCP_init_response_for_sending	29	0x465360
FCP_initialize	30	0x4653f0
FCP_load_object	31	0x465400
FCP_load_package	32	0x4654f0
FCP_pack_obj	33	0x466820
FCP_parse_params	34	0x465ad0
FCP_recv_request	35	0x465bf0
FCP_recv_response	36	0x465d90
FCP_send_n_recv	37	0x465f30
FCP_send_object	38	0x465f70
FCP_send_request	39	0x4660a0
FCP_send_response	40	0x4660d0
FCP_set_param	41	0x466100
FCP_unpack_obj	42	0x466a50
FCP_unpack_obj_ff	43	0x466cd0
FCP_unpack_obj_fnfn	44	0x466f60
FCP_verify_object_hdr	45	0x467010
FCP_verify_package_hdr	46	0x467050
FR_cleanup	47	0x4673e0
FR_close	48	0x467400
FR_connect	49	0x467420
FR_connected	50	0x467430
FR_get_local_addr	51	0x467450
FR_initialize	52	0x4674a0
FR_read	53	0x467500
FR_write	54	0x467520

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan
Czech	Czech Republic
Danish	Denmark
German	Germany
English	United States
Finnish	Finland
French	France
Hungarian	Hungary
Japanese	Japan
Korean	North Korea
Korean	South Korea
Norwegian	Norway
Portuguese	Brazil
Russian	Russia
Slovak	Slovakia
Estonian	Estonia
Latvian	Lativa
Lithuanian	Lithuania
Chinese	China
French	Canada

