Windows Analysis Report
GlobalProtect64.msi

Bitcoin Miner

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION PanGPA.exe
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION PanGPA.exe

Compliance

Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_JAPANESE.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_SPANISH.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\bmp00001.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaresource.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\ConnectedInternal.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Lato-Regular.ttf
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_GERMAN.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.inf
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.cat
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHip.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\tray_busy.ico
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.inf
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\bitmap1.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPSupport.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.cat
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.ico
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\license.cfg
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PsvCtrl.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\WdfCoinstaller01011.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.sys
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\wa_3rd_party_host_32.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\ConnectedNone.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\uninstall.ico
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\wa_3rd_party_host_64.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\ConnectedFail.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaheap.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_CHINESE_TRADITIONAL.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\gp-public.pem
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwalocal.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.sys
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\bitmap2.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHipMp.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\close1.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwautils.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Connecting.avi
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanVcrediChecker.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\WebView2Loader.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_FRENCH.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanMSAgent.ico
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\app.sig
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\DEM64.msi
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\res
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\res\help.chm
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\message.bin
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_CHINESE.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\tray_ok.ico
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Lato-Semibold.ttf
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaapi.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\tray_ok_msg.ico
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanSupport.ico
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\res\Panw-Logo.png
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Decimal-Medium-Pro.otf
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Connected.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd64.cat
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\bmp00003.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Connecting.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\close2.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\close3.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\tray_stop.ico
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\debug_drv.log
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanProxyAgent.log
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\pan_gp_event.log

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D6DDD103-F4D3-4123-A9A2-E61CFE9FBCD0}

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

File created: C:\Windows\INF\setupapi.app.log

Source: GlobalProtect64.msi

Static PE information: certificate valid

Source: unknown	HTTPS traffic detected: 8.8.8.8:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 8.8.8.8:443 -> 192.168.2.16:49737 version: TLS 1.2

Spreading

Source: C:\Windows\System32\msiexec.exe	File opened: z:
Source: C:\Windows\System32\msiexec.exe	File opened: x:
Source: C:\Windows\System32\msiexec.exe	File opened: v:
Source: C:\Windows\System32\msiexec.exe	File opened: t:
Source: C:\Windows\System32\msiexec.exe	File opened: r:
Source: C:\Windows\System32\msiexec.exe	File opened: p:
Source: C:\Windows\System32\msiexec.exe	File opened: n:
Source: C:\Windows\System32\msiexec.exe	File opened: l:
Source: C:\Windows\System32\msiexec.exe	File opened: j:
Source: C:\Windows\System32\msiexec.exe	File opened: h:
Source: C:\Windows\System32\msiexec.exe	File opened: f:
Source: C:\Windows\System32\svchost.exe	File opened: d:
Source: C:\Windows\System32\msiexec.exe	File opened: b:
Source: C:\Windows\System32\msiexec.exe	File opened: y:
Source: C:\Windows\System32\msiexec.exe	File opened: w:
Source: C:\Windows\System32\msiexec.exe	File opened: u:
Source: C:\Windows\System32\msiexec.exe	File opened: s:
Source: C:\Windows\System32\msiexec.exe	File opened: q:
Source: C:\Windows\System32\msiexec.exe	File opened: o:
Source: C:\Windows\System32\msiexec.exe	File opened: m:
Source: C:\Windows\System32\msiexec.exe	File opened: k:
Source: C:\Windows\System32\msiexec.exe	File opened: i:
Source: C:\Windows\System32\msiexec.exe	File opened: g:
Source: C:\Windows\System32\msiexec.exe	File opened: e:
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Local Storage\leveldb\
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Local Storage\
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\

Networking

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

HTTP traffic: GET /generate_204 HTTP/1.1 Host: clients3.google.com User-Agent: PAN GlobalProtect/6.3.1-383 (Microsoft Windows 10 Pro , 64-bit) Connection: Keep-Alive

Source: Network traffic

Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.16:49737 -> 8.8.8.8:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /generate_204 HTTP/1.1Host: clients3.google.comUser-Agent: PAN GlobalProtect/6.3.1-383 (Microsoft Windows 10 Pro , 64-bit)Connection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: c.pki.goog
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: dns.google
Source: global traffic	DNS traffic detected: DNS query: clients3.google.com

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 8.8.8.8:443 -> 192.168.2.16:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 8.8.8.8:443 -> 192.168.2.16:49737 version: TLS 1.2

System Summary

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.sys

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

File created: C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\netelx.PNF

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4b3413.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{D6DDD103-F4D3-4123-A9A2-E61CFE9FBCD0}
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI3D69.tmp
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\PanPlapProvider.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\PanCredProv.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\PanV2CredProv.dll
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\PanPlapApp.exe
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{D6DDD103-F4D3-4123-A9A2-E61CFE9FBCD0}
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{D6DDD103-F4D3-4123-A9A2-E61CFE9FBCD0}\_853F67D554F05449430E7E.exe
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{D6DDD103-F4D3-4123-A9A2-E61CFE9FBCD0}\_F67ADD686FB057D50FF66A.exe
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{D6DDD103-F4D3-4123-A9A2-E61CFE9FBCD0}\_76ABBD49E711C599777E87.exe
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4b3415.msi
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\4b3415.msi
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\3ware.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\61883.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\acxhdaudiop.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\adp80xx.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\amdsata.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\amdsbs.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\athw8x.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\avc.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\b57nd60a.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\battery.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\bcmdhd64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\bcmwdidhdpcie.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\bda.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\btampm.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\BthLCPen.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\bthmtpenum.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\BthOob.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\bthpan.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\bthprint.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\bthspp.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\cht4nulx64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\cht4sx64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_1394.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_61883.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_apo.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_avc.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_barcodescanner.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_battery.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_biometric.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_bluetooth.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_camera.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_cashdrawer.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_cdrom.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_computeaccelerator.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_computer.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_diskdrive.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_display.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_dot4.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_dot4print.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_extension.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fdc.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_firmware.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_floppydisk.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fsactivitymonitor.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fsantivirus.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fscfsmetadataserver.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fscompression.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fscontentscreener.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fscontinuousbackup.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fscopyprotection.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fsencryption.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fshsm.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fsinfrastructure.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fsopenfilebackup.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fsphysicalquotamgmt.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fsquotamgmt.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fsreplication.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fssecurityenhancer.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fssystem.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fssystemrecovery.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fsundelete.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fsvirtualization.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_hdc.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_hidclass.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_holographic.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_image.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_infrared.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_keyboard.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_legacydriver.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_linedisplay.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_magneticstripereader.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_mcx.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_media.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_mediumchanger.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_memory.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_modem.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_monitor.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_mouse.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_mtd.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_multifunction.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_multiportserial.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_net.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_netclient.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_netdriver.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_netservice.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_nettrans.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_pcmcia.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_pnpprinters.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_ports.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_printer.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_processor.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_proximity.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_receiptprinter.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_sbp2.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_scmdisk.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_scmvolume.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_scsiadapter.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_sdhost.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_securitydevices.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_sensor.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_smartcard.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_smartcardfilter.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_smartcardreader.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_smrdisk.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_smrvolume.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_sslaccel.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_swcomponent.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_system.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_tapedrive.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_ucm.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_unknown.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_usb.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_usbdevice.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_usbfn.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_volsnap.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_volume.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_wceusbs.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_wpd.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\dc1-controller.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\dc21x4vm.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\digitalmediadevice.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\displayoverride.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\e2xw10x64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\eaphost.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ehstorpwddrv.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\fidohid.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\fusionv2.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\gameport.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\halextintclpiodma.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\halextpl080.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\hdaudss.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\heat.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\hidbthle.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\hidcfu.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\hidirkbd.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\hidscanner.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\hidserv.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\HidTelephonyDriver.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\hpsamd.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\idtsec.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\image.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ipmidrv.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ipoib6x.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ItSas35i.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ks.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\kscaptur.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\lltdio.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\lsi_sas2i.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\lsi_sas3i.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\lsi_sss.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mbtr8897w81x64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mchgr.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdm3com.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdm5674a.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmadc.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmagm64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmags64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmairte.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmaiwa.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmaiwa3.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmaiwa4.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmaiwa5.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmaiwat.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmar1.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmarch.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmarn.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmati.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmatm2k.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmaus.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmboca.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmbsb.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmbug3.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmbw561.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmc26a.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcdp.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcm28.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcodex.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcom1.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcommu.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcomp.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcpq.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcpq2.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcpv.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcrtix.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcxhv6.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcxpv6.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmdcm5.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmdcm6.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmdf56f.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmdgitn.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmdp2.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmdsi.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmdyna.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmeiger.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmelsa.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmeric.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmeric2.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmetech.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmfj2.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgatew.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgcs.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgen.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgl001.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgl002.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgl003.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgl004.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgl005.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgl006.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgl007.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgl008.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgl009.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgl010.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgsm.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmhaeu.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmhandy.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmhay2.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmhayes.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdminfot.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmiodat.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmirmdm.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmisdn.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmjf56e.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmke.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmkortx.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmlasat.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmlasno.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmlucnt.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmc288.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmcd.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmcom.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmct.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmega.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmetri.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmhrtz.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmhzel.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmminij.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmod.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmot64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmoto1.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmotou.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmts.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmneuhs.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnis1u.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnis2u.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnis3t.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnis5t.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnokia.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnova.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmntt1.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnttd2.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnttd6.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnttme.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnttp.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnttp2.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnttte.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmolic.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmomrn3.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmoptn.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmosi.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmpace.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmpenr.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmpin.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmpn1.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmpp.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmpsion.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmracal.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmrock.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmrock3.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmrock4.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmrock5.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmsier.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmsii64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmsmart.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmsonyu.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmsun1.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmsun2.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmsupr3.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmsupra.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmsuprv.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmtdk.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmtdkj2.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmtdkj3.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmtdkj4.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmtdkj5.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmtdkj6.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmtdkj7.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmtexas.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmti.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmtkr.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmtron.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmusrf.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmusrg.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmusrgl.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmusrk1.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmusrsp.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmvdot.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmvv.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmwhql0.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmx5560.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmzoom.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmzyp.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmzyxel.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmzyxlg.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\megasas.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\megasas2i.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\megasas35i.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\megasr.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mf.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mgtdyn.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\microsoft_bluetooth_a2dp_snk.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\microsoft_bluetooth_a2dp_src.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\microsoft_bluetooth_hfp_ag.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\microsoft_bluetooth_hfp_hf.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\miradisp.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\modemcsa.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mrvlpcie8897.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\msclmd.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\msdri.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\msdv.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mstape.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\msux64w10.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\multiprt.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mvumis.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mwlu97w8x64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ndiscap.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ndisimplatform.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ndisimplatformmp.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ndisuio.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net1yx64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net44amd.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net7400-x64-n650.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net7500-x64-n650f.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net7800-x64-n650f.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net8185.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net8187bv64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net8187se64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net8192se64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net8192su64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net819xp.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net9500-x64-n650f.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netathr10x.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netathrx.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netax88179_178a.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netax88772.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netbc63a.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netbc64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netbrdg.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netbxnda.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\nete1e3e.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\nete1g3e.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netefe3e.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netelx.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netg664.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netimm.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netip6.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netirda.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netjme.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netk57a.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netl160a.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netl1c63x64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netl1e64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netl260a.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netlldp.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netloop.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netmlx4eth63.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netmlx5.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netmscli.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netmyk64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netnb.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netnvm64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netnvma.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netnwifi.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netpacer.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netpgm.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netr28ux.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netr28x.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netr7364.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netrass.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netrast.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netrndis.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netrtl64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netrtwlane.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netrtwlane01.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netrtwlane_13.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netrtwlans.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netrtwlanu.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netserv.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\nett4x64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\nettcpip.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netv1x64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netvchannel.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netvf63a.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netvg63a.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netvwifibus.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netvwififlt.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netvwifimp.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netvwwanmp.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netwbw02.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netwew00.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netwew01.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netwlv64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netwmbclass.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netwns64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netwsw00.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netwtw02.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netwtw04.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netwtw06.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netwtw08.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netxex64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ntprint.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ntprint4.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\nulhpopr.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\nulhprs8.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\nvraid.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\oem0.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\oem1.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\oem3.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\oposdrv.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\pcmcia.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\PerceptionSimulationHeadset.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\PerceptionSimulationSixDof.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\PerceptionSimulationSixDofModels.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\percsas2i.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\percsas3i.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\pnpxinternetgatewaydevices.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnge001.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnms002.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnms003.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnms004.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnms005.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnms007.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnms008.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnms010.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnms011.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnms012.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnms013.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnms014.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\qd3x64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\rawsilo.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\rdcameradriver.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\rdlsbuscbs.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\rdpidd.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\rdvgwddmdx11.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\remoteposdrv.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\rndiscmp.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\rspndr.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\rt640x64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\rtux64w10.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\rtvdevx64.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\rtwlanu_oldIC.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\scmvolume.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\scrawpdo.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\scsidev.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\scunknown.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\sdbus.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\SDFLauncher.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\sensorsalsdriver.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\SensorsHidClassDriver.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\sensorsservicedriver.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\sisraid2.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\sisraid4.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\SmartSAMD.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\smrdisk.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\smrvolume.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\stexstor.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\sti.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\storfwupdate.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\tape.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\termkbd.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\tpmvsc.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\transfercable.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\tsprint.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\tsusbhubfilter.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ts_generic.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ts_wpdmtp.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\uicciso.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\uiccspb.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\unknown.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\UsbccidDriver.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\usbncm.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\usbnet.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\usbvideo.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\vca.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\virtualdisplayadapter.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\volsnap.PNF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\vrd.PNF