Target ID:	0
Start time:	04:06:27
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FortiClientVPNOnlineInstaller.exe"
Imagebase:	0x3a0000
File size:	2'794'560 bytes
MD5 hash:	11BFC265FC53AC4756E4EF2759CA10EB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	04:08:30
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe
Imagebase:	0x30000
File size:	176'739'392 bytes
MD5 hash:	43866BF1847EFD3BEF65E4D9EF603CA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	04:08:40
Start date:	03/07/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff66f7e0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	04:08:41
Start date:	03/07/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\MsiExec.exe -Embedding 451EC6BB5F916B7CCFDA9FD6E2C98FE7 C
Imagebase:	0x7ff66f7e0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
173.243.138.76	https://filestore.fortinet.com/forticlient/FortiClientVPNOnlineInstaller.exe	Get hash	malicious	Unknown	Browse	173.243.138.76/fdsupdate
192.229.221.95	http://wavebrowser.co	Get hash	malicious	Unknown	Browse
	AnyDesk_new_Soft.exe	Get hash	malicious	EICAR	Browse
	https://echange.netapi.fr/f.php?h=0ocaYd0R&d=1	Get hash	malicious	Unknown	Browse
	smartsscreen.exe	Get hash	malicious	Xmrig	Browse
	SecuriteInfo.com.Program.Unwanted.5510.19662.8210.exe	Get hash	malicious	Unknown	Browse
	http://www.torproject.org	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Win32.PWSX-gen.28315.7841.exe	Get hash	malicious	Amadey, Fabookie, Mystic Stealer, RedLine, SmokeLoader, Xmrig	Browse
	SecuriteInfo.com.Trojan.Inject4.61510.5025.30434.exe	Get hash	malicious	Amadey, Fabookie, Healer AV Disabler, Mystic Stealer, RedLine, SmokeLoader, Xmrig	Browse
	SecuriteInfo.com.Win32.DropperX-gen.26839.16803.exe	Get hash	malicious	Amadey, Glupteba, Mystic Stealer, RedLine, SmokeLoader, Xmrig	Browse
	D8dw2h4OaE.exe	Get hash	malicious	FormBook, NSISDropper	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FORTINETUS	https://caterwauling-nine-menu.glitch.me/#ZXF1aXRhYmxlcy5yZWdpb24uaWxlZGVmcmFuY2VAaWxlZGVmcmFuY2UuZnI=	Get hash	malicious	HTMLPhisher	Browse	208.91.114.103
	https://0ma1l.cc/os44u09/erds6io.html#elsa.cohen@iledefrance.fr	Get hash	malicious	HTMLPhisher	Browse	208.91.114.103
	https://arrow-amenable-gardenia.glitch.me/#ZWxzYS5jb2hlbkBpbGVkZWZyYW5jZS5mcg==	Get hash	malicious	HTMLPhisher	Browse	208.91.114.103
	https://silk-proximal-fortnight.glitch.me#a2V2aW4ucm9sbGVyQHNhaWMuY29t	Get hash	malicious	HTMLPhisher	Browse	208.91.114.103
	http://bafybeibzkqukq26eelwvcna2gnl2nhxhlbrizj6s7rupo7bqimxp7chice.ipfs.dweb.link/	Get hash	malicious	Unknown	Browse	208.91.114.103
	https://cloudflare-ipfs.com/ipfs/QmWhG4PY6RXe5T7UakJVFDfTnjN6pte6LhpzoEmpDK7232#drusso@he-equipment.com	Get hash	malicious	Unknown	Browse	208.91.114.103
	https://filestore.fortinet.com/forticlient/FortiClientVPNOnlineInstaller.exe	Get hash	malicious	Unknown	Browse	173.243.138.76
	https://clt1655579.benchurl.com/c/l?u=10B4123B&e=1794C08&c=19431B&t=1&l=E898EDFF&email=%2F9eKHwQD1yGPbZtwsY9UUTdy4FBCAQYZF2MDYoOuwyzrxzdkiCva1w%3D%3D&seq=1#aW5rZW4ubGFzYXJAZGlnaXRhbDE0LmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	208.91.114.103
	https://cloudflare-ipfs.com/ipfs/bafybeigh33xrahgcasatwjitlon4jt2edh57zvscbmnhlgwtg3vxtsdbqy/GM.html#rentals@steinborn.com	Get hash	malicious	HTMLPhisher	Browse	208.91.114.103
	9e4ca156.html	Get hash	malicious	Unknown	Browse	208.91.114.120
EDGECASTUS	https://www.itanhangasaude.com.br/www/1475312998d8aKqdmPdPNJZi4JNq7WIowwvYGOvuIT___714820ufgtMx5cBwKyVuzlJn3VAYy1QdJUF0IuhCb1EFSueBwxxR9n7T4VNMSyrZd9kcF9rD67v2lJn3VufgtMP8xfiVl9n3IuhCbR9n7Tx5cBw4VNMSx5cBwi3vtsVl9n3MryfS1EFSuufgtMi3vts7O1AR408519___47741237d8aKqdmPdPNJZi4JNq7WIowwvYGOvuIT	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	http://url2530.tvsmotor.com/ls/click?upn=u001.smInq0-2BkNc5oRshkzMLE7U6zcio2-2F9zwu1ZIXUanV0NJI-2BOrcqj0f4SCu-2B-2BWZYRJ5WulbQ5i5mBsK1zXEak-2FiMRG64aR-2FUGiDgoHteplEfqii9y-2FZm8OviJTU1sjmz7jpaYlxIO-2FZqsCEMZLobIAuBKqKOl6jqYqSAHVwBkUZuGRzhvuesvLIb-2BOJaFEug0CnemcJJ-2FkU8Glr1M3HQvGDXPIOyf8nkQbVJt7YovOZkAEhuJOuEH4Ph5MiX9jsYgicGN-2FPvxMb8qP3PNxydat9K4xALqN5Q554s0jqmG18yyE0AoEP3aqsetKiEetfLRlyIoY9Go3GDyKCGByc1bkwA-3D-3D_hiB_k8wtFa9etD1KMa1MmHXW-2FwYg06wo9cWiDvHqiPmYOGRytNUZst79UpJomtryxKKrh0AV18bTw1Uxa1j3-2B-2BWgpNF6-2FluKqUVQIq65eqgwBcBWQ5CQR9M5cCIHc1cOAH-2BE24H4P7fEAYeqsitSa9ibB8GYFVo8FSHDcQGWJdcDhc6qRVYNNoOHnXmlwvjC9umLA7lBgfKuIFPk0wTmv1npRA3-2BeNSYEECh53hnx2Ya-2Bv8-3D	Get hash	malicious	HTMLPhisher	Browse	93.184.221.165
	https://maknastudio.com/pkyos	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://www.getaround.co.il/wp-logs/?r=mag372@norauto.es	Get hash	malicious	HTMLPhisher	Browse	192.229.233.55
	https://swans-muffin-1id4964-7304421.netlify.app/form	Get hash	malicious	Unknown	Browse	93.184.221.165
	https://reg1a-g4ad23-269fe50-lqng5s.netlify.app/dev.html/	Get hash	malicious	Unknown	Browse	93.184.221.165
	https://hr.economictimes.indiatimes.com/etl.php?url=https://hr.economictimes.indiatimes.com/etl.php?url=//dolar2go.com/new/auth//klqsxqvkkosgj/%2F/ZG9uYWxkLmRvbm92YW5AbWJ1LmVkdQ==	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://hr.economictimes.indiatimes.com/etl.php?url=https://hr.economictimes.indiatimes.com/etl.php?url=//littlelassies.com/ejk/xlpd//j40gstqcualqm/%2F/ZG9uYWxkLmRvbm92YW5AbWJ1LmVkdQ==	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	https://azotictechnologies953-my.sharepoint.com/:o:/g/personal/marilyn_hall_azotictechnologies_com/Eg8tk_4KvvpMk4ZCAagCmggBx_QeawKvcBXzwvKltGQxKw?e=5%3adBgRX2&at=9	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	The Siedenburg Group #24-051-553861 Project.pdf	Get hash	malicious	Unknown	Browse	93.184.221.240

Entrypoint:	0x46fd60
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x665A4EA6 [Fri May 31 22:26:46 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	8546df8fe77bb35f303e775ee2f6749d

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	07/06/2021 02:00:00 10/07/2024 01:59:59
Subject Chain	CN=Fortinet Technologies (Canada) ULC, O=Fortinet Technologies (Canada) ULC, L=Burnaby, S=British Columbia, C=CA
Version:	3
Thumbprint MD5:	0FC41099213427CBB151F9BCEB0999A3
Thumbprint SHA-1:	0F38EA0AA959EA336C743AE18DC9E60A4FD58665
Thumbprint SHA-256:	2946B2BB26811170F8E10F1643DDC020888162D9F53073100FE5A408872285EE
Serial:	0862DFFEC6E9332BFA93B2F187863642

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x25a3b0	0x624	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25a9d4	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x266000	0x322b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x2a7c00	0x2840	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x299000	0x16f00	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x255b70	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x255bc0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1cd9c0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1c6000	0x2e4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x259078	0x200	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1c4b3d	0x1c4c00	85e33bccdac310f838264e52d28b68e9	False	0.5347609875414135	data	6.849650084467638	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1c6000	0x95b26	0x95c00	ab4b7255f1c23c04cd3d63f0e29f609e	False	0.4219418431761269	data	5.71713508827871	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x25c000	0x8ed4	0x3800	7bc30ec1eaef94b2203f91cfaab74ea1	False	0.44949776785714285	data	5.349235142741649	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didat	0x265000	0x324	0x400	2d2ef5bd2488de55716af6f9fa7a53c6	False	0.435546875	data	4.0906763099531975	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x266000	0x322b8	0x32400	ae51569bf38c41b033d3a2014f16b88f	False	0.6108714241293532	data	6.523864682017585	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x299000	0x16f00	0x17000	9f972e86388fc3b833d2048a1a3d850c	False	0.5941745923913043	data	6.6361861676436185	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
REGISTRY	0x26bbc8	0xc3	ASCII text, with CRLF line terminators			0.6512820512820513
RT_ICON	0x26c178	0x3d9	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced			1.0111675126903554
RT_ICON	0x26c558	0x725	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced			1.0060142154182614
RT_ICON	0x26cc80	0xb07	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced			1.003896563939072
RT_ICON	0x26d788	0x14e3	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced			1.002057228352347
RT_ICON	0x26ec70	0x1fac	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced			1.0013566847557966
RT_ICON	0x270c20	0x3877	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced			1.0007609823590453
RT_ICON	0x274498	0x554b	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced			1.0007327684909548
RT_ICON	0x2799e8	0xac4d	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9978915867510032
RT_ICON	0x2846b0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640			0.2647849462365591
RT_MENU	0x2679f8	0x22	Matlab v4 mat-file (little endian) \326S\210m\337\216\324\232GS\032}, numeric, rows 7143568, columns 6881377, imaginary	Chinese	Taiwan	1.1764705882352942
RT_MENU	0x269030	0x52	Matlab v4 mat-file (little endian) S, numeric, rows 7143568, columns 6881377, imaginary	Czech	Czech Republic	0.8658536585365854
RT_MENU	0x26b3a0	0x4c	Matlab v4 mat-file (little endian) A, numeric, rows 7143568, columns 6881377, imaginary	Danish	Denmark	0.881578947368421
RT_MENU	0x2687d8	0x48	Matlab v4 mat-file (little endian) S, numeric, rows 7143568, columns 6881377, imaginary	German	Germany	0.8888888888888888
RT_MENU	0x2674a8	0x42	Matlab v4 mat-file (little endian) C, numeric, rows 7143568, columns 6881377, imaginary	English	United States	0.9090909090909091
RT_MENU	0x26afc8	0x4a	Matlab v4 mat-file (little endian) P, numeric, rows 7143568, columns 6881377, imaginary	Finnish	Finland	0.8918918918918919
RT_MENU	0x268398	0x5a	Matlab v4 mat-file (little endian) A, numeric, rows 7143568, columns 6881377, imaginary	French	France	0.8111111111111111
RT_MENU	0x26a010	0x52	Matlab v4 mat-file (little endian) S, numeric, rows 7143568, columns 6881377, imaginary	Hungarian	Hungary	0.8902439024390244
RT_MENU	0x267fa8	0x30	Matlab v4 mat-file (little endian) \2750\3250\3100\2460\2470\2420\364f\260e\2550\3430\3630\2730\3530, numeric, rows 7143568, columns 6881377, imaginary	Japanese	Japan	1.1458333333333333
RT_MENU	0x267ce0	0x30	Matlab v4 mat-file (little endian) \214\301\004\325\270\322\350\306\264\305 , numeric, rows 7143568, columns 6881377, imaginary	Korean	North Korea	1.1458333333333333
RT_MENU	0x267ce0	0x30	Matlab v4 mat-file (little endian) \214\301\004\325\270\322\350\306\264\305 , numeric, rows 7143568, columns 6881377, imaginary	Korean	South Korea	1.1458333333333333
RT_MENU	0x26b758	0x50	Matlab v4 mat-file (little endian) A, numeric, rows 7143568, columns 6881377, imaginary	Norwegian	Norway	0.8625
RT_MENU	0x269860	0x5a	Matlab v4 mat-file (little endian) C, numeric, rows 7143568, columns 6881377, imaginary	Portuguese	Brazil	0.8222222222222222
RT_MENU	0x269c80	0x42	data	Russian	Russia	0.9393939393939394
RT_MENU	0x269448	0x54	Matlab v4 mat-file (little endian) S, numeric, rows 7143568, columns 6881377, imaginary	Slovak	Slovakia	0.9047619047619048
RT_MENU	0x26a3e8	0x4e	Matlab v4 mat-file (little endian) K, numeric, rows 7143568, columns 6881377, imaginary	Estonian	Estonia	0.8076923076923077
RT_MENU	0x26a7c0	0x60	Matlab v4 mat-file (little endian) A, numeric, rows 7143568, columns 6881377, imaginary	Latvian	Lativa	0.8020833333333334
RT_MENU	0x26abd8	0x66	Matlab v4 mat-file (little endian) A, numeric, rows 7143568, columns 6881377, imaginary	Lithuanian	Lithuania	0.7941176470588235
RT_MENU	0x267760	0x22	Matlab v4 mat-file (little endian) \326S\210mo\217\366NGS\247~, numeric, rows 7143568, columns 6881377, imaginary	Chinese	China	1.1470588235294117
RT_MENU	0x268c08	0x5a	Matlab v4 mat-file (little endian) C, numeric, rows 7143568, columns 6881377, imaginary			0.8444444444444444
RT_MENU	0x26bb68	0x5a	Matlab v4 mat-file (little endian) A, numeric, rows 7143568, columns 6881377, imaginary	French	Canada	0.8111111111111111
RT_DIALOG	0x267788	0x100	data	Chinese	Taiwan	0.7109375
RT_DIALOG	0x268c68	0x11c	data	Czech	Czech Republic	0.6936619718309859
RT_DIALOG	0x26b018	0x128	data	Danish	Denmark	0.6587837837837838
RT_DIALOG	0x2683f8	0x12e	data	German	Germany	0.6423841059602649
RT_DIALOG	0x267110	0x110	data	English	United States	0.6617647058823529
RT_DIALOG	0x26ac40	0x11e	data	Finnish	Finland	0.6783216783216783
RT_DIALOG	0x267fd8	0x112	data	French	France	0.6788321167883211
RT_DIALOG	0x269cc8	0x10e	data	Hungarian	Hungary	0.7111111111111111
RT_DIALOG	0x267d10	0xf8	data	Japanese	Japan	0.7620967741935484
RT_DIALOG	0x267a20	0xf4	data	Korean	North Korea	0.7622950819672131
RT_DIALOG	0x267a20	0xf4	data	Korean	South Korea	0.7622950819672131
RT_DIALOG	0x26b3f0	0x128	data	Norwegian	Norway	0.6351351351351351
RT_DIALOG	0x2694a0	0x11a	data	Portuguese	Brazil	0.6595744680851063
RT_DIALOG	0x2698c0	0x114	data	Russian	Russia	0.6884057971014492
RT_DIALOG	0x269088	0x11e	data	Slovak	Slovakia	0.6888111888111889
RT_DIALOG	0x26a068	0x114	data	Estonian	Estonia	0.6666666666666666
RT_DIALOG	0x26a438	0x114	data	Latvian	Lativa	0.6702898550724637
RT_DIALOG	0x26a820	0x126	data	Lithuanian	Lithuania	0.6462585034013606
RT_DIALOG	0x2674f0	0x100	data	Chinese	China	0.71484375
RT_DIALOG	0x268820	0x122	data			0.6620689655172414
RT_DIALOG	0x26b7a8	0x112	data	French	Canada	0.6788321167883211
RT_DIALOG	0x267888	0x16c	data	Chinese	Taiwan	0.6868131868131868
RT_DIALOG	0x268d88	0x2a2	data	Czech	Czech Republic	0.5341246290801187
RT_DIALOG	0x26b140	0x25e	data	Danish	Denmark	0.504950495049505
RT_DIALOG	0x268528	0x2b0	data	German	Germany	0.48691860465116277
RT_DIALOG	0x267220	0x282	data	English	United States	0.48442367601246106
RT_DIALOG	0x26ad60	0x264	data	Finnish	Finland	0.5179738562091504
RT_DIALOG	0x2680f0	0x2a6	data	French	France	0.48672566371681414
RT_DIALOG	0x269dd8	0x238	data	Hungarian	Hungary	0.5264084507042254
RT_DIALOG	0x267e08	0x19c	data	Japanese	Japan	0.6601941747572816
RT_DIALOG	0x267b18	0x1c2	data	Korean	North Korea	0.6711111111111111
RT_DIALOG	0x267b18	0x1c2	data	Korean	South Korea	0.6711111111111111
RT_DIALOG	0x26b518	0x240	data	Norwegian	Norway	0.5260416666666666
RT_DIALOG	0x2695c0	0x29e	data	Portuguese	Brazil	0.48059701492537316
RT_DIALOG	0x2699d8	0x2a6	data	Russian	Russia	0.4911504424778761
RT_DIALOG	0x2691a8	0x2a0	data	Slovak	Slovakia	0.5267857142857143
RT_DIALOG	0x26a180	0x268	data	Estonian	Estonia	0.5081168831168831
RT_DIALOG	0x26a550	0x26e	data	Latvian	Lativa	0.5016077170418006
RT_DIALOG	0x26a948	0x28e	data	Lithuanian	Lithuania	0.48623853211009177
RT_DIALOG	0x2675f0	0x170	data	Chinese	China	0.6766304347826086
RT_DIALOG	0x268948	0x2ba	data			0.4584527220630373
RT_DIALOG	0x26b8c0	0x2a6	data	French	Canada	0.48672566371681414
RT_STRING	0x286110	0x10c	data	Chinese	Taiwan	0.7873134328358209
RT_STRING	0x28b420	0x262	data	Czech	Czech Republic	0.4967213114754098
RT_STRING	0x294d28	0x2b0	data	Danish	Denmark	0.4055232558139535
RT_STRING	0x288ef8	0x30c	data	German	Germany	0.4153846153846154
RT_STRING	0x2849b0	0x26a	data	English	United States	0.42718446601941745
RT_STRING	0x293ba0	0x2b6	data	Finnish	Finland	0.4438040345821326
RT_STRING	0x287c88	0x2f0	data	French	France	0.4162234042553192
RT_STRING	0x28f700	0x2ac	data	Hungarian	Hungary	0.4853801169590643
RT_STRING	0x287238	0x196	data	Japanese	Japan	0.6059113300492611
RT_STRING	0x286850	0x172	data	Korean	North Korea	0.7216216216216216
RT_STRING	0x286850	0x172	data	Korean	South Korea	0.7216216216216216
RT_STRING	0x295eb8	0x288	data	Norwegian	Norway	0.43364197530864196
RT_STRING	0x28d4f8	0x2ce	data	Portuguese	Brazil	0.41225626740947074
RT_STRING	0x28e6a0	0x25e	data	Russian	Russia	0.5181518151815182
RT_STRING	0x28c420	0x28e	data	Slovak	Slovakia	0.4847094801223242
RT_STRING	0x290810	0x2a2	data	Estonian	Estonia	0.4406528189910979
RT_STRING	0x291920	0x26a	data	Latvian	Lativa	0.45307443365695793
RT_STRING	0x292a28	0x26e	data	Lithuanian	Lithuania	0.4533762057877814
RT_STRING	0x2859e8	0x108	data	Chinese	China	0.7727272727272727
RT_STRING	0x28a1d8	0x2e4	data			0.40945945945945944
RT_STRING	0x297048	0x2f0	data	French	Canada	0.4162234042553192
RT_STRING	0x286410	0x14a	data	Chinese	Taiwan	0.696969696969697
RT_STRING	0x28b958	0x34c	data	Czech	Czech Republic	0.40639810426540285
RT_STRING	0x295318	0x3ac	data	Danish	Denmark	0.3553191489361702
RT_STRING	0x289578	0x3c6	data	German	Germany	0.3944099378881988
RT_STRING	0x284ef0	0x354	data	English	United States	0.3673708920187793
RT_STRING	0x294168	0x35a	data	Finnish	Finland	0.38578088578088576
RT_STRING	0x2882d0	0x3d6	data	French	France	0.36761710794297353
RT_STRING	0x28fca8	0x3b2	data	Hungarian	Hungary	0.4143763213530655
RT_STRING	0x287570	0x228	data	Japanese	Japan	0.5507246376811594
RT_STRING	0x286bc0	0x1bc	data	Korean	North Korea	0.6036036036036037
RT_STRING	0x286bc0	0x1bc	data	Korean	South Korea	0.6036036036036037
RT_STRING	0x296490	0x362	data	Norwegian	Norway	0.3891454965357968
RT_STRING	0x28dae8	0x3a8	data	Portuguese	Brazil	0.3888888888888889
RT_STRING	0x28ebf8	0x362	data	Russian	Russia	0.4214780600461894
RT_STRING	0x28c9b8	0x356	data	Slovak	Slovakia	0.4203747072599532
RT_STRING	0x290d88	0x3c2	data	Estonian	Estonia	0.35550935550935553
RT_STRING	0x291e98	0x366	data	Latvian	Lativa	0.4057471264367816
RT_STRING	0x292f90	0x36a	data	Lithuanian	Lithuania	0.41533180778032036
RT_STRING	0x285ce0	0x14c	data	Chinese	China	0.6897590361445783
RT_STRING	0x28a7d0	0x39a	data			0.36984815618221256
RT_STRING	0x297690	0x3d6	data	French	Canada	0.36761710794297353
RT_STRING	0x286560	0x2ea	data	Chinese	Taiwan	0.5294906166219839
RT_STRING	0x28bca8	0x776	data	Czech	Czech Republic	0.3261780104712042
RT_STRING	0x2956c8	0x7f0	data	Danish	Denmark	0.2780511811023622
RT_STRING	0x289940	0x896	data	German	Germany	0.26524112829845314
RT_STRING	0x285248	0x79c	data	English	United States	0.27618069815195073
RT_STRING	0x2944c8	0x85e	data	Finnish	Finland	0.2913165266106443
RT_STRING	0x2886a8	0x84a	data	French	France	0.2822808671065033
RT_STRING	0x290060	0x7ae	data	Hungarian	Hungary	0.31841302136317395
RT_STRING	0x287798	0x4ea	data	Japanese	Japan	0.41971383147853736
RT_STRING	0x286d80	0x4b4	data	Korean	North Korea	0.48588039867109634
RT_STRING	0x286d80	0x4b4	data	Korean	South Korea	0.48588039867109634
RT_STRING	0x2967f8	0x850	data	Norwegian	Norway	0.25798872180451127
RT_STRING	0x28de90	0x810	data	Portuguese	Brazil	0.2916666666666667
RT_STRING	0x28ef60	0x79c	data	Russian	Russia	0.3203285420944558
RT_STRING	0x28cd10	0x7e2	data	Slovak	Slovakia	0.313181367690783
RT_STRING	0x291150	0x7d0	data	Estonian	Estonia	0.2765
RT_STRING	0x292200	0x824	data	Latvian	Lativa	0.30038387715930903
RT_STRING	0x293300	0x8a0	data	Lithuanian	Lithuania	0.291213768115942
RT_STRING	0x285e30	0x2e0	data	Chinese	China	0.529891304347826
RT_STRING	0x28ab70	0x8aa	data			0.2799819657348963
RT_STRING	0x297a68	0x850	data	French	Canada	0.28289473684210525
RT_STRING	0x286220	0x1f0	data	Chinese	Taiwan	0.6290322580645161
RT_STRING	0x28b688	0x2cc	data	Czech	Czech Republic	0.46787709497206703
RT_STRING	0x294fd8	0x340	data	Danish	Denmark	0.390625
RT_STRING	0x289208	0x36a	data	German	Germany	0.40274599542334094
RT_STRING	0x284c20	0x2cc	data	English	United States	0.41480446927374304
RT_STRING	0x293e58	0x30c	data	Finnish	Finland	0.42948717948717946
RT_STRING	0x287f78	0x354	data	French	France	0.41431924882629106
RT_STRING	0x28f9b0	0x2f8	data	Hungarian	Hungary	0.4644736842105263
RT_STRING	0x2873d0	0x19a	data	Japanese	Japan	0.6292682926829268
RT_STRING	0x2869c8	0x1f4	data	Korean	North Korea	0.702
RT_STRING	0x2869c8	0x1f4	data	Korean	South Korea	0.702
RT_STRING	0x296140	0x34a	data	Norwegian	Norway	0.3919239904988123
RT_STRING	0x28d7c8	0x31c	data	Portuguese	Brazil	0.42085427135678394
RT_STRING	0x28e900	0x2f6	data	Russian	Russia	0.45910290237467016
RT_STRING	0x28c6b0	0x306	data	Slovak	Slovakia	0.4483204134366925
RT_STRING	0x290ab8	0x2d0	data	Estonian	Estonia	0.42777777777777776
RT_STRING	0x291b90	0x306	data	Latvian	Lativa	0.4160206718346253
RT_STRING	0x292c98	0x2f2	data	Lithuanian	Lithuania	0.4403183023872679
RT_STRING	0x285af0	0x1ea	data	Chinese	China	0.6224489795918368
RT_STRING	0x28a4c0	0x30e	data			0.40281329923273657
RT_STRING	0x297338	0x354	data	French	Canada	0.41431924882629106
RT_GROUP_ICON	0x284638	0x76	data			0.7372881355932204
RT_GROUP_ICON	0x284998	0x14	data			1.25
RT_MANIFEST	0x26bc90	0x4e3	XML 1.0 document, ASCII text, with CRLF line terminators			0.4580335731414868

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FortiClientVPNOnlineInstaller.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Applications\Cache\{0DC51760-4FB7-41F3-8967-D3DEC9D320EB}\7.4.0.1658\FortiClient.msi

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C56C4404C4DEF0DC88E5FCD9F09CB2F1

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2E248BEDDBB2D85122423C41028BFD4

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C56C4404C4DEF0DC88E5FCD9F09CB2F1

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2E248BEDDBB2D85122423C41028BFD4

C:\Users\user\AppData\Local\Temp\FCTInstall.log

C:\Users\user\AppData\Local\Temp\FCT_{625BC4BA-AC3E-4E4B-9996-EEED9D4287C3}\{37F86F81-CEE2-4981-BF24-D0AAFBE74BFB}\FortiClient.msi

C:\Users\user\AppData\Local\Temp\FCT_{625BC4BA-AC3E-4E4B-9996-EEED9D4287C3}\{37F86F81-CEE2-4981-BF24-D0AAFBE74BFB}\FortiClientInstaller.exe

C:\Users\user\AppData\Local\Temp\FCT_{625BC4BA-AC3E-4E4B-9996-EEED9D4287C3}\{37F86F81-CEE2-4981-BF24-D0AAFBE74BFB}\configuration.xml

C:\Users\user\AppData\Local\Temp\FCT_{625BC4BA-AC3E-4E4B-9996-EEED9D4287C3}\{37F86F81-CEE2-4981-BF24-D0AAFBE74BFB}\orchestrator.json

C:\Users\user\AppData\Local\Temp\FortiClient00000.log

C:\Users\user\AppData\Local\Temp\FortiClientVPN.exe

C:\Users\user\AppData\Local\Temp\MSI88FD.tmp

C:\Users\user\AppData\Local\Temp\MSI8A46.tmp

C:\Users\user\AppData\Local\Temp\MSI8B12.tmp

C:\Users\user\AppData\Local\Temp\MSI8C1C.tmp

C:\Users\user\AppData\Local\Temp\obj_1_a05988

C:\Users\user\AppData\Local\Temp\obj_1_a05988__unpacked

C:\Users\user\AppData\Local\Temp\~DFB96228BA219DC387.TMP

Static File Info

General

File Icon

Static PE Info

Windows Analysis Report
FortiClientVPNOnlineInstaller.exe