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\4b3415.msi

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

Process token adjusted: Load Driver

Source: C:\Windows\System32\svchost.exe

Process token adjusted: Security

Source: classification engine

Classification label: sus32.spyw.evad.winMSI@33/708@7/21

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files\Palo Alto Networks

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe

File created: C:\Users\user\AppData\Local\Palo Alto Networks\

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Mutant created: NULL
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\GP_InstanceChecker_user
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6568:120:WilError_03

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF955B425E2344DFB2.TMP

Source: C:\Windows\System32\msiexec.exe

File read: C:\Windows\win.ini

Source: C:\Windows\System32\msiexec.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\GlobalProtect64.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe" -commit
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe" -commit
Source: unknown	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "1" "C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.inf" "9" "4473c0673" "0000000000000158" "WinSta0\Default" "000000000000016C" "208" "C:\Program Files\Palo Alto Networks\GlobalProtect"
Source: unknown	Process created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe"
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe" fromGPS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-383 --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3384.3808.9035140351402317242
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x140,0x170,0x7fffebae8e88,0x7fffebae8e98,0x7fffebae8ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-383 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,13562698424550181503,3014916588442710952,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-383 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2856 --field-trial-handle=1780,i,13562698424550181503,3014916588442710952,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-383 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=3016 --field-trial-handle=1780,i,13562698424550181503,3014916588442710952,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-383 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1742409843635632 --launch-time-ticks=5027663235 --mojo-platform-channel-handle=3216 --field-trial-handle=1780,i,13562698424550181503,3014916588442710952,262144 --enable-features=MojoIpcz /prefetch:1
Source: unknown	Process created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "1" "C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.inf" "9" "4473c0673" "0000000000000158" "WinSta0\Default" "000000000000016C" "208" "C:\Program Files\Palo Alto Networks\GlobalProtect"
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-383 --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3384.3808.9035140351402317242
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x140,0x170,0x7fffebae8e88,0x7fffebae8e98,0x7fffebae8ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-383 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,13562698424550181503,3014916588442710952,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-383 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2856 --field-trial-handle=1780,i,13562698424550181503,3014916588442710952,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-383 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=3016 --field-trial-handle=1780,i,13562698424550181503,3014916588442710952,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-383 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1742409843635632 --launch-time-ticks=5027663235 --mojo-platform-channel-handle=3216 --field-trial-handle=1780,i,13562698424550181503,3014916588442710952,262144 --enable-features=MojoIpcz /prefetch:1

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windowscodecs.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: riched20.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: usp10.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msls31.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: psvctrl.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: userenv.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: winhttp.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: wininet.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: powrprof.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: msimg32.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: oledlg.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: netapi32.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: secur32.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: version.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: cryptui.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: msi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: pdh.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: oleacc.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: winmm.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: netutils.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: dsrole.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: samcli.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: dpapi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: umpdc.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: devobj.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: spinf.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: devrtl.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: drvstore.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: netsetupshim.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: netsetupapi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: netsetupengine.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: spfileq.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: textinputframework.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: wintypes.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: wintypes.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: wintypes.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: textshaping.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: wldp.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: cabinet.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: tcpipcfg.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpnpmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupengine.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: implatsetup.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupengine.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: implatsetup.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: spinf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: drvstore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: psvctrl.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: userenv.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: winhttp.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: wininet.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: powrprof.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: msimg32.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: version.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: oledlg.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: netapi32.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: secur32.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: cryptui.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: msi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: pdh.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: oleacc.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: winmm.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: netutils.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: dsrole.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: samcli.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: dpapi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: umpdc.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: winsta.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: amsi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: profapi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: devobj.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: devrtl.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: spinf.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: drvstore.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: spfileq.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: wldp.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: cabinet.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: mswsock.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: samlib.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: wscapi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: netprofm.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: npmproxy.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: netprofm.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: npmproxy.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: netprofm.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: npmproxy.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: netprofm.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: npmproxy.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: netprofm.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: npmproxy.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: userenv.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: winhttp.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: netapi32.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: cryptui.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: winbio.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: wininet.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: powrprof.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: ncrypt.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: webview2loader.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: msimg32.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: oledlg.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: secur32.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: winscard.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: dwmapi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: oleacc.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: winmm.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: netutils.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: samcli.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: devobj.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: umpdc.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: ntasn1.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: profapi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: wldp.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: mswsock.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: textshaping.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: textinputframework.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: wintypes.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: wintypes.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: wintypes.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: version.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: propsys.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: edputil.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: napinsp.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: pnrpnsp.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: wshbth.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: nlaapi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: winrnr.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: winsta.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: dbghelp.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: dhcpcsvc.dll

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B035261-40F9-11D1-AAEC-00805FC1270E}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_JAPANESE.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_SPANISH.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\bmp00001.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaresource.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\ConnectedInternal.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Lato-Regular.ttf
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_GERMAN.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.inf
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.cat
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHip.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\tray_busy.ico
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.inf
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\bitmap1.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPSupport.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.cat
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.ico
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\license.cfg
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PsvCtrl.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\WdfCoinstaller01011.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.sys
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\wa_3rd_party_host_32.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\ConnectedNone.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\uninstall.ico
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\wa_3rd_party_host_64.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\ConnectedFail.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaheap.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_CHINESE_TRADITIONAL.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\gp-public.pem
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwalocal.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.sys
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\bitmap2.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHipMp.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\close1.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwautils.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Connecting.avi
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanVcrediChecker.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\WebView2Loader.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_FRENCH.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanMSAgent.ico
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\app.sig
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\DEM64.msi
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\res
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\res\help.chm
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\message.bin
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_CHINESE.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\tray_ok.ico
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Lato-Semibold.ttf
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaapi.dll
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\tray_ok_msg.ico
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanSupport.ico
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\res\Panw-Logo.png
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Decimal-Medium-Pro.otf
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Connected.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd64.cat
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\bmp00003.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Connecting.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\close2.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\close3.bmp
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\tray_stop.ico
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\debug_drv.log
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanProxyAgent.log
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\pan_gp_event.log

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D6DDD103-F4D3-4123-A9A2-E61CFE9FBCD0}

Source: GlobalProtect64.msi

Static PE information: certificate valid

Source: GlobalProtect64.msi

Static file information: File size 66515456 > 1048576

Persistence and Installation Behavior

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Palo Alto Networks\
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Palo Alto Networks\GlobalProtect\

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\PanV2CredProv.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_CHINESE_TRADITIONAL.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanVcrediChecker.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PsvCtrl.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_GERMAN.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwautils.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\WebView2Loader.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHipMp.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaheap.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\wa_3rd_party_host_32.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\WdfCoinstaller01011.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\PanPlapProvider.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.sys			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_FRENCH.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwalocal.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaapi.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_JAPANESE.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHip.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.sys			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\PanPlapApp.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\wa_3rd_party_host_64.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaresource.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_CHINESE.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\PanCredProv.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_SPANISH.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPSupport.exe			Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\PanV2CredProv.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\PanPlapApp.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\PanPlapProvider.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\PanCredProv.dll			Jump to dropped file

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

File created: C:\Windows\INF\setupapi.app.log

Boot Survival

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PanGpd

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage

Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Palo Alto Networks
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Palo Alto Networks\GlobalProtect
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Palo Alto Networks\GlobalProtect\GlobalProtect.lnk
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Palo Alto Networks\GlobalProtect\PanGPSupport.lnk

Source: C:\Windows\System32\msiexec.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GlobalProtect
Source: C:\Windows\System32\msiexec.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GlobalProtect

Hooking and other Techniques for Hiding and Protection

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanGPS
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\PanV2CredProv.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_CHINESE_TRADITIONAL.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\PanVcrediChecker.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\libwautils.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_GERMAN.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\WebView2Loader.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHipMp.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaheap.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\wa_3rd_party_host_32.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\WdfCoinstaller01011.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\PanPlapProvider.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.sys			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_FRENCH.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\libwalocal.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaapi.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHip.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_JAPANESE.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\PanPlapApp.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.sys			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\wa_3rd_party_host_64.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaresource.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_CHINESE.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\PanCredProv.dll			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPSupport.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_SPANISH.dll			Jump to dropped file

Source: C:\Windows\System32\svchost.exe TID: 428	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe TID: 5956	Thread sleep count: 81 > 30
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe TID: 2116	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe

Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Code Cache\wasm FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Code Cache\js FullSizeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Cache\Cache_Data FullSizeInformation

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Local Storage\leveldb\
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Local Storage\
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

HIPS / PFW / Operating System Protection Evasion

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

Memory allocated: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe base: 1762FA60000 protect: page read and write

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Memory written: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe base: 1762FA60000
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Memory written: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe base: 73FE94E2D8

Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe" -commit
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x140,0x170,0x7fffebae8e88,0x7fffebae8e98,0x7fffebae8ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-383 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,13562698424550181503,3014916588442710952,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-383 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2856 --field-trial-handle=1780,i,13562698424550181503,3014916588442710952,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-383 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=3016 --field-trial-handle=1780,i,13562698424550181503,3014916588442710952,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-383 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1742409843635632 --launch-time-ticks=5027663235 --mojo-platform-channel-handle=3216 --field-trial-handle=1780,i,13562698424550181503,3014916588442710952,262144 --enable-features=MojoIpcz /prefetch:1

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=pangpa.exe --webview-exe-version=6.3.1-383 --user-data-dir="c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --enable-features=mojoipcz --mojo-named-platform-channel-pipe=3384.3808.9035140351402317242
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview\crashpad" --annotation=isofficialbuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=win64 "--annotation=prod=edge webview2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x140,0x170,0x7fffebae8e88,0x7fffebae8e98,0x7fffebae8ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" --webview-exe-name=pangpa.exe --webview-exe-version=6.3.1-383 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,13562698424550181503,3014916588442710952,262144 --enable-features=mojoipcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --noerrdialogs --user-data-dir="c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" --webview-exe-name=pangpa.exe --webview-exe-version=6.3.1-383 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2856 --field-trial-handle=1780,i,13562698424550181503,3014916588442710952,262144 --enable-features=mojoipcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-gb --service-sandbox-type=service --noerrdialogs --user-data-dir="c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" --webview-exe-name=pangpa.exe --webview-exe-version=6.3.1-383 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=3016 --field-trial-handle=1780,i,13562698424550181503,3014916588442710952,262144 --enable-features=mojoipcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" --webview-exe-name=pangpa.exe --webview-exe-version=6.3.1-383 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --first-renderer-process --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1742409843635632 --launch-time-ticks=5027663235 --mojo-platform-channel-handle=3216 --field-trial-handle=1780,i,13562698424550181503,3014916588442710952,262144 --enable-features=mojoipcz /prefetch:1
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=pangpa.exe --webview-exe-version=6.3.1-383 --user-data-dir="c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --enable-features=mojoipcz --mojo-named-platform-channel-pipe=3384.3808.9035140351402317242
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview\crashpad" --annotation=isofficialbuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=win64 "--annotation=prod=edge webview2" --annotation=ver=117.0.2045.47 --initial-client-data=0x15c,0x160,0x164,0x140,0x170,0x7fffebae8e88,0x7fffebae8e98,0x7fffebae8ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" --webview-exe-name=pangpa.exe --webview-exe-version=6.3.1-383 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,13562698424550181503,3014916588442710952,262144 --enable-features=mojoipcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --noerrdialogs --user-data-dir="c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" --webview-exe-name=pangpa.exe --webview-exe-version=6.3.1-383 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2856 --field-trial-handle=1780,i,13562698424550181503,3014916588442710952,262144 --enable-features=mojoipcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-gb --service-sandbox-type=service --noerrdialogs --user-data-dir="c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" --webview-exe-name=pangpa.exe --webview-exe-version=6.3.1-383 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=3016 --field-trial-handle=1780,i,13562698424550181503,3014916588442710952,262144 --enable-features=mojoipcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" --webview-exe-name=pangpa.exe --webview-exe-version=6.3.1-383 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --first-renderer-process --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1742409843635632 --launch-time-ticks=5027663235 --mojo-platform-channel-handle=3216 --field-trial-handle=1780,i,13562698424550181503,3014916588442710952,262144 --enable-features=mojoipcz /prefetch:1

Language, Device and Operating System Detection

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{85384807-c270-594a-be16-957143f816d2}\pangpd64.cat VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Queries volume information: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\Trust Protection Lists\manifest.json VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\WidevineCdm\manifest.json VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Network\SCT Auditing Pending Reports VolumeInformation
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Queries volume information: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\PanGPA.log VolumeInformation

Source: C:\Windows\System32\drvinst.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION

Stealing of Sensitive Information

Source: C:\Windows\System32\svchost.exe

Registry value created: