Edit tour

Windows Analysis Report
GlobalProtect64-6.3.1.msi

Overview

General Information

Sample name:	GlobalProtect64-6.3.1.msi
Analysis ID:	1543859
MD5:	ee67a64e6eec29580597358a7860c706
SHA1:	493877cd3362a44d59eda084b444455f755c3d29
SHA256:	eaa5e4fb71791a360bbabdf007f50861213ead504c649c26482d6529d9fb50dc
Infos:

Detection

Score:	28
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Signatures

Creates files in the system32 config directory

Modifies the DNS server

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Sample is not signed and drops a device driver

AV process strings found (often used to terminate AV products)

Checks for available system drives (often done to infect USB drives)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to communicate with device drivers

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read device registry values (via SetupAPI)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the driver directory

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Enables driver privileges

Enables security privileges

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries device information via Setup API

Queries disk information (often used to detect virtual machines)

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 7284 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\GlobalProtect64-6.3.1.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7352 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

PanGPS.exe (PID: 5900 cmdline: "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe" -commit MD5: D9A82015A96F7EBEBD1B30F6B0BA1F86)

conhost.exe (PID: 5356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PanGPA.exe (PID: 5408 cmdline: "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe" MD5: 300C8D493829B89674AB840CF163A111)

msedgewebview2.exe (PID: 1400 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5408.6692.18028064762265798369 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 1272 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x110,0x160,0x164,0x140,0x16c,0x7ff8a7a58e88,0x7ff8a7a58e98,0x7ff8a7a58ea8 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 6980 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=MojoIpcz /prefetch:2 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 1476 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2516 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=MojoIpcz /prefetch:3 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 5004 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=3000 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=MojoIpcz /prefetch:8 MD5: 9909D978B39FB7369F511D8506C17CA0)

msedgewebview2.exe (PID: 5080 cmdline: "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1730120263967503 --launch-time-ticks=4791055134 --mojo-platform-channel-handle=3408 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=MojoIpcz /prefetch:1 MD5: 9909D978B39FB7369F511D8506C17CA0)

svchost.exe (PID: 6460 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6464 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

drvinst.exe (PID: 5424 cmdline: DrvInst.exe "4" "1" "C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.inf" "9" "4473c0673" "0000000000000158" "WinSta0\Default" "0000000000000168" "208" "C:\Program Files\Palo Alto Networks\GlobalProtect" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)

svchost.exe (PID: 4012 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

PanGPS.exe (PID: 6308 cmdline: "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe" MD5: D9A82015A96F7EBEBD1B30F6B0BA1F86)

cleanup

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe", EventID: 13, EventType: SetValue, Image: C:\Windows\System32\msiexec.exe, ProcessId: 7352, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GlobalProtect

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6460, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION PanGPA.exe			Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION PanGPA.exe			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_JAPANESE.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_SPANISH.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\bmp00001.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaresource.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\ConnectedInternal.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Lato-Regular.ttf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_GERMAN.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHip.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\tray_busy.ico	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\bitmap1.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPSupport.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.ico	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\license.cfg	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PsvCtrl.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\WdfCoinstaller01011.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\wa_3rd_party_host_32.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\ConnectedNone.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\uninstall.ico	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\wa_3rd_party_host_64.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\ConnectedFail.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaheap.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_CHINESE_TRADITIONAL.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\gp-public.pem	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwalocal.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\bitmap2.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHipMp.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\close1.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwautils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Connecting.avi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanVcrediChecker.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\WebView2Loader.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_FRENCH.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanMSAgent.ico	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\app.sig	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\DEM64.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\res	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\res\help.chm	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\message.bin	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_CHINESE.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\tray_ok.ico	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Lato-Semibold.ttf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\tray_ok_msg.ico	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanSupport.ico	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\res\Panw-Logo.png	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Decimal-Medium-Pro.otf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Connected.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\bmp00003.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Connecting.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\close2.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\close3.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\tray_stop.ico	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\debug_drv.log	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanProxyAgent.log
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\pan_gp_event.log

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{62BC3D77-3D5D-4821-B162-5BF52C6B11AF}

Jump to behavior

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

File created: C:\Windows\INF\setupapi.app.log

Jump to behavior

Source:	Binary string: e:\workspace\GlobalProtect\Release6.3\globalprotect-release-6.3-RELENG_2\gp\release\6.3.1\win32\apps\PanMS\x64\Release\PanGPS.pdb source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: X509_NAME_ENTRYRDNSX509_NAME_ENTRIESNameX509_NAME_INTERNALX509_NAMEcrypto\x509\x_name.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1g FIPS 21 Apr 2020built on: Sat Oct 15 03:31:49 2022 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not availablecrypto\fips\fips_post.crand_drbg_selftestType=assertion failed: len <= FIPS_MAX_CIPHER_TEST_SIZE0123456789abcdefcrypto\fips\fips.cFATAL FIPS SELFTEST FAILUREOPENSSL_ia32cap_OPENSSL_isserviceService-0xno stack?OpenSSLOpenSSL: FATAL%s:%d: OpenSSL internal error: %s source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: c:
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Code function: 8_2_00007FF8B8AFF950 FindFirstFileExW,	8_2_00007FF8B8AFF950
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Code function: 8_2_00007FF8B8AFFAD4 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	8_2_00007FF8B8AFFAD4
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7E148E4 FindFirstFileExW,	19_2_00007FF8B7E148E4

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Local Storage\	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Local Storage\leveldb\	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\	Jump to behavior

Networking

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Source: gpfltdrv.sys.1.dr	Static PE information: Found NDIS imports: FwpsFreeCloneNetBufferList0, FwpsAllocateCloneNetBufferList0, FwpsApplyModifiedLayerData0, FwpsInjectNetworkSendAsync0, FwpsReleaseClassifyHandle0, FwpsAcquireClassifyHandle0, FwpmFilterDestroyEnumHandle0, FwpmFilterEnum0, FwpmFilterCreateEnumHandle0, FwpmFilterDeleteByKey0, FwpmFilterAdd0, FwpsConstructIpHeaderForTransportPacket0, FwpsInjectNetworkReceiveAsync0, FwpsReferenceNetBufferList0, FwpsDereferenceNetBufferList0, FwpsQueryPacketInjectionState0, FwpsQueryConnectionRedirectState0, FwpsFlowAssociateContext0, FwpsFlowRemoveContext0, FwpsCompleteClassify0, FwpsAcquireWritableLayerDataPointer0, FwpsCalloutRegister2, FwpsCalloutUnregisterById0, FwpsInjectionHandleCreate0, FwpsInjectionHandleDestroy0, FwpsRedirectHandleCreate0, FwpsRedirectHandleDestroy0, FwpmFreeMemory0, FwpmEngineOpen0, FwpmEngineClose0, FwpmTransactionBegin0, FwpmTransactionCommit0, FwpmTransactionAbort0, FwpmSubLayerAdd0, FwpmCalloutAdd0
Source: PanGPS.exe.1.dr	Static PE information: Found NDIS imports: FwpmFilterAdd0, FwpmSubLayerDeleteByKey0, FwpmFilterDeleteByKey0, FwpmTransactionAbort0, FwpmTransactionCommit0, FwpmFilterCreateEnumHandle0, FwpmFilterDeleteById0, FwpmFilterDestroyEnumHandle0, FwpmSubLayerAdd0, FwpmFilterEnum0, FwpmGetAppIdFromFileName0, FwpmCalloutDeleteByKey0, FwpmTransactionBegin0, FwpmFreeMemory0, FwpmEngineOpen0, FwpmEngineClose0
Source: SET8C10.tmp.19.dr	Static PE information: Found NDIS imports: FwpsFreeCloneNetBufferList0, FwpsAllocateCloneNetBufferList0, FwpsApplyModifiedLayerData0, FwpsInjectNetworkSendAsync0, FwpsReleaseClassifyHandle0, FwpsAcquireClassifyHandle0, FwpmFilterDestroyEnumHandle0, FwpmFilterEnum0, FwpmFilterCreateEnumHandle0, FwpmFilterDeleteByKey0, FwpmFilterAdd0, FwpsConstructIpHeaderForTransportPacket0, FwpsInjectNetworkReceiveAsync0, FwpsReferenceNetBufferList0, FwpsDereferenceNetBufferList0, FwpsQueryPacketInjectionState0, FwpsQueryConnectionRedirectState0, FwpsFlowAssociateContext0, FwpsFlowRemoveContext0, FwpsCompleteClassify0, FwpsAcquireWritableLayerDataPointer0, FwpsCalloutRegister2, FwpsCalloutUnregisterById0, FwpsInjectionHandleCreate0, FwpsInjectionHandleDestroy0, FwpsRedirectHandleCreate0, FwpsRedirectHandleDestroy0, FwpmFreeMemory0, FwpmEngineOpen0, FwpmEngineClose0, FwpmTransactionBegin0, FwpmTransactionCommit0, FwpmTransactionAbort0, FwpmSubLayerAdd0, FwpmCalloutAdd0

Source: global traffic

TCP traffic: 192.168.2.5:51418 -> 1.1.1.1:53

Source: Joe Sandbox View

IP Address: 162.159.61.3 162.159.61.3

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://127.0.0.1
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://127.0.0.1Software
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://captive.apple.com/hotspot-detect.html
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://captive.apple.com/hotspot-detect.html(P%u-T%u)%s(%4d):
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html(P%u-T%u)%s(%4d):
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://gp.test.com/big_file
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://gp.test.com/small_file
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: https://gp.test.com/small_filetrace

Source: unknown	Network traffic detected: HTTP traffic on port 51654 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51653 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51650 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51650
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51651
Source: unknown	Network traffic detected: HTTP traffic on port 51651 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51654
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51653

Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{bde618de-3b74-034f-b443-966861a24834}\pangpd64.cat (copy)			Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{bde618de-3b74-034f-b443-966861a24834}\SET6E48.tmp			Jump to dropped file

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

Code function: 19_2_00007FF8B7DF5F3C: EnterCriticalSection,_snwprintf_s,_snwprintf_s,EnterCriticalSection,_snwprintf_s,LeaveCriticalSection,_snwprintf_s,CreateEventW,DeviceIoControl,EnterCriticalSection,_snwprintf_s,LeaveCriticalSection,GetOverlappedResult,CloseHandle,_snwprintf_s,GetLastError,EnterCriticalSection,_snwprintf_s,LeaveCriticalSection,_snwprintf_s,

19_2_00007FF8B7DF5F3C

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

Code function: 19_2_00007FF8B7E033D4 OpenSCManagerW,OpenServiceW,QueryServiceStatus,Sleep,EnterCriticalSection,_snwprintf_s,LeaveCriticalSection,EnterCriticalSection,_snwprintf_s,LeaveCriticalSection,_snwprintf_s,_snwprintf_s,DeleteService,GetLastError,EnterCriticalSection,_snwprintf_s,LeaveCriticalSection,_snwprintf_s,GetSystemDirectoryW,DeleteFileW,EnterCriticalSection,GetLastError,_snwprintf_s,LeaveCriticalSection,GetLastError,_snwprintf_s,CloseServiceHandle,CloseServiceHandle,

19_2_00007FF8B7E033D4

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.sys

Jump to behavior

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

File created: C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\netelx.PNF

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\48bce9.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{62BC3D77-3D5D-4821-B162-5BF52C6B11AF}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIC68D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\PanPlapProvider.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\PanCredProv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\PanV2CredProv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\system32\PanPlapApp.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{62BC3D77-3D5D-4821-B162-5BF52C6B11AF}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{62BC3D77-3D5D-4821-B162-5BF52C6B11AF}\_853F67D554F05449430E7E.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{62BC3D77-3D5D-4821-B162-5BF52C6B11AF}\_F385DCA0A7C7248F54C3CD.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\{62BC3D77-3D5D-4821-B162-5BF52C6B11AF}\_2AE9C45021E1A96BA1E33A.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\48bceb.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\48bceb.msi	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\3ware.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\61883.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\acxhdaudiop.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\adp80xx.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\amdsata.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\amdsbs.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\athw8x.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\avc.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\b57nd60a.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\battery.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\bcmdhd64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\bcmwdidhdpcie.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\bda.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\btampm.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\BthLCPen.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\bthmtpenum.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\BthOob.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\bthpan.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\bthprint.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\bthspp.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\cht4nulx64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\cht4sx64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_1394.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_61883.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_apo.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_avc.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_barcodescanner.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_battery.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_biometric.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_bluetooth.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_camera.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_cashdrawer.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_cdrom.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_computeaccelerator.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_computer.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_diskdrive.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_display.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_dot4.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_dot4print.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_extension.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fdc.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_firmware.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_floppydisk.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fsactivitymonitor.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fsantivirus.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fscfsmetadataserver.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fscompression.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fscontentscreener.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fscontinuousbackup.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fscopyprotection.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fsencryption.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fshsm.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fsinfrastructure.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fsopenfilebackup.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fsphysicalquotamgmt.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fsquotamgmt.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fsreplication.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fssecurityenhancer.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fssystem.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fssystemrecovery.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fsundelete.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_fsvirtualization.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_hdc.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_hidclass.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_holographic.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_image.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_infrared.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_keyboard.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_legacydriver.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_linedisplay.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_magneticstripereader.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_mcx.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_media.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_mediumchanger.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_memory.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_modem.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_monitor.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_mouse.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_mtd.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_multifunction.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_multiportserial.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_net.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_netclient.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_netdriver.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_netservice.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_nettrans.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_pcmcia.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_pnpprinters.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_ports.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_printer.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_processor.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_proximity.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_receiptprinter.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_sbp2.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_scmdisk.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_scmvolume.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_scsiadapter.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_sdhost.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_securitydevices.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_sensor.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_smartcard.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_smartcardfilter.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_smartcardreader.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_smrdisk.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_smrvolume.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_sslaccel.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_swcomponent.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_system.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_tapedrive.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_ucm.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_unknown.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_usb.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_usbdevice.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_usbfn.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_volsnap.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_volume.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_wceusbs.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\c_wpd.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\dc1-controller.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\dc21x4vm.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\digitalmediadevice.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\displayoverride.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\e2xw10x64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\eaphost.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ehstorpwddrv.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\fidohid.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\fusionv2.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\gameport.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\halextintclpiodma.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\halextpl080.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\hdaudss.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\heat.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\hidbthle.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\hidcfu.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\hidirkbd.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\hidscanner.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\hidserv.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\HidTelephonyDriver.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\hpsamd.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\idtsec.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\image.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ipmidrv.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ipoib6x.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ItSas35i.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ks.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\kscaptur.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\lltdio.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\lsi_sas2i.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\lsi_sas3i.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\lsi_sss.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mbtr8897w81x64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mchgr.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdm3com.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdm5674a.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmadc.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmagm64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmags64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmairte.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmaiwa.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmaiwa3.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmaiwa4.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmaiwa5.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmaiwat.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmar1.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmarch.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmarn.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmati.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmatm2k.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmaus.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmboca.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmbsb.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmbug3.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmbw561.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmc26a.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcdp.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcm28.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcodex.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcom1.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcommu.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcomp.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcpq.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcpq2.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcpv.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcrtix.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcxhv6.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmcxpv6.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmdcm5.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmdcm6.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmdf56f.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmdgitn.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmdp2.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmdsi.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmdyna.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmeiger.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmelsa.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmeric.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmeric2.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmetech.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmfj2.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgatew.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgcs.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgen.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgl001.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgl002.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgl003.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgl004.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgl005.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgl006.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgl007.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgl008.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgl009.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgl010.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmgsm.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmhaeu.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmhandy.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmhay2.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmhayes.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdminfot.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmiodat.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmirmdm.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmisdn.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmjf56e.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmke.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmkortx.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmlasat.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmlasno.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmlucnt.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmc288.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmcd.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmcom.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmct.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmega.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmetri.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmhrtz.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmhzel.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmminij.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmod.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmot64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmoto1.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmotou.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmmts.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmneuhs.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnis1u.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnis2u.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnis3t.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnis5t.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnokia.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnova.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmntt1.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnttd2.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnttd6.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnttme.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnttp.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnttp2.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmnttte.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmolic.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmomrn3.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmoptn.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmosi.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmpace.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmpenr.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmpin.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmpn1.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmpp.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmpsion.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmracal.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmrock.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmrock3.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmrock4.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmrock5.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmsier.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmsii64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmsmart.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmsonyu.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmsun1.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmsun2.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmsupr3.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmsupra.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmsuprv.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmtdk.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmtdkj2.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmtdkj3.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmtdkj4.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmtdkj5.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmtdkj6.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmtdkj7.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmtexas.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmti.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmtkr.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmtron.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmusrf.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmusrg.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmusrgl.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmusrk1.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmusrsp.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmvdot.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmvv.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmwhql0.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmx5560.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmzoom.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmzyp.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmzyxel.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mdmzyxlg.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\megasas.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\megasas2i.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\megasas35i.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\megasr.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mf.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mgtdyn.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\microsoft_bluetooth_a2dp_snk.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\microsoft_bluetooth_a2dp_src.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\microsoft_bluetooth_hfp_ag.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\microsoft_bluetooth_hfp_hf.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\miradisp.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\modemcsa.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mrvlpcie8897.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\msclmd.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\msdri.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\msdv.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mstape.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\msux64w10.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\multiprt.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mvumis.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\mwlu97w8x64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ndiscap.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ndisimplatform.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ndisimplatformmp.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ndisuio.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net1yx64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net44amd.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net7400-x64-n650.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net7500-x64-n650f.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net7800-x64-n650f.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net8185.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net8187bv64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net8187se64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net8192se64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net8192su64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net819xp.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\net9500-x64-n650f.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netathr10x.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netathrx.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netax88179_178a.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netax88772.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netbc63a.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netbc64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netbrdg.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netbxnda.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\nete1e3e.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\nete1g3e.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netefe3e.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netelx.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netg664.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netimm.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netip6.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netirda.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netjme.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netk57a.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netl160a.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netl1c63x64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netl1e64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netl260a.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netlldp.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netloop.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netmlx4eth63.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netmlx5.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netmscli.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netmyk64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netnb.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netnvm64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netnvma.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netnwifi.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netpacer.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netpgm.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netr28ux.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netr28x.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netr7364.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netrass.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netrast.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netrndis.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netrtl64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netrtwlane.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netrtwlane01.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netrtwlane_13.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netrtwlans.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netrtwlanu.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netserv.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\nett4x64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\nettcpip.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netv1x64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netvchannel.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netvf63a.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netvg63a.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netvwifibus.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netvwififlt.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netvwifimp.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netvwwanmp.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netwbw02.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netwew00.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netwew01.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netwlv64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netwmbclass.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netwns64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netwsw00.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netwtw02.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netwtw04.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netwtw06.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netwtw08.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\netxex64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ntprint.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ntprint4.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\nulhpopr.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\nulhprs8.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\nvraid.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\oem0.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\oem1.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\oem3.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\oposdrv.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\pcmcia.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\PerceptionSimulationHeadset.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\PerceptionSimulationSixDof.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\PerceptionSimulationSixDofModels.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\percsas2i.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\percsas3i.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\pnpxinternetgatewaydevices.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnge001.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnms002.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnms003.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnms004.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnms005.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnms007.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnms008.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnms010.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnms011.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnms012.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnms013.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\prnms014.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\qd3x64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\rawsilo.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\rdcameradriver.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\rdlsbuscbs.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\rdpidd.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\rdvgwddmdx11.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\remoteposdrv.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\rndiscmp.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\rspndr.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\rt640x64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\rtux64w10.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\rtvdevx64.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\rtwlanu_oldIC.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\scmvolume.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\scrawpdo.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\scsidev.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\scunknown.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\sdbus.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\SDFLauncher.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\sensorsalsdriver.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\SensorsHidClassDriver.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\sensorsservicedriver.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\sisraid2.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\sisraid4.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\SmartSAMD.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\smrdisk.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\smrvolume.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\stexstor.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\sti.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\storfwupdate.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\tape.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\termkbd.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\tpmvsc.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\transfercable.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\tsprint.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\tsusbhubfilter.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ts_generic.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\ts_wpdmtp.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\uicciso.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\uiccspb.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\unknown.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\UsbccidDriver.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\usbncm.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\usbnet.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\usbvideo.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\vca.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\virtualdisplayadapter.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\volsnap.PNF	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\INF\vrd.PNF	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\48bceb.msi

Jump to behavior

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Code function: 8_2_00007FF8B8B05168	8_2_00007FF8B8B05168
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Code function: 8_2_00007FF8B8AFF950	8_2_00007FF8B8AFF950
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Code function: 8_2_00007FF8B8AFFAD4	8_2_00007FF8B8AFFAD4
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Code function: 8_2_00007FF8B8AF27AF	8_2_00007FF8B8AF27AF
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Code function: 8_2_00007FF8B8AF2035	8_2_00007FF8B8AF2035
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Code function: 8_2_00007FF8B8AF7468	8_2_00007FF8B8AF7468
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7DF90F0	19_2_00007FF8B7DF90F0
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7DFBDB8	19_2_00007FF8B7DFBDB8
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7DFBBB0	19_2_00007FF8B7DFBBB0
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7DF1250	19_2_00007FF8B7DF1250
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7DFD154	19_2_00007FF8B7DFD154
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7E148E4	19_2_00007FF8B7E148E4
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7DF4750	19_2_00007FF8B7DF4750
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7E16F30	19_2_00007FF8B7E16F30
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7E146D8	19_2_00007FF8B7E146D8
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7DFE6A0	19_2_00007FF8B7DFE6A0
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7E1265C	19_2_00007FF8B7E1265C
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7DF45D0	19_2_00007FF8B7DF45D0
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7DF3DB0	19_2_00007FF8B7DF3DB0
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7E01D40	19_2_00007FF8B7E01D40
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7E1BD18	19_2_00007FF8B7E1BD18
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7E0D3DC	19_2_00007FF8B7E0D3DC
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7E003C4	19_2_00007FF8B7E003C4
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7DFDBD0	19_2_00007FF8B7DFDBD0
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7E1735C	19_2_00007FF8B7E1735C
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7DF8350	19_2_00007FF8B7DF8350
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7E19B18	19_2_00007FF8B7E19B18
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7E11234	19_2_00007FF8B7E11234
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7DFC9D0	19_2_00007FF8B7DFC9D0
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7E05160	19_2_00007FF8B7E05160
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7E0D174	19_2_00007FF8B7E0D174

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

Process token adjusted: Load Driver

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Process token adjusted: Security

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: String function: 00007FF8B7DF1F54 appears 79 times
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: String function: 00007FF8B7DF2990 appears 115 times
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: String function: 00007FF8B7DF39FC appears 219 times

Source: libwaresource.dll.1.dr	Static PE information: Resource name: RT_RCDATA type: COM executable for DOS
Source: WdfCoinstaller01011.dll.1.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, Microsoft Standalone Update, 897290 bytes, 4 files, at 0x44 +A "WSUSSCAN.cab" +A "Windows6.0-KB2685811-x64.cab", flags 0x4, number 1, extra bytes 20 in head, 31 datablocks, 0x1 compression
Source: WdfCoinstaller01011.dll.1.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, Microsoft Standalone Update, 794777 bytes, 4 files, at 0x44 +A "WSUSSCAN.cab" +A "Windows6.1-KB2685811-x64.cab", flags 0x4, number 1, extra bytes 20 in head, 27 datablocks, 0x1 compression
Source: wa_3rd_party_host_32.exe.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Source: wa_3rd_party_host_64.exe.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows

Source: WebView2Loader.dll.1.dr

Static PE information: Number of sections : 11 > 10

Source: PanGPA_SPANISH.dll.1.dr	Static PE information: No import functions for PE file found
Source: PanGPA_FRENCH.dll.1.dr	Static PE information: No import functions for PE file found
Source: libwaresource.dll.1.dr	Static PE information: No import functions for PE file found
Source: PanGPA_GERMAN.dll.1.dr	Static PE information: No import functions for PE file found
Source: PanGPA_JAPANESE.dll.1.dr	Static PE information: No import functions for PE file found
Source: PanGPA_CHINESE.dll.1.dr	Static PE information: No import functions for PE file found
Source: PanGPA_CHINESE_TRADITIONAL.dll.1.dr	Static PE information: No import functions for PE file found

Source: WdfCoinstaller01011.dll.1.dr

Static PE information: Section: .rsrc ZLIB complexity 0.9922124359783254

Source: classification engine

Classification label: sus28.troj.spyw.evad.winMSI@24/837@4/2

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

Code function: 19_2_00007FF8B7DFFFD0 CoInitialize,CoCreateInstance,CoUninitialize,

19_2_00007FF8B7DFFFD0

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

Code function: 19_2_00007FF8B7E04778 LoadResource,LockResource,SizeofResource,

19_2_00007FF8B7E04778

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files\Palo Alto Networks

Jump to behavior

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe

File created: C:\Users\user\AppData\Local\Palo Alto Networks\

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5356:120:WilError_03
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Mutant created: NULL
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\GP_InstanceChecker_user

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF0981B5E01843200F.TMP

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: PanGPA.exe	String found in binary or memory: <SIZE>15, 14</SIZE> <CORNERS>2, 2, 2, 2</CORNERS> </LAUNCH_BTN> <LAUNCH_ICON> <SIZE>8, 8</SIZE> </LAUNCH_ICON> <TextNormal>83, 84, 89</TextNormal> <TextHighlighted>83, 84, 89</TextHighlighted> </CAPTION> <SEPA
Source: PanGPA.exe	String found in binary or memory: <CORNERS>2, 0, 2, 16</CORNERS> </BOTTOM> </BACK> <CAPTION> <LAUNCH_ICON> <SIZE>12, 12</SIZE> </LAUNCH_ICON> <TextNormal>255, 255, 255</TextNormal> <TextHighlighted>255, 255, 255</TextHighlighted> </CAPTION> <S
Source: PanGPA.exe	String found in binary or memory: SIZE>100, 17</SIZE> <CORNERS>3, 0, 4, 4</CORNERS> </BOTTOM> </BACK> <CAPTION> <LAUNCH_BTN> <SIZE>15, 14</SIZE> <CORNERS>2, 2, 2, 2</CORNERS> </LAUNCH_BTN> <LAUNCH_ICON> <SIZE>8, 8</SIZE> </LAUNCH_ICON>
Source: PanGPA.exe	String found in binary or memory: TTOM> <SIZE>100, 17</SIZE> <CORNERS>3, 0, 4, 4</CORNERS> </BOTTOM> </BACK> <CAPTION> <LAUNCH_BTN> <SIZE>15, 14</SIZE> <CORNERS>2, 2, 2, 2</CORNERS> </LAUNCH_BTN> <LAUNCH_ICON> <SIZE>8, 8</SIZE> </L
Source: PanGPA.exe	String found in binary or memory: <LAUNCH_BTN> <SIZE>15, 14</SIZE> <CORNERS>2, 2, 2, 2</CORNERS> </LAUNCH_BTN> <LAUNCH_ICON> <SIZE>8, 8</SIZE> </LAUNCH_ICON> <TextNormal>115, 131, 153</TextNormal> <TextHighlighted>115, 131, 153</TextHighlighted>
Source: PanGPS.exe	String found in binary or memory: The old interface cannot get un-installed. Please reboot computer and install again!

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\GlobalProtect64-6.3.1.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe" -commit
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe"
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5408.6692.18028064762265798369
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x110,0x160,0x164,0x140,0x16c,0x7ff8a7a58e88,0x7ff8a7a58e98,0x7ff8a7a58ea8
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=MojoIpcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2516 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=MojoIpcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=3000 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=MojoIpcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1730120263967503 --launch-time-ticks=4791055134 --mojo-platform-channel-handle=3408 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=MojoIpcz /prefetch:1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "1" "C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.inf" "9" "4473c0673" "0000000000000158" "WinSta0\Default" "0000000000000168" "208" "C:\Program Files\Palo Alto Networks\GlobalProtect"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
Source: unknown	Process created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe"
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe" -commit	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5408.6692.18028064762265798369	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x110,0x160,0x164,0x140,0x16c,0x7ff8a7a58e88,0x7ff8a7a58e98,0x7ff8a7a58ea8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=MojoIpcz /prefetch:2	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2516 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=MojoIpcz /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=3000 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=MojoIpcz /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1730120263967503 --launch-time-ticks=4791055134 --mojo-platform-channel-handle=3408 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=MojoIpcz /prefetch:1	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "1" "C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.inf" "9" "4473c0673" "0000000000000158" "WinSta0\Default" "0000000000000168" "208" "C:\Program Files\Palo Alto Networks\GlobalProtect"

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: psvctrl.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: spinf.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: devrtl.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: drvstore.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: netsetupshim.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: netsetupapi.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: netsetupengine.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: spfileq.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: tcpipcfg.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: winbio.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: webview2loader.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: winscard.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windows.system.profile.platformdiagnosticsandusagedatasettings.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: kbdus.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windows.system.profile.platformdiagnosticsandusagedatasettings.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mdmregistration.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mdmregistration.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: omadmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: iri.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: windows.security.authentication.web.core.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: directmanipulation.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mf.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mfplat.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: rtworkq.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: hevcdecoder.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dolbydecmft.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mfperfhelper.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: nlaapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: rasadhlp.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: ntmarta.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: ncrypt.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: ntasn1.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: ncryptprov.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: winmm.dll
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Section loaded: winmm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpnpmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupengine.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: implatsetup.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netsetupengine.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: implatsetup.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devrtl.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: spinf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: drvstore.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: psvctrl.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: userenv.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: winhttp.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: wininet.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: powrprof.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: msimg32.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: oledlg.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: netapi32.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: secur32.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: wtsapi32.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: cryptui.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: msi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: pdh.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: fwpuclnt.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: oleacc.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: winmm.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: version.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: netutils.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: dsrole.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: samcli.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: dpapi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: umpdc.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: winsta.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: amsi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: profapi.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: devobj.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: devrtl.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: spinf.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: drvstore.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: spfileq.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: wldp.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: cabinet.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: mswsock.dll
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Section loaded: samlib.dll

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B035261-40F9-11D1-AAEC-00805FC1270E}\InProcServer32

Jump to behavior

Source: GlobalProtect.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\Windows\Installer\{62BC3D77-3D5D-4821-B162-5BF52C6B11AF}\_F385DCA0A7C7248F54C3CD.exe
Source: PanGPSupport.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\Windows\Installer\{62BC3D77-3D5D-4821-B162-5BF52C6B11AF}\_2AE9C45021E1A96BA1E33A.exe

Source: C:\Windows\System32\msiexec.exe	Automated click: Next >
Source: C:\Windows\System32\msiexec.exe	Automated click: Next >
Source: C:\Windows\System32\msiexec.exe	Automated click: Next >

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_JAPANESE.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_SPANISH.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\bmp00001.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaresource.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\ConnectedInternal.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Lato-Regular.ttf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_GERMAN.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHip.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\tray_busy.ico	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.inf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\bitmap1.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPSupport.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.ico	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\license.cfg	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PsvCtrl.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\WdfCoinstaller01011.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\wa_3rd_party_host_32.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\ConnectedNone.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\uninstall.ico	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\wa_3rd_party_host_64.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\ConnectedFail.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaheap.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_CHINESE_TRADITIONAL.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\gp-public.pem	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwalocal.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.sys	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\bitmap2.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHipMp.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\close1.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwautils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Connecting.avi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanVcrediChecker.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\WebView2Loader.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_FRENCH.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanMSAgent.ico	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\app.sig	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\DEM64.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\res	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\res\help.chm	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\message.bin	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_CHINESE.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\tray_ok.ico	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Lato-Semibold.ttf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\tray_ok_msg.ico	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanSupport.ico	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\res\Panw-Logo.png	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Decimal-Medium-Pro.otf	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Connected.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd64.cat	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\bmp00003.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\Connecting.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\close2.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\close3.bmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\tray_stop.ico	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\debug_drv.log	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanProxyAgent.log
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Directory created: C:\Program Files\Palo Alto Networks\GlobalProtect\pan_gp_event.log

Source: C:\Windows\System32\msiexec.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{62BC3D77-3D5D-4821-B162-5BF52C6B11AF}

Jump to behavior

Source: GlobalProtect64-6.3.1.msi

Static file information: File size 66512384 > 1048576

Source:	Binary string: e:\workspace\GlobalProtect\Release6.3\globalprotect-release-6.3-RELENG_2\gp\release\6.3.1\win32\apps\PanMS\x64\Release\PanGPS.pdb source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: X509_NAME_ENTRYRDNSX509_NAME_ENTRIESNameX509_NAME_INTERNALX509_NAMEcrypto\x509\x_name.ccompiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASMOpenSSL 1.1.1g FIPS 21 Apr 2020built on: Sat Oct 15 03:31:49 2022 UTCplatform: VC-WIN64AOPENSSLDIR: "C:\Program Files\Common Files\SSL"ENGINESDIR: "C:\Program Files\OpenSSL\lib\engines-1_1"not availablecrypto\fips\fips_post.crand_drbg_selftestType=assertion failed: len <= FIPS_MAX_CIPHER_TEST_SIZE0123456789abcdefcrypto\fips\fips.cFATAL FIPS SELFTEST FAILUREOPENSSL_ia32cap_OPENSSL_isserviceService-0xno stack?OpenSSLOpenSSL: FATAL%s:%d: OpenSSL internal error: %s source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp
Source:	Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /W3 /wd4090 /nologo /O2 -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe

Code function: 8_2_00007FF8B8AF3B59 LoadLibraryW,GetProcAddress,GetProcAddress,FreeLibrary,GetLastError,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,GetLastError,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,

8_2_00007FF8B8AF3B59

Source: wa_3rd_party_host_32.exe.1.dr	Static PE information: section name: .didat
Source: wa_3rd_party_host_64.exe.1.dr	Static PE information: section name: .didat
Source: wa_3rd_party_host_64.exe.1.dr	Static PE information: section name: .gehcont
Source: libwaheap.dll.1.dr	Static PE information: section name: .gehcont
Source: libwalocal.dll.1.dr	Static PE information: section name: .gehcont
Source: libwautils.dll.1.dr	Static PE information: section name: .didat
Source: libwautils.dll.1.dr	Static PE information: section name: .gehcont
Source: WebView2Loader.dll.1.dr	Static PE information: section name: .00cfg
Source: WebView2Loader.dll.1.dr	Static PE information: section name: .gxfg
Source: WebView2Loader.dll.1.dr	Static PE information: section name: .retplne
Source: WebView2Loader.dll.1.dr	Static PE information: section name: _RDATA
Source: libwaapi.dll.1.dr	Static PE information: section name: .gehcont

Persistence and Installation Behavior

Creates files in the system32 config directory

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Palo Alto Networks\
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Palo Alto Networks\GlobalProtect\

Sample is not signed and drops a device driver

Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.sys			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.sys			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\PanV2CredProv.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_CHINESE_TRADITIONAL.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanVcrediChecker.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PsvCtrl.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{bde618de-3b74-034f-b443-966861a24834}\pangpd.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_GERMAN.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwautils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\WebView2Loader.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHipMp.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaheap.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\wa_3rd_party_host_32.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Jump to dropped file
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\system32\DRIVERS\gpfltdrv.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\WdfCoinstaller01011.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{bde618de-3b74-034f-b443-966861a24834}\SET6DF9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\PanPlapProvider.dll	Jump to dropped file
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\system32\DRIVERS\pangpd.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_FRENCH.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwalocal.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaapi.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHip.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_JAPANESE.dll	Jump to dropped file
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\System32\drivers\SET8C10.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\PanPlapApp.exe	Jump to dropped file
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\System32\drivers\SET80A6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\wa_3rd_party_host_64.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaresource.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_CHINESE.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_SPANISH.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\PanCredProv.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPSupport.exe	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\PanV2CredProv.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{bde618de-3b74-034f-b443-966861a24834}\pangpd.sys (copy)	Jump to dropped file
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\System32\drivers\SET8C10.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\PanPlapApp.exe	Jump to dropped file
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\System32\drivers\SET80A6.tmp	Jump to dropped file
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\system32\DRIVERS\gpfltdrv.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	File created: C:\Windows\System32\DriverStore\Temp\{bde618de-3b74-034f-b443-966861a24834}\SET6DF9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\PanPlapProvider.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\System32\PanCredProv.dll	Jump to dropped file
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	File created: C:\Windows\system32\DRIVERS\pangpd.sys (copy)	Jump to dropped file

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

File created: C:\Windows\INF\setupapi.app.log

Jump to behavior

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\PanGpd

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Linkage

Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Palo Alto Networks	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Palo Alto Networks\GlobalProtect	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Palo Alto Networks\GlobalProtect\GlobalProtect.lnk	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Palo Alto Networks\GlobalProtect\PanGPSupport.lnk	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GlobalProtect			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GlobalProtect			Jump to behavior

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip6\Parameters	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip6\Parameters

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

Code function: 19_2_00007FF8B7DFBBB0 SetupDiGetDeviceRegistryPropertyW,EnterCriticalSection,GetLastError,_snwprintf_s,LeaveCriticalSection,GetLastError,_snwprintf_s,_invalid_parameter_noinfo_noreturn,EnterCriticalSection,_snwprintf_s,LeaveCriticalSection,_snwprintf_s,SetupDiClassGuidsFromNameExW,SetupDiGetClassDevsExW,SetupDiGetDeviceInfoListDetailW,SetupDiEnumDeviceInfo,CM_Get_Device_ID_ExW,wcsstr,EnterCriticalSection,_snwprintf_s,LeaveCriticalSection,_snwprintf_s,CM_Get_DevNode_Status_Ex,EnterCriticalSection,_snwprintf_s,LeaveCriticalSection,_snwprintf_s,EnterCriticalSection,_snwprintf_s,LeaveCriticalSection,_snwprintf_s,EnterCriticalSection,_snwprintf_s,LeaveCriticalSection,_snwprintf_s,EnterCriticalSection,_snwprintf_s,_snwprintf_s,

19_2_00007FF8B7DFBBB0

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\PanV2CredProv.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_CHINESE_TRADITIONAL.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\PanVcrediChecker.exe	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{bde618de-3b74-034f-b443-966861a24834}\pangpd.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\libwautils.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_GERMAN.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHipMp.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaheap.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\wa_3rd_party_host_32.exe	Jump to dropped file
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Dropped PE file which has not been started: C:\Windows\system32\DRIVERS\gpfltdrv.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\WdfCoinstaller01011.dll	Jump to dropped file
Source: C:\Windows\System32\drvinst.exe	Dropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{bde618de-3b74-034f-b443-966861a24834}\SET6DF9.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\PanPlapProvider.dll	Jump to dropped file
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Dropped PE file which has not been started: C:\Windows\system32\DRIVERS\pangpd.sys (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.sys	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_FRENCH.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\libwalocal.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaapi.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_JAPANESE.dll	Jump to dropped file
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\SET8C10.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHip.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\PanPlapApp.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.sys	Jump to dropped file
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Dropped PE file which has not been started: C:\Windows\System32\drivers\SET80A6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\wa_3rd_party_host_64.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\libwaresource.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_CHINESE.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\System32\PanCredProv.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPSupport.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_SPANISH.dll	Jump to dropped file

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	API coverage: 3.9 %
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	API coverage: 7.9 %

Source: C:\Windows\System32\svchost.exe TID: 7136

Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe

Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Last function: Thread delayed

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Code Cache\wasm FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Code Cache\js FullSizeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File Volume queried: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Cache\Cache_Data FullSizeInformation

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Code function: 8_2_00007FF8B8AFF950 FindFirstFileExW,	8_2_00007FF8B8AFF950
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Code function: 8_2_00007FF8B8AFFAD4 FindFirstFileExW,FindNextFileW,FindClose,FindClose,	8_2_00007FF8B8AFFAD4
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7E148E4 FindFirstFileExW,	19_2_00007FF8B7E148E4

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe

Code function: 8_2_00007FF8B8AF4D2C VirtualQuery,GetSystemInfo,

8_2_00007FF8B8AF4D2C

Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Local Storage\	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Local Storage\leveldb\	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	File opened: C:\Users\user\	Jump to behavior

Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: (P%u-T%u)%s(%4d): %02d/%02d/%02d %02d:%02d:%02d:%03d vmware, get our adapter name is %s
Source: PanGPS.exe, 00000006.00000003.3009033545.000002861A5A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netvsc_ppp.DeviceDesc = "Microsoft Hyper-V VPN Network Adapter"
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: (P%u-T%u)%s(%4d): %02d/%02d/%02d %02d:%02d:%02d:%03d DLSAV6, numVmwareIf = %d
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: (P%u-T%u)%s(%4d): %02d/%02d/%02d %02d:%02d:%02d:%03d try get vmware information
Source: PanGPS.exe, 00000006.00000003.3009033545.000002861A5A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{152fbe4b-c7ad-4f68-bada-a4fcc1464f6c}\ChannelReferences\1",,0x0,"Microsoft-Windows-Hyper-V-NETVSC/Diagnostic"
Source: PanGPS.exe, 00000006.00000003.3009033545.000002861A5A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DiskId1 = "Microsoft Hyper-V Network Adapter Installation Disk #1"
Source: PanGPS.exe, 00000006.00000003.3006710182.000002861A5A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ; ConnectX-4 Hyper-V VF
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: (P%u-T%u)%s(%4d): %02d/%02d/%02d %02d:%02d:%02d:%03d pangp virtual adapter switched by hyper-v
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: (P%u-T%u)%s(%4d): %02d/%02d/%02d %02d:%02d:%02d:%03d ignore 3323, an vmware adapter???
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: (P%u-T%u)%s(%4d): %02d/%02d/%02d %02d:%02d:%02d:%03d DLSAV6, ignore 5006, an vmware adapter???
Source: PanGPS.exe, 00000006.00000003.3009033545.000002861A5A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netvsc.DeviceDesc = "Microsoft Hyper-V Network Adapter"
Source: PanGPS.exe, 00000006.00000003.3009033545.000002861A5A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NETVSC/Diagnostic","OwningPublisher",0x0,"{152fbe4b-c7ad-4f68-bada-a4fcc1464f6c}"
Source: PanGPS.exe, 00000006.00000003.3009033545.000002861A5A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netvsc_eth.DeviceDesc = "Microsoft Hyper-V Ethernet Network Adapter"
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: CPanNetSetup::TrfExcludeLocalSubnet(P%u-T%u)%s(%4d): %02d/%02d/%02d %02d:%02d:%02d:%03d Traffic Enforcement: %s:numVmwareIf = %d
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: CPanNetSetup::RefreshDLSAV6Needed(P%u-T%u)%s(%4d): %02d/%02d/%02d %02d:%02d:%02d:%03d DLSAV6, numVmwareIf = %d
Source: PanGPS.exe, 00000006.00000003.3006710182.000002861A5A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ; ConnectX-4 non Hyper-V VF
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: (P%u-T%u)%s(%4d): %02d/%02d/%02d %02d:%02d:%02d:%03d found vmware adapter or virtual box adapter: %S
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: (P%u-T%u)%s(%4d): %02d/%02d/%02d %02d:%02d:%02d:%03d ignore 3982, an vmware adapter???
Source: PanGPS.exe, 00000006.00000003.3009033545.000002861A5A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NETVSC/Diagnostic","ChannelAccess",0x0,"O:BAG:SYD:(A;;0x2;;;S-1-15-2-1)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)"
Source: msedgewebview2.exe, 0000000D.00000002.3441253117.000002590DE46000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: PanGPS.exe, 00000006.00000003.3009033545.000002861A5A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netvsc_mbb_gsm.DeviceDesc = "Microsoft Hyper-V GSM MBB Network Adapter"
Source: PanGPS.exe, 00000006.00000003.3009033545.000002861A5A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HyperVNetworkAdapterName = "Hyper-V Network Adapter Name"
Source: PanGPS.exe, 00000006.00000003.3009033545.000002861A5A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ; Hyper-V Network Adapter Name
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: VMnet(P%u-T%u)%s(%4d): %02d/%02d/%02d %02d:%02d:%02d:%03d found vmware adapter switch: %S
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: VMwareVirtualBoxVMware Accelerated(P%u-T%u)%s(%4d): %02d/%02d/%02d %02d:%02d:%02d:%03d new vmware name inside windows, ignore it now
Source: PanGPS.exe, 00000006.00000003.3009033545.000002861A5A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NETVSC/Diagnostic","Isolation",0x00010001,0
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: (P%u-T%u)%s(%4d): %02d/%02d/%02d %02d:%02d:%02d:%03d found vmware adapter switch: %S
Source: PanGPS.exe, 00000006.00000003.3009033545.000002861A5A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NETVSC/Diagnostic","Enabled",0x00010001,0
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: (P%u-T%u)%s(%4d): %02d/%02d/%02d %02d:%02d:%02d:%03d ST,PANGP, found it, switch by hyper-v???
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: Switch(P%u-T%u)%s(%4d): %02d/%02d/%02d %02d:%02d:%02d:%03d PANGP, found it, switch by hyper-v???
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: (P%u-T%u)%s(%4d): %02d/%02d/%02d %02d:%02d:%02d:%03d DLSAV6, ignore index %d, it is a vmware adapter
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: (P%u-T%u)%s(%4d): %02d/%02d/%02d %02d:%02d:%02d:%03d PANGP, found it, switch by hyper-v???
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: (P%u-T%u)%s(%4d): %02d/%02d/%02d %02d:%02d:%02d:%03d numVmwareIf = %d
Source: PanGPS.exe, 00000006.00000003.3008694933.000002861A5A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: GenericScsiVmLun = "Hyper-V LUN"
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: (P%u-T%u)%s(%4d): %02d/%02d/%02d %02d:%02d:%02d:%03d ignore index %d, it is a vmware adapter
Source: PanGPS.exe, 00000006.00000003.3009033545.000002861A5A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netvsc_wifi.DeviceDesc = "Microsoft Hyper-V WiFi Network Adapter"
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: (P%u-T%u)%s(%4d): %02d/%02d/%02d %02d:%02d:%02d:%03d Traffic Enforcement: %s:numVmwareIf = %d
Source: PanGPS.exe, 00000006.00000003.3009033545.000002861A5A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netvsc_mbb_cdma.DeviceDesc = "Microsoft Hyper-V CDMA MBB Network Adapter"
Source: PanGPS.exe, 00000006.00000003.3009033545.000002861A5A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\{152fbe4b-c7ad-4f68-bada-a4fcc1464f6c}",,0x0,"Microsoft-Windows-Hyper-V-Netvsc"
Source: PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: (P%u-T%u)%s(%4d): %02d/%02d/%02d %02d:%02d:%02d:%03d new vmware name inside windows, ignore it now
Source: PanGPS.exe, 00000006.00000003.3009033545.000002861A5A1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HKLM,"SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Hyper-V-NETVSC/Diagnostic","Type",0x00010001,2

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe

Code function: 8_2_00007FF8B8AFE648 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

8_2_00007FF8B8AFE648

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe

8_2_00007FF8B8AF3B59

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe

8_2_00007FF8B8AF3B59

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe

Code function: 8_2_00007FF8B8AFCF80 GetProcessHeap,

8_2_00007FF8B8AFCF80

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Code function: 8_2_00007FF8B8B00EC8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00007FF8B8B00EC8
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Code function: 8_2_00007FF8B8AFE648 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00007FF8B8AFE648
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Code function: 8_2_00007FF8B8AF438C IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00007FF8B8AF438C
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7E0EF30 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_00007FF8B7E0EF30
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7E07A24 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	19_2_00007FF8B7E07A24
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Code function: 19_2_00007FF8B7E081FC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_00007FF8B7E081FC

Source: C:\Windows\System32\msiexec.exe	Process created: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe" -commit	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x110,0x160,0x164,0x140,0x16c,0x7ff8a7a58e88,0x7ff8a7a58e98,0x7ff8a7a58ea8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=MojoIpcz /prefetch:2	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2516 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=MojoIpcz /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=3000 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=MojoIpcz /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1730120263967503 --launch-time-ticks=4791055134 --mojo-platform-channel-handle=3408 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=MojoIpcz /prefetch:1	Jump to behavior

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=pangpa.exe --webview-exe-version=6.3.1-376 --user-data-dir="c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --enable-features=mojoipcz --mojo-named-platform-channel-pipe=5408.6692.18028064762265798369
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview\crashpad" --annotation=isofficialbuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=win64 "--annotation=prod=edge webview2" --annotation=ver=117.0.2045.47 --initial-client-data=0x110,0x160,0x164,0x140,0x16c,0x7ff8a7a58e88,0x7ff8a7a58e98,0x7ff8a7a58ea8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" --webview-exe-name=pangpa.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=1792 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=mojoipcz /prefetch:2
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --noerrdialogs --user-data-dir="c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" --webview-exe-name=pangpa.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2516 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=mojoipcz /prefetch:3
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-gb --service-sandbox-type=service --noerrdialogs --user-data-dir="c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" --webview-exe-name=pangpa.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=3000 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=mojoipcz /prefetch:8
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" --webview-exe-name=pangpa.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --first-renderer-process --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1730120263967503 --launch-time-ticks=4791055134 --mojo-platform-channel-handle=3408 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=mojoipcz /prefetch:1
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=pangpa.exe --webview-exe-version=6.3.1-376 --user-data-dir="c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --enable-features=mojoipcz --mojo-named-platform-channel-pipe=5408.6692.18028064762265798369	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview\crashpad" --annotation=isofficialbuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=win64 "--annotation=prod=edge webview2" --annotation=ver=117.0.2045.47 --initial-client-data=0x110,0x160,0x164,0x140,0x16c,0x7ff8a7a58e88,0x7ff8a7a58e98,0x7ff8a7a58ea8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" --webview-exe-name=pangpa.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=waaaaaaaaadgaaamaaaaaaaaaaaaaaaaaabgaaaaaaa4aaaaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaagaaaaaaaaaayaaaaaaaaaagaaaaaaaaacaaaaaaaaaaiaaaaaaaaaa== --mojo-platform-channel-handle=1792 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=mojoipcz /prefetch:2	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --noerrdialogs --user-data-dir="c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" --webview-exe-name=pangpa.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2516 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=mojoipcz /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.storageservice --lang=en-gb --service-sandbox-type=service --noerrdialogs --user-data-dir="c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" --webview-exe-name=pangpa.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=3000 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=mojoipcz /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Process created: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe "c:\program files (x86)\microsoft\edgewebview\application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="c:\users\user\appdata\local\palo alto networks\globalprotect\gpaedge\captiveportalurl\ebwebview" --webview-exe-name=pangpa.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --first-renderer-process --lang=en-gb --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_ch" --time-ticks-at-unix-epoch=-1730120263967503 --launch-time-ticks=4791055134 --mojo-platform-channel-handle=3408 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=mojoipcz /prefetch:1	Jump to behavior

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe

Code function: 8_2_00007FF8B8B04F80 cpuid

8_2_00007FF8B8B04F80

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

19_2_00007FF8B7DFBBB0

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\Trust Protection Lists\manifest.json VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\WidevineCdm\manifest.json VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\Fonts\segoeuib.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe	Queries volume information: C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Network\SCT Auditing Pending Reports VolumeInformation
Source: C:\Windows\System32\drvinst.exe	Queries volume information: C:\Windows\System32\DriverStore\Temp\{bde618de-3b74-034f-b443-966861a24834}\pangpd64.cat VolumeInformation
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Queries volume information: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log VolumeInformation

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe

Code function: 8_2_00007FF62C3EE5EC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

8_2_00007FF62C3EE5EC

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

Code function: 19_2_00007FF8B7E04BC8 GetVersionExW,EnterCriticalSection,GetLastError,_snwprintf_s,LeaveCriticalSection,GetLastError,_snwprintf_s,

19_2_00007FF8B7E04BC8

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: PanGPS.exe, 00000006.00000003.3017385751.000002861A5F9000.00000004.00000020.00020000.00000000.sdmp, PanGPS.exe, 00000006.00000003.3015609756.000002861A5F9000.00000004.00000020.00020000.00000000.sdmp, PanGPS.exe, 00000006.00000003.3017683829.000002861A5FA000.00000004.00000020.00020000.00000000.sdmp, PanGPS.exe, 00000006.00000003.3017563730.000002861A5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PGSETUP.EXE
Source: PanGPS.exe, 00000006.00000003.3017385751.000002861A5F9000.00000004.00000020.00020000.00000000.sdmp, PanGPS.exe, 00000006.00000003.3015609756.000002861A5F9000.00000004.00000020.00020000.00000000.sdmp, PanGPS.exe, 00000006.00000003.3017683829.000002861A5FA000.00000004.00000020.00020000.00000000.sdmp, PanGPS.exe, 00000006.00000003.3017563730.000002861A5F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 123.exe

Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION			Jump to behavior
Source: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION			Jump to behavior

Stealing of Sensitive Information

Modifies the DNS server

Source: C:\Windows\System32\svchost.exe

Registry value created:

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Replication Through Removable Media	1 Native API	1 Scripting	1 LSASS Driver	1 Deobfuscate/Decode Files or Information	1 Network Sniffing	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 LSASS Driver	1 DLL Side-Loading	1 Obfuscated Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	1 DLL Side-Loading	41 Windows Service	1 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	41 Windows Service	11 Process Injection	1 DLL Side-Loading	NTDS	1 Network Sniffing	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	11 Registry Run Keys / Startup Folder	11 Registry Run Keys / Startup Folder	1 File Deletion	LSA Secrets	56 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	133 Masquerading	Cached Domain Credentials	2 Query Registry	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	51 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	2 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Process Injection	/etc/passwd and /etc/shadow	1 Process Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
GlobalProtect64-6.3.1.msi	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_CHINESE.dll	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_CHINESE_TRADITIONAL.dll	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_FRENCH.dll	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_GERMAN.dll	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_JAPANESE.dll	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_SPANISH.dll	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPSupport.exe	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHip.exe	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHipMp.exe	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\PanVcrediChecker.exe	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\PsvCtrl.dll	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\WdfCoinstaller01011.dll	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\WebView2Loader.dll	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.sys	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\libwaapi.dll	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\libwaheap.dll	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\libwalocal.dll	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\libwaresource.dll	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\libwautils.dll	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.sys	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\wa_3rd_party_host_32.exe	0%	ReversingLabs
C:\Program Files\Palo Alto Networks\GlobalProtect\wa_3rd_party_host_64.exe	0%	ReversingLabs
C:\Windows\System32\DriverStore\Temp\{bde618de-3b74-034f-b443-966861a24834}\SET6DF9.tmp	0%	ReversingLabs
C:\Windows\System32\DriverStore\Temp\{bde618de-3b74-034f-b443-966861a24834}\pangpd.sys (copy)	0%	ReversingLabs
C:\Windows\System32\PanCredProv.dll	0%	ReversingLabs
C:\Windows\System32\PanPlapApp.exe	0%	ReversingLabs
C:\Windows\System32\PanPlapProvider.dll	0%	ReversingLabs
C:\Windows\System32\PanV2CredProv.dll	0%	ReversingLabs
C:\Windows\System32\drivers\SET80A6.tmp	0%	ReversingLabs
C:\Windows\System32\drivers\SET8C10.tmp	0%	ReversingLabs
C:\Windows\system32\DRIVERS\gpfltdrv.sys (copy)	0%	ReversingLabs
C:\Windows\system32\DRIVERS\pangpd.sys (copy)	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://chrome.cloudflare-dns.com/dns-query	0%	URL Reputation	safe
http://www.openssl.org/support/faq.html	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://chrome.cloudflare-dns.com/dns-query	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.openssl.org/support/faq.html(P%u-T%u)%s(%4d):	PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	false		unknown
http://127.0.0.1Software	PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	false		unknown
https://gp.test.com/small_filetrace	PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	false		unknown
http://127.0.0.1	PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	false		unknown
https://gp.test.com/small_file	PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	false		unknown
https://gp.test.com/big_file	PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	false		unknown
http://www.openssl.org/support/faq.html	PanGPS.exe, 00000006.00000000.2978860740.00007FF6758FF000.00000002.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.159.61.3	chrome.cloudflare-dns.com	United States		13335	CLOUDFLARENETUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543859
Start date and time:	2024-10-28 15:14:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	GlobalProtect64-6.3.1.msi
Detection:	SUS
Classification:	sus28.troj.spyw.evad.winMSI@24/837@4/2
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .msi Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.190.159.23, 20.190.159.4, 20.190.159.64, 20.190.159.2, 20.190.159.75, 40.126.31.71, 20.190.159.68, 40.126.31.69, 13.107.42.16, 184.28.90.27, 142.250.113.94, 142.250.115.94
Excluded domains from analysis (whitelisted): client.wns.windows.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, config.edge.skype.com.trafficmanager.net, otelrules.azureedge.net, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, l-0007.config.skype.com, config-edge-skype.l-0007.l-msedge.net, e16604.g.akamaiedge.net, www.gstatic.com, l-0007.l-msedge.net, prod.fs.microsoft.com.akadns.net, config.edge.skype.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target msedgewebview2.exe, PID 5004 because there are no executed function
Execution Graph export aborted for target msedgewebview2.exe, PID 6980 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
VT rate limit hit for: GlobalProtect64-6.3.1.msi

Simulations

Behavior and APIs

Time	Type	Description
10:17:34	API Interceptor	2x Sleep call for process: svchost.exe modified
15:17:23	Autostart	Run: HKLM64\Software\Microsoft\Windows\CurrentVersion\Run GlobalProtect "C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
162.159.61.3	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Payment for outstanding statements.pdf	Get hash	malicious	HTMLPhisher	Browse
	setup.msi	Get hash	malicious	Unknown	Browse
	http://74.248.121.8/d/msdownload/update/software/defu/2024/10/updateplatform.amd64fre_d3f6f8300855e56b8ed00da6dac55a3c4cbf8c20.exe?cacheHostOrigin=au.download.windowsupdate.com	Get hash	malicious	Unknown	Browse
	Demande de proposition du CPE Les Coquins.pdf	Get hash	malicious	Unknown	Browse
	Demande de proposition du CPE Les Coquins.pdf	Get hash	malicious	Unknown	Browse
	roquette October.pdf	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	setup.msi	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://2007.filemail.com/api/file/get?filekey=58mKUrTMdlmzqkRvo0UdVa2TMjJTCQiSNv5rUBtsDQTNU0dM4JzppUJaOrP_mWxCym0k9l5xEDeaXunPsHq6frY8XZH_gnclw86MefA3bpAlGuDkr77-xSqrMOQIlMdW5cRjwoOSCWIlTwpC48cNKMMHhMKp&track=P8fpm4ry&pk_vid=8a8b18f03738ae4f17297703684d559d	Get hash	malicious	HTMLPhisher	Browse	172.64.41.3
	http://74.248.121.8/d/msdownload/update/software/defu/2024/10/updateplatform.amd64fre_d3f6f8300855e56b8ed00da6dac55a3c4cbf8c20.exe?cacheHostOrigin=au.download.windowsupdate.com	Get hash	malicious	Unknown	Browse	162.159.61.3
	https://t.ly/2jKWO	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	172.64.41.3
	https://t.ly/2jKWO	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	172.64.41.3
	https://www.filemail.com/t/cFCAI9C4	Get hash	malicious	HtmlDropper	Browse	172.64.41.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	EwKKdCrEDu.exe	Get hash	malicious	Unknown	Browse	188.114.97.3
	Salary_Structure_Benefits_for_I.e.van.groenesteinIyNURVhUTlVNUkFORE9NMTkjIw==.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Salary_Structure_Benefits_for_SridenourIyNURVhUTlVNUkFORE9NMTkjIw==.html	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	W9f3Fx6sL4.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	come.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	188.114.97.3
	INVOICE.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s553e3fe901654d86bcc4ed44c7c05dd3&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0V1a19QbFZsQVlaTnZNVHRSTWZBWGRNQmtvbDQ2b1NlN1o5MGFiazNzS3lGSlE_ZT1UMnQ4S3Y&wd=target%28Sezione%20senza%20titolo.one%7C8d7e5173-6006-4648-a69d-e39e66e7041a%2FAblehnung%20Rechnung%20R15946098273-KU30_WE02%20Vom%2028%5C%2F%7Cd77916b9-b471-429a-a13e-74764563e56b%2F%29&wdorigin=NavigationUrl	Get hash	malicious	HTMLPhisher	Browse	104.21.79.135
	Okfjk1hs4kdhs2.exe	Get hash	malicious	LummaC	Browse	104.21.9.13
	QUOTATION_OCTQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	33537
Entropy (8bit):	5.841403323070531
Encrypted:	false
SSDEEP:	768:vLweskXz7fTIxuSeXC/0w5Pl+yNJm2GiijPDixzGHkRtUDvC19PKNFRjtnoA35xS:DweskXz7fTIxuSeXC/0w5Pl+yNJm2GiZ
MD5:	3BFE94E346AEF2BF07BCDECDA16D5303
SHA1:	8CFE23AA091221C29880F01AD4B7CDBA28C224DD
SHA-256:	FB6611094A71E7F1005FABE8FEF397E0244CE720DA1DB25DA9E759267B3687B0
SHA-512:	01EB6900B861516DDCD4929F9DD30DEDC3431D944911329C92DF38AB2C92DD55E5EA0BC2B006FAE1AADD866EE044E556B5896C95D640DC06574561A36D955B05
Malicious:	false
Preview:	...@IXOS.@.....@'R\Y.@.....@.....@.....@.....@.....@......&.{62BC3D77-3D5D-4821-B162-5BF52C6B11AF}..GlobalProtect..GlobalProtect64-6.3.1.msi.@.....@.....@.....@......_853F67D554F05449430E7E.exe..&.{EE37356D-D07C-43F6-8D20-35139031CF9B}.....@.....@.....@.....@.......@.....@.....@.......@......GlobalProtect......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{147E1698-DF2D-C421-588B-1BEC0AE53B84}&.{62BC3D77-3D5D-4821-B162-5BF52C6B11AF}.@......&.{86766B4C-0308-5776-EEEE-BF0F68AD410C}&.{62BC3D77-3D5D-4821-B162-5BF52C6B11AF}.@......&.{F7D8C07A-6492-6E55-F9CA-4FD419353CE3}&.{62BC3D77-3D5D-4821-B162-5BF52C6B11AF}.@......&.{515B27B7-8E96-8C09-4BF1-4C86A1369093}&.{62BC3D77-3D5D-4821-B162-5BF52C6B11AF}.@......&.{CEF533B3-20F7-AAE0-2239-993BDC6F874D}&.{62BC3D77-3D5D-4821-B162-5BF52C6B11AF}.@......&.{84B784F4-BC1D-9C03-459A-845616284755}&.{62BC3D77-3D5D-4821-B162-5BF52C6B11AF}.@......&.{7A12B956-5961-F

C:\Program Files\Palo Alto Networks\GlobalProtect\Connected.bmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PC bitmap, Windows 3.x format, 106 x 112 x 24, image size 35842, resolution 5668 x 5668 px/m, cbSize 35896, bits offset 54
Category:	dropped
Size (bytes):	35896
Entropy (8bit):	5.863869084757977
Encrypted:	false
SSDEEP:	384:sdg04dlgwicSg/1DPsQryPoqx1CP3CStGKEhhGY9zzGKcDMyFIWnt:si04dlgwibg/VP3ygUwkXXMFRt
MD5:	9ADB0FBD8A5A08422AFFF58D27B5DFB5
SHA1:	57E3084A8CB347679AB21B901D3E281BB6759325
SHA-256:	5827D6F83617DAE8FA63963C318F36BAA978E66C532A5EF34FC38FA6E7AB99EC
SHA-512:	2DEE9C28FECE114B43E3852A9DC046E37F369AE9147D8E40C88F928F8E6DC4F53FC7495162215AA0F86817BA017D06B898F3025C262C83E2CBDD848B74333404
Malicious:	false
Preview:	BM8.......6...(...j...p...............$...$.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\ConnectedFail.bmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PC bitmap, Windows 3.x format, 106 x 112 x 24, image size 35842, resolution 5668 x 5668 px/m, cbSize 35896, bits offset 54
Category:	dropped
Size (bytes):	35896
Entropy (8bit):	5.65145534605385
Encrypted:	false
SSDEEP:	384:6cN070WeNl433QZasldPsiC/h1bYyVsctEUGwZEUR9Q66Fqgc7jW67GyiGX64zNg:SwHl43gZtD0T7sYw/66Fqgsjldq
MD5:	FAB748173122877AFF2FFE9BB46C5515
SHA1:	88AE0759F4858C08BC24FA9D21439F0A272A536E
SHA-256:	12F12EAAC7630DA461D5532B7F7C06E13F615C7B8542C0A9FAC31696A59F1F17
SHA-512:	6D45F1447631C9A75DA2D78D4D6F55526F0C0867A74B7315DFE9368372E1256222DC0BB9D5A854E5DC19AF8DFCF1386CBB50E382B079466F2332F7AFED1357AE
Malicious:	false
Preview:	BM8.......6...(...j...p...............$...$............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\ConnectedInternal.bmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PC bitmap, Windows 3.x format, 106 x 112 x 24, image size 35842, resolution 5668 x 5668 px/m, cbSize 35896, bits offset 54
Category:	dropped
Size (bytes):	35896
Entropy (8bit):	5.936915344223492
Encrypted:	false
SSDEEP:	384:dTXNgXU2FeMA85Rc9xF7iLEA1Gzcfk5gV30yoc:dzNH2QMf5RcpMR+cC+3d
MD5:	619F1B08AA639F872325BACC337C07B9
SHA1:	B4164EE2619E14CB450F2DB6AAD5F9D805DA3010
SHA-256:	C16E81075EA202363D6870FB0F2BB7BDF7006AC46EEE554C9C6A6B242EBE28F2
SHA-512:	B2F878AD4F5B9008B69EAB99E609B0588EDFC5A18116B05F0AAC7EA535FF276A914E99CF392DA8BBD4EA48CE4DDF45EAF19279561D4A76B4FC52D627B42C8269
Malicious:	false
Preview:	BM8.......6...(...j...p...............$...$.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\ConnectedNone.bmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PC bitmap, Windows 3.x format, 106 x 112 x 24, image size 35842, resolution 5668 x 5668 px/m, cbSize 35896, bits offset 54
Category:	dropped
Size (bytes):	35896
Entropy (8bit):	5.531594909936363
Encrypted:	false
SSDEEP:	384:7NWV5b/GZ9m4y5mz2K1WLRXLqIMq+OwxWefvTbW6QPHcfsawq0zCEfEgw:0VJ/GzmD5K3ERbqIFnaH3W6AH0z0Bw
MD5:	8772D53AAE99B7CE8E2D764D9E39E8A6
SHA1:	5982EB1F521F47FF3A04D3611A04620EB02DD57E
SHA-256:	9FB7DD4B421EF3EF199BE518031AD615F488EE4C44177B471B068C6053D18BAB
SHA-512:	C1071D58271C585709BB55251AA190B5B935E02AB969AE0CD936BC2BBB6BD0383A78F2588EA43C9447533EB02BF20F908805C0A82B9977EB94962061006144D3
Malicious:	false
Preview:	BM8.......6...(...j...p...............$...$.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\Connecting.avi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	RIFF (little-endian) data, AVI, 88 x 88, 10.00 fps, video:
Category:	dropped
Size (bytes):	372328
Entropy (8bit):	3.9221788837398104
Encrypted:	false
SSDEEP:	6144:uj5Rj5Dj5pj5dj5nj5qBuqj5fj5Wj5Yj5Hj5Vj54j5b38Nj5k:uj5Rj5Dj5pj5dj5nj5qBuqj5fj5Wj5YO
MD5:	73D63A2508E2DFFC0AD80010FE97A47A
SHA1:	CB6F2F4D77DF3CA95B0E64DF7A67DC19B3471121
SHA-256:	8F8C4EFB5F546E71A6928627B07FDB7FCD9FAC1AB8CCC7EB6C0CA7D16C52C1E4
SHA-512:	EF1342E96DB6C00F1B37976F50D3B22A39B1C7568F98EE46A9A377C44488D2F8615D29A55CE3E0695186952510F1C8E670AAA7AD18A4EE188770304D67ED35EA
Malicious:	false
Preview:	RIFF`...AVI LIST....hdrlavih8................................Z..X...X...................LISTt...strlstrh8...vidsDIB ................@B...........Z..............X.X.strf(...(...X...X............Z..................LIST....movi00db.Z..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\Connecting.bmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PC bitmap, Windows 3.x format, 83 x 83 x 24, image size 20916, cbSize 20970, bits offset 54
Category:	dropped
Size (bytes):	20970
Entropy (8bit):	3.842563948689852
Encrypted:	false
SSDEEP:	384:wCPITtskAkzGnMkztntyfNdAPktBkZkJCkPkQYk1vPUg+JkHSgkwW9oV9nEwe6HF:wCPITtskAkzGnMkztntyfNdAPktBkZkJ
MD5:	F5BF14AC5EEC10973A49C4E78225910E
SHA1:	79D8DF686F52FE5D2464D771BC003D4406ECD5E2
SHA-256:	D9A94BCDA2A5B2E90DDD97494E361C27B68ACB18D9AEF2267F1F774CF8C35FDD
SHA-512:	EC166010D59FB0A910A1FE213D9314E2E98373505FB465AFF76D24DC593629D64AB46D7DAD66911B31F965FE2E944A1237F97395A48FFE4A5248F93C2582EB83
Malicious:	false
Preview:	BM.Q......6...(...S...S............Q....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\DEM64.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {F9DDF353-9E3A-4895-8363-68BBB8975543}, Number of Words: 2, Subject: Access Experience, Author: Palo Alto Networks, Name of Creating Application: Access Experience, Template: x64;1033, Comments: Installs the services required for the Palo Alto Networks' Access Experience., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	19704832
Entropy (8bit):	7.932677245541872
Encrypted:	false
SSDEEP:	393216:L4++n6eLj/hssBw42oLUs24UcRxP1nxmfu3xb4x3EHxDYegMd:U+BAjCkJ2oz24531x2MxEdEHxUk
MD5:	C86935C1387D036155663CB74DAD53D6
SHA1:	8B00E951D3036409C165CF5B7FDD08D4AFF3A9B9
SHA-256:	43932B3E084870B7C25EAEFB5547BDDC463973066F655699BCCC84A0251B9A6D
SHA-512:	CDD0F5C4E34DE1ABD0C5155998EEAF8A499EF7E30E4939080EE6752CDE76FDB62336D4FAE3D76356072D5B267E98D85621CFA2750234DAF154B4245CE4CD5B30
Malicious:	false
Preview:	......................>...................-...................................v.......!..."...#...$...%...&...u...v...w...x...y...z...{...\|...}.......................................................................r.......n...o...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...{...\|...}...~...................................................................................................................................................................................................>...............3................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...?...4...5...6...7...8...9...:...;...<...=...........@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...w.......x...y...z...

C:\Program Files\Palo Alto Networks\GlobalProtect\Decimal-Medium-Pro.otf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	156184
Entropy (8bit):	5.659699243637914
Encrypted:	false
SSDEEP:	3072:QrAEBEeYt5rVXNLfv+ad38LJYWQmkdkJSHkVKG:QrAE6Rt5rNNrX5fyJHEG
MD5:	A754D31D11186B8F1370B8382ACB1118
SHA1:	36955F22EB4CD9CB9C8820418B59B808DECB5275
SHA-256:	A8AD7F4D6E1FFB353CC1BB5AB32C4B0D5C9F75451A21A0D374EFEBCA745B8B5D
SHA-512:	2C024B3AB844FA266E0E72A8A1468411AEA4B6B8538A9A2A400F2F82A23C38B2BE6FC7931057A044A9D39E0FBB084BA87C348675B34BDED8EC9ACA85C11068D0
Malicious:	false
Preview:	OTTO.......PCFF ..(...!.....DSIG......b.....GPOS.bm.........GSUB.b1...T\..%\|OS/2.4.9...@...`cmap.4&K...l...>head.].........6hhea...........$hmtx.k....y.....kern..*.........maxp..P....8....name...\........post......!.... ........$..._.<....................@.........................8.1...@.@......................P..........^.......X...K...X...^...A..................`.........H&Co....... .8..................... .................:.............:...........A...........G...........f...........t.....................Z.......................................................................+.............:...........A.............................................................................................t.0.................................>.......................".........................J.................................$...........$.............<.........V.@................................."...........&.........................&...........<.........$.T.........&.xCopyright (C) 2019 Hoefler

C:\Program Files\Palo Alto Networks\GlobalProtect\Lato-Regular.ttf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	TrueType Font data, 16 tables, 1st "GPOS", 30 names, Macintosh, Copyright (c) 2011-2015 by tyPoland Lukasz Dziedzic (http://www.typoland.com/) with Reserved Fon
Category:	dropped
Size (bytes):	657212
Entropy (8bit):	6.571688424286861
Encrypted:	false
SSDEEP:	12288:SdiODE6EwpTuDgQHGKlAqsdzgJwSjz+uVDe9hj:S0OSVgQHGKlAqsRawSji3D
MD5:	3B9B99039CC0A98DD50C3CBFAC57CCB2
SHA1:	F59F9E4F3CBEE981A5E6F58A279F9B9613F22599
SHA-256:	6F6940BE0835C3DDEC9199E5FC42BE4CBC61EBCFD58C623FDF719366253F1780
SHA-512:	2E81CB0ED1F26DED89D9756EC98A42581759D29BF605F964EA384C55112E7AD04A12E6D945310DDE0098CEA5459DE5530E4F900D550B4605EC2762CE2A61D4EC
Malicious:	false
Preview:	............GPOS.l.?...\..6rGSUBl..x......$lOS/2j.........`cmapP.....1$....cvt :(....R ....fpgm......E.....gasp.......T....glyfBd.....H....head.8.........6hhea.......D...$hmtx...%....../<loca+.....S.../@maxp...j...h... name..........:post.1.Y...4... prepo.i:..Qd..............97_.<...........y......7......}.m...................V.........}...................................P.`.w.............T.......x.......x.......Y.&................P......!....tyPL.@.....J.z...... .............. ...'.-.........J...H...E.......8._.8._.................k.....^.........0...1.b.M...-....... .......A...........A.^.A.^...`.........A._.....=.B.=.B.......-.........J.................5...A...A.J.D.`.....T...T. .T...T.z.T.\|.T.`.V.`.V.a.W.l.R. .S. .S.../.$./.../.3./.../.../.y.1.y.1.x.1.y.1.x.1.y.1.x.1.x.1.y.1...1.../...1...1...1...1...1...1...1.y.1...1.../.2.1...1.../.Y./...1...>.`.V.\...\...\.....q...=.......c.................i.+.....m...\...\...n.T.m.K...T.a...a...`.V.....b.C.b.C.8.C.9.C.....8.1...+...)....._.+

C:\Program Files\Palo Alto Networks\GlobalProtect\Lato-Semibold.ttf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	TrueType Font data, 16 tables, 1st "GPOS", 34 names, Macintosh, Copyright (c) 2011-2015 by tyPoland Lukasz Dziedzic (http://www.typoland.com/) with Reserved Fon
Category:	dropped
Size (bytes):	669228
Entropy (8bit):	6.573016480211004
Encrypted:	false
SSDEEP:	12288:oKKKbKKKrKKKrKKKkBxGaX0D2caWVsgtDSjd9RjKLAURe9rCoc0AXE4A6evmoU:oKKKbKKKrKKKrKKKd/aQDe7sAJ9e0ABv
MD5:	3C6CFB1AEBD888A0EB4C8FBA94140FA6
SHA1:	96569E2CFCC3A298BB1AEA21103D0D1E3C7E2ED4
SHA-256:	2DC5D31E2CF1E29F3430EB2DFA1BA9911E08EE401B61DD12F40E0ACB047A17A3
SHA-512:	509ABB792C29CF9433E46D087F005CF1358F5496FAA9769F0C3DD3372428E465B9A12BC59CE61B8EAFBCA3E5F92724BD1D5692DF24D51C154E247E57B9E0F985
Malicious:	false
Preview:	............GPOS..;Z.....6.GSUBl..x......$lOS/2j.........`cmapP.....1$....cvt ;..9..R ....fpgm......E.....gasp...........glyf.90....H..A.head...........6hhea.......D...$hmtx.c......../<loca+..z..S.../@maxp...~...h... name.].x........post.5.`...... prepo.i:..Qd............h8{=_.<...........y......7............................V.............................................P.`.w.............^.X.....x.......x.......`..................P......!....tyPL.@.....J.z...... .............. ...8.+.........]...[...G.......1.U.1.U.................k.....T.........A...B.d.T...E.......(.......R...........I.T.I.T.{.V.........I.U.....C.7.C.7.......+.........]...'...(.............9...9.O.;.h.....K...K...K...K...K...K.h.M.h.M.i.N.q.I.&.J.&.J...,.8.,...,.E.,.2.,...,...-...-...-...-...-...-...-...-...-...-...,...-...-...-...-...-...-...-...-...-...,.d.-...-.1.,.q.,...-...7.h.M.b...b...b.....h...@.....".\...................).....}...b...b...v.K.u.=...K.i...i...h.M.....i.9.i.9.M.9.N.9.....K.-...&...%...).o.&

C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13805856
Entropy (8bit):	6.429794779361294
Encrypted:	false
SSDEEP:	196608:NW50ise144H1sZPVzS3m+LUtFLOyomFHKnPK0:NWqisevH6o3mrFi
MD5:	300C8D493829B89674AB840CF163A111
SHA1:	4565D4EBE4B34EB6F8AE9DFB55DB64987227E8B5
SHA-256:	F464A8BC54F677A89511CCF543061738349961E5BD4CE1D0C2A8B5E227370CB9
SHA-512:	72AADED96FCB5CF0026A0A7CD0555045CF8260173EF61CC2FC0188D7A1BFE4B0446FA128E185E06B363A976E474A115698E9A71241C877683BE266C63089A94D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$.........>..P..P..P...S..P.H>...P...W..P...T...P...U.:.P...V..P...T...P...S..P...U.F.P.....P...Q...P..Q..P..P..P.s.T..P.s.Y.p.P.s....P....P.s.R..P.Rich.P.........................PE..d......f.........."......&L..P......`.F........@....................................H!....`...................................................j......pw.@.Z...t. ....... )......d...0.a.p.....................a.(.....a..............@L..............................text....$L......&L................. ..`.rdata..J....@L......*L.............@..@.data........j.......j.............@....pdata.. .....t......zs.............@..@.rsrc...@.Z..pw...Z..Pv.............@..@.reloc..d...........................@..B................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.170721372809223
Encrypted:	false
SSDEEP:	48:gAW4jSSPvBv0fcxJMVBXO4Ba/dnUASukq+EQItyab+3Z0jpKFTpdd:bFSSxvrJMjXO4B4dnLV+5ItygKLz
MD5:	B9272CBEDEAA100A55E5002DC0301C6F
SHA1:	8349D7352840CD594A37ACD601607A37EEF4A715
SHA-256:	A8A3B7400D8A3C66B856FE2F30F6BA4AB7595DEF8453D2D1564B5822CBBB07BA
SHA-512:	2E479FD63F81B2B1C50534C61CAFEBA5F0573FEF865DC75E8C08B9D507C4E4B32BF87D6F3B4172CE57649B88D34ED6FD41BBD4734F90D0E6436F9ED5209EE9BF
Malicious:	false
Preview:	...... .... .........(... ...@..... .................................................................................................................;;;.;;;.<<<.<<<.<<<............................................................................}..S'..%............;;;.<<<.<<<o<<<.<<<n<<<.<<<.<<<........................................................X.......[..M..............MSQIF;;<.<<<.<<<.<<<.<<<.<<<<:::.;;;............................................q.............F..C...............y.FEB.;;<.<<<.<<<.<<<.<<<.<<<.<<<g;;;.;;;.................................D...................O......h.........q.CC@.;;<.<<<.;;;.<<<.;;;.<<<.<<<.<<<.<<<.;;;.;;;.........................`.......................W.....:......\|.CB@.;;;.;;;.@@@.DDD.:::.CCC.AAA.;;;.<<<.<<<.<<<x888.....................`..........................b...../...J.XUI.::;.;;;.AAA.........^^^.........BBB.;;;.<<<.<<<.;;;:................C.................

C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_CHINESE.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4570400
Entropy (8bit):	5.305407915680498
Encrypted:	false
SSDEEP:	24576:+CAR8pFpAMcf9Hnh6D5cepfG9GsYgUOUpUQh8oL9wRT7PY:+zQgc53mIpLGRTLY
MD5:	6D0BAD081A48FB5757F9C2A3FC3C8D53
SHA1:	4C016451AC022B9403484BD3EBE66C818AFEA54A
SHA-256:	5640CEDBF1084B07B7D7663D960E73573A00C2262924051F6B98A58FDCDAC576
SHA-512:	2917D145BE9E759C652D120EE39997C4355C1879DE424B34E3C67CAE4C5706CC3B6351354B2AC21E7A3810C9BEC937BC191B649931BF4FFF3EB570CDD0424EA6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................Z......Z.~.............Z......Rich............PE..d...i..f.........." ..........E...............................................E......^F...`.........................................p...<............ ....E...........E. )..............p............................................................................rdata..............................@..@.rsrc.....E.. ....E.................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_CHINESE_TRADITIONAL.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4570912
Entropy (8bit):	5.3063839242344795
Encrypted:	false
SSDEEP:	24576:yCAR8pFpAMlf9Hnh6D5cepfG9GsYgUOUpUQh8oL9wRT7PM:yzQgj53mIpLGRTLM
MD5:	F964A6B4FB93C30473F94D7ABA3B35C1
SHA1:	ED075BD9679F48CA0DC0461CD6B1F6D37EC70A2E
SHA-256:	524BE2565BC48FD52674C20FAB40871B424B499392195C9F1A8498706D80C68A
SHA-512:	2D525F07ABBF18D17F0642A156596EF7D9C79130033F44823F486AB9ED33D49A52E8861A43148BAF5645DC533A866736F95B377804999657509CFCAF251FB222
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................Z......Z.~.............Z......Rich............PE..d...g..f.........." ..........E...............................................E.....6.F...`.........................................p...H............ ....E...........E. )..............p............................................................................rdata..............................@..@.rsrc.....E.. ....E.................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_FRENCH.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4629280
Entropy (8bit):	5.316210027078527
Encrypted:	false
SSDEEP:	24576:tCAR8pFpAMmf9Hnh6D5cepfG9GsYgUOUpUQh8oL9wRT7PF:tzQgm53mIpLGRTLF
MD5:	A5F8B2F5F96B2C53B3DE8E424E8EB94C
SHA1:	D95334A394DE5435876753D420F9C3135B4885B7
SHA-256:	8813AEDB39EB257B89D6708C86FD5F570E7A85D0A35BED184D19AE1A645D4F3E
SHA-512:	397A340E943D68E1EF280CED7A0C42E1348A72A7CECCD365F289672382030CF97A646CF40A0D2FD4A639CCA4ED90F091C2D6D2411FE3A54EB0E63D2125C376C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................Z......Z.~.............Z......Rich............PE..d...u..f.........." .........vF...............................................F.......F...`.........................................p...<............ ...sF..........zF. )..............p............................................................................rdata..............................@..@.rsrc....sF.. ...tF.................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_GERMAN.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4626208
Entropy (8bit):	5.315681411443751
Encrypted:	false
SSDEEP:	24576:HCAR8pFpAMPf9Hnh6D5cepfG9GsYgUOUpUQh8oL9wRT7PI:HzQgd53mIpLGRTLI
MD5:	919ACF2095C071B01D1AF8E297598DC4
SHA1:	DE2220BE899408440054CD3C60C7FBAAAB2EAD19
SHA-256:	822AA3B7A15A3FFD4945EF68C3CC2FE2F25B451F9A1F46895424EF5394B474BF
SHA-512:	3AD57F8C792F84BC5A2DBCFF97B3F212495D3FCFE730AD7E763C79572BF4C95F65270E5B2A3D7A1AA67461C80BCA91FA12719AE2BD0EE95E6375AB9158488F85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................Z......Z.~.............Z......Rich............PE..d......f.........." .........jF...............................................F.......G...`.........................................p...<............ ...fF..........nF. )..............p............................................................................rdata..............................@..@.rsrc....fF.. ...hF.................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_JAPANESE.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4584224
Entropy (8bit):	5.314927095013855
Encrypted:	false
SSDEEP:	24576:YCAR8pFpAMvf9Hnh6D5cepfG9GsYgUOUpUQh8oL9wRT7PKs:YzQgt53mIpLGRTLKs
MD5:	48613CA9D7D0CA65FD7AE4A68D31AB62
SHA1:	FD0EE3CB065DF9BFB591CDEC2544249C1EFBF220
SHA-256:	CC05F4095534A71DD9D4E3DB80C9A5EB5DB9D577552F7AF6F7DAA266F8931EF1
SHA-512:	D35B5E58C03E4EE9E660B9B4BF96B48770CDE727D96DF4B77AFA103432139FD369FAC4DD0554494EAAB8A616E9243E2227A1951DFA5D07028C61A3CDA29C298E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................Z......Z.~.............Z......Rich............PE..d......f.........." ..........E...............................................E......F...`.........................................p...<............ ....E...........E. )..............p............................................................................rdata..............................@..@.rsrc.....E.. ....E.................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_SPANISH.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4625696
Entropy (8bit):	5.31483715910939
Encrypted:	false
SSDEEP:	24576:yCAR8pFpAMif9Hnh6D5cepfG9GsYgUOUpUQh8oL9wRT7Pn:yzQg653mIpLGRTLn
MD5:	E4216FFCDE360D8E4C49C95F4287C0FD
SHA1:	AB2F569FBA48C9A198B8F6F722009DA8DC6218E6
SHA-256:	9EDA20F2B986E0421D86A20A67796EBF9732CB2A7023D13D4C3EF2A55532E808
SHA-512:	145A23C9F7BEC1A6300E6FC663EC41C263598E596BC3804D330099FAC50CD7C2DA81B245BDF53ADE8BAF2EBA34D1C97D2DFE8611B2CD457F9940F4BC6E8EF4FB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................Z......Z.~.............Z......Rich............PE..d...k..f.........." .........hF...............................................F......IG...`.........................................p...<............ ...eF..........lF. )..............p............................................................................rdata..............................@..@.rsrc....eF.. ...fF.................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14137120
Entropy (8bit):	6.407444093217519
Encrypted:	false
SSDEEP:	196608:xmRofKw+C3CtqMJCN5sB3SpAb+81Z+NlG:xmRVw+C3CtqM0mB34Ab+wgNlG
MD5:	D9A82015A96F7EBEBD1B30F6B0BA1F86
SHA1:	3398107DF3BBC951663DD3B335AC52B64FDF62ED
SHA-256:	8A5D9B33B6881595A84BDF4D04E9CD924F1891FAB6313E354191E6FF39D8CE9F
SHA-512:	B9484D4395233EC3E192C520963CDFBDB4CCF97D6325477A2FE8D37DC828C01EE3DACD643493DB77F51EE996B456EF8225C287920D065097B675DFD467B8EE9E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.......d.m} ... ... ...E../5.......%...E../....E../%...r../....r../*...r../......./"...E../$...E../i... ....... ...=......."....../......./l....../A....../!.......!... ...!....../!...Rich ...........................PE..d...7..f.........."................p.........@.....................................r....`......................................... =.......F.......................... )......l...0..T......................(......................&...........................text............................. ..`.rdata..\.1......1.................@..@.data.....J......$..................@....pdata..............................@..@.rsrc...............................@..@.reloc..l...........................@..B................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.log

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	data
Category:	dropped
Size (bytes):	12209
Entropy (8bit):	5.339068339813437
Encrypted:	false
SSDEEP:	192:6IHIMpgqqwKJcBpaEcRwA+jKPAgdyPpFZ7fdzWhQ6MVsWxldl/iSdrQBVdpmb/dI:1Fpgqqhcfa7a+owyhFZ7VyhQ9x7tiOUf
MD5:	288B9B5F2DA66CA3EC8CF90721D5A575
SHA1:	A111F028C2D2B1E974B202A6D380C3A8558B203E
SHA-256:	9F848126E46BE867676E0EE58544A2F4A0801204459ACAC08731EBD59820679B
SHA-512:	FF63D5FDE0B515E1B17185A67D5D1493748EB1EBBB306FD7E3DB08275EF261F0592B1A72EDD2C80955DD2A396B95DB4B4B861267A1043A99D03E1BC0222ADA2B
Malicious:	false
Preview:	(P6308-T2200)Error( 289): 10/28/24 10:18:03:400 DRBG selftest: FAILED, error: error:2D08D065:FIPS routines:func(141):reason(101)..(P6308-T2200)Info ( 162): 10/28/24 10:18:03:932 ####################### Start PanGPS service (ver: 6.3.1-376) #######################..(P6308-T2200)Info (1776): 10/28/24 10:18:03:932 Enumerate session: user user-pc\user logs in on session 1..(P6308-T2200)Debug(1022): 10/28/24 10:18:03:978 PreviousDNSInfo doesn't exist, no need to restore..(P6308-T2200)Debug(6544): 10/28/24 10:18:03:994 Proxy is not disabled before, no need to restore..(P6308-T2200)Debug( 70): 10/28/24 10:18:04:119 Virtual interface driver is initialized..(P6308-T2200)Info ( 77): 10/28/24 10:18:04:119 Filter Driver is not installed, install it!..(P6308-T2200)Debug( 130): 10/28/24 10:18:04:119 ST,Install Filter Driver .....(P6308-T2200)Debug( 148): 10/28/24 10:18:04:119 ST,call SetupOpenInfFileW(C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.inf..(P6308-T2200)Debug( 150): 10/

C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPSupport.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3057440
Entropy (8bit):	6.277851386121495
Encrypted:	false
SSDEEP:	49152:OEQENeJFJTs08ClG+zJur2yxJnaMT29i72X5X+f:NNeJnFIvxJn7T29np+f
MD5:	2293718D82A76F30435E9825BB0AE92F
SHA1:	91ABEA6E0BC45D08F9BC760A4A55966CCEA2BCFC
SHA-256:	20D6302A70AE3A9D62429DF8311EDA68B0DD18ADC6B6E12959E7C619BBB50168
SHA-512:	9D70F6883F7103400F210F2762FD931BEFC29CD92C37568528205A2084E3E10DE5357987666690407061F11E0DE5D2DD92467316839A24151F6D628E76B33242
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P...........q.....q..1..q....q.....F..6..F.....F..h..q..1.....?..........)..........Rich...........................PE..d......f.........."..........^.................@.............................0/.....x1/...`..................................................v).\|....0,.........i...~.. )...0...... .%.p.....................%.(.....%..............................................text.............................. ..`.rdata..............................@..@.data.........)..~....).............@....pdata...i......j...$*.............@..@.rsrc........0,.......+.............@..@.reloc.......0........-.............@..B................................................................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHip.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5216544
Entropy (8bit):	6.54386800397943
Encrypted:	false
SSDEEP:	49152:qGtlqrIU6i70VwASOVTOwYRIFxmp6EUTX+PDAOh5PFvTsH4iIk2k5HBz54VIovN0:f+awjPs55HX9UNx4GaJ8i0pvwB
MD5:	E8159542741FC0F7F695EF2B956CA6B2
SHA1:	C477AB578825FD695A0986CCDCAAE48AE593C750
SHA-256:	C2FFDA20D713C38D3D4D43591F347C0A183AF1F909A69B2BFF48CF4B080E9884
SHA-512:	9BD7707296BBB3BED28A9A563A583B040E7A7BFC1A6A907EF1C23660B4B30324572940C515C89DBDCEF80BD1CA779B49B42B6BB9B478D38CA0AF5F8A14B40F5E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......].....g...g...g.\|.d...g.\|.b..g.\|.c.?.g.\|.a...g.K.c.:.g.K.d...g.K.b.l.g.\|.f.,.g...f..g...g...g..c...g..n.:.g..g...g.....g.......g..e...g.Rich..g.........................PE..d......f.........."......(7..........R1........@.............................`P......P...`..........................................WJ.....0aJ......PN.......L.\>...pO. )... O.,:...E.p...................@.E.(...@.E..............@7..............................text....&7......(7................. ..`.rdata..&h...@7..j...,7.............@..@.data....Q....J.......J.............@....pdata..\>....L..@...0K.............@..@.rsrc........PN......pM.............@..@.reloc..,:... O..<...4N.............@..B................................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\PanGpHipMp.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5190432
Entropy (8bit):	6.546862890421192
Encrypted:	false
SSDEEP:	49152:ZGtlq6IU6idQVwASOWuvuo8j5cWt6wTR2/vzFJOh5PgUu2n8X0HE7EtelxGVBIE5:p+fn+vz0t5VBJz3N6yuWQsAK7
MD5:	C9E1F407BB029DC73412D60129FFA1BF
SHA1:	7BD79D0008289A3852085914F494F1ECF6D22E5B
SHA-256:	06F6FD00C8B152612ECD02C476A23FA4E3D836C7D9B87F70ABA04D3DCC80B4F3
SHA-512:	7D1C96648F40B236E578E1C4E59F8268674071160E46FBD5CC517C6372E3A5E1F8D4431EF97147778049763E0781DED51E44BEDDF19EB201F59626B84C9AC9B4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......].....g...g...g.\|.d...g.\|.b..g.\|.c.?.g.\|.a...g.K.c.:.g.K.d...g.K.b.l.g.\|.f.,.g...f..g...g...g..c...g..n.:.g..g...g.....g.......g..e...g.Rich..g.........................PE..d......f..........".......6.........@.1........@..............................P.....nmO...`.........................................0.I.......I.......M.......K..>....O. )....N..:...NE.p....................OE.(....NE...............6..............................text.....6.......6................. ..`.rdata...P....6..R....6.............@..@.data....R...PJ.......J.............@....pdata...>....K..@....J.............@..@.rsrc.........M.......M.............@..@.reloc...:....N..<....M.............@..B................................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\PanMSAgent.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 9 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, -128x-128, 32 bits/pixel
Category:	dropped
Size (bytes):	195565
Entropy (8bit):	6.378864154519159
Encrypted:	false
SSDEEP:	3072:LwwnzWV9tBurxdDQOirTSMs6grqmZdD8ZJ/d05wPbwoihJu5L:xnq3kx9QLSMjeq0QwthJGL
MD5:	2FBC3DDD9597EA3C6A621CC3832CEACD
SHA1:	69A53CEAB84D786D30FDF38BFFC8862873CE6CD8
SHA-256:	FCB8A6C4CEC48D4B67C504C32A0964AB570705CAD1E627C90BA800349BEFCFF1
SHA-512:	13F9BE3D6AEA742590ACA6F6969B58988FE0F2844986E705E543B5646F85184EEA324AA17A865D94D175BA5D5240D161873CCEB368AC76398849799A5266FF76
Malicious:	false
Preview:	............ ............... .(...M...``.... .....u...@@.... .(B...[..00.... ..%..E...((.... .h....... .... .....U......... ............... .h........PNG........IHDR.............\r.f...~IDATx....].U...>.N.....H..n+Nl'v.....I .............<..@x..@ !@BB.!......,..2.}F...{.~....>..)..c...{...Z.....X..w...\m1....o.....2u.(4.2....F...c..l..V~..c1.8+..E<..Ll...;..._d./.....^....\|......._....wf.4...70..e.{.nL..)..<...E.....:b.-.@.6.q...<....c..:A....N...G,.3.'....j.j_.C.P..A.`@..i..1y.CQ.....,..Me..y...........2}...\...{.3..S....,J..b.N.\|...v..(.2.dT...l...[Af~.}...U.....w<...,..d.X.b.8.....v........M5.=....=s.........D.-?.....n%.k...J.Z#...Ig...1...Q.3.?.#..ioF...8x.../.z.6...... ........T.h1....Qal.........gO1........u.r..3.....H.....t..t.F)$7....EmQ..+.[X....$.S.8.... Sm..q.Q..$.w C.l?.R.g...-.lz......]pz.."..}......B.p..h...2...........]f.`.........E$.r.....(....h....PSs..;.<...\*.....'\......_2a...G...0.j.~.+r-.}....+`. ].& .

C:\Program Files\Palo Alto Networks\GlobalProtect\PanProxyAgent.log

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	367
Entropy (8bit):	4.887530243593368
Encrypted:	false
SSDEEP:	6:l/+YhcPJ6K5K2/+Yhcdqlce2/mtcU1FQVyJUNFS2/+YhORRDVmy:l2qcPJ12qcd90cU1uOiFR2qcRoy
MD5:	A3718A9CDF82F2CB317D215BCB0AB124
SHA1:	EC10330CBA2A84B2536BA5E55E33EEEFCD35BF73
SHA-256:	CA40750B7AFE2CB9A369D5D69BC711E4D0FF1D7175691DA0EE81A18E9DE8E82D
SHA-512:	8C7C2875601C755C448ECF00009A81EE1A17BE9F2F64E7343AB6147328102C0F014ADC49FEABC6751DEC4AC27EAF1D499D189077E1BE4FC6315F65CA4FA88F9D
Malicious:	false
Preview:	(P6308-T2200)info 10/28/24 11:32:44:776 (43): ####################### Start ProxyAgent #######################..(P6308-T2200)info 10/28/24 11:32:44:776 (44): Creating Proxy Agent... ..(P6308-T2200)debug10/28/24 11:32:44:776 (441): PacManger Event state update Ready:PAC Manager Ready..(P6308-T2200)info 10/28/24 11:32:44:778 (50): Proxy Agent created. 0x24341e07170..

C:\Program Files\Palo Alto Networks\GlobalProtect\PanSupport.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 5 icons, 256x256 with PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced, 32 bits/pixel, 96x96, 32 bits/pixel
Category:	dropped
Size (bytes):	110711
Entropy (8bit):	7.04581083755224
Encrypted:	false
SSDEEP:	3072:HQ7VWZt6yfzrXC7uZiu4/fpnrar+GfU4v:UEt6yfzr65++G84v
MD5:	4ABE455BAD5FFFFA43741DEBBCBD07E5
SHA1:	C66B072E967EBAFF3B7F6F9A96C41602F5E75CE9
SHA-256:	2E47D2B23A1954EDA142FDE7012F2D9F68DD92FC358F90A099A1C03A20BFF7D8
SHA-512:	E2DDA71D957B6F6B9614C282BE131AD5DC86FF0DF9987B7230077BD05783DCB9DB42596CD22A2CA7E4565D078327957D39C6A15BA897C99728D6B0A3B2E25CF8
Malicious:	false
Preview:	............ .....V...``.... .........00.... ..%...u.. .... .....g......... .h........PNG........IHDR.............\r.f....IDATx..}..]E...}....%....Y.Ge.APt....E.....q.G.q..AG.7..qEpe..AA...A..Y...B.....{..s_p.A...p...vU}U.U........;.}..c~.{o.+..1?..c^........`~...W..c~<........<........1.....x..y.0?...x.+...h.w..{..c.,\.......f...yc`a^.X.g....>.....Rh....rO..?.Z....{y.n.v%oo.v;..nk............Y...............}.......`;...-....>..%{....]...^.......Js...r...(%..r....,..3M...]...s\|..mk..f....L..Nm...~...........n.i.}......`{...,8..#....\|B.x......1.......I...R..).....~p.o..H...%...O.g..../..6V&.+'%b@.....ypz...[~...w.O..&&&...:?...W......Zr.._...........\...h...X.H!........~.....G.%%.v._s...m.WT.....R..... 7...u....&(..}b......L\{./.\|..O........<....n...z...{.S......kc....2..g(......W..+.....Z......T$s?.;;z5..F.N....V.N...A..j....._n.E.MW.[.9....:.7.s>..w...W.......=c..>...~..... ..x.._..l..@../.>..*...7.?...).6...@.b..V.G...G.&...

C:\Program Files\Palo Alto Networks\GlobalProtect\PanVcrediChecker.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4684064
Entropy (8bit):	6.538962617722601
Encrypted:	false
SSDEEP:	49152:WGtlqxIU6iOkVwASOSBtci5WTWjqTsB3d8uOh5Pm8FR6pYVIRZ0J98jd2rzHKd/I:V+ybz3d8WgCYBJU2rWAJh37jO/R5hx6
MD5:	6E994B7F3FB71C1F25BC28640AB4098D
SHA1:	BD683799CA682874B3320B73DDE04967CF57588A
SHA-256:	8E6152304A7D486D01014F10C0BCD5CC5165F786A27CF4BE270804E9057A2C44
SHA-512:	3FB58D52FEB8B21FC4807C0AD5BF22ABF6D27009DC900D2B108322C4C33F8593FA9D9E6524B308614F13E9B6239404C2AFA38088BDFC5F11C044F08A5B93AA46
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......o...+.c.+.c.+.c.N.`.?.c.N.f...c.y.g...c.y.`.!.c.y.f.].c.N.g...c.N.e..c.N.b...c.+.b..c.+.c.6.c.g.-.c.j.<.c....c.+....c.a..c.Rich+.c.................PE..d......f.........."......V1..........1.........@.............................@H.....1.H...`.................................................0DC.......F.......D......PG. )....G.84...^?.p...................._?.(....^?..............p1..............................text....T1......V1................. ..`.rdata.......p1......Z1.............@..@.data...d5....C......tC.............@....pdata........D.......C.............@..@.rsrc.........F.......F.............@..@.reloc..84....G..6....F.............@..B................................................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\PsvCtrl.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	290080
Entropy (8bit):	6.207691586003451
Encrypted:	false
SSDEEP:	6144:l1Xn3NsPcW6hIzrAJxNFSTIrCv8A4BnoVO:l1X3YN6Grczuv8b
MD5:	C1AD035030D04609CB3091C888609801
SHA1:	7808449F0707CA20A5C2E728FB69764C2C06402E
SHA-256:	4DA8F3661CBED7E9EE2080FF58F1E78C59561870A48F2C2C6AEB9E2D6F420FD3
SHA-512:	3A53B65DA5523C659118270FB5D1EE6B77A2F73601C9EB76E2287E9E540C82702BD15B64DFB440FDB487A2A39E8959B81AEFCCFF883191A4A39D5992BDD01000
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y:..8T..8T..8T..^W..8T..^Q.@8T..PP..8T..PW..8T..PQ..8T..^P..8T..^U..8T..8U.`8T.lQ]..8T.lQT..8T.lQ...8T..8...8T.lQV..8T.Rich.8T.........PE..d......f.........." ................................................................3.....`A........................................p... ............p..h....P.......D.. )..............p...................p...(...p................................................text...\|........................... ..`.rdata...G.......H..................@..@.data...t'... ......................@....pdata.......P......................@..@.rsrc...h....p.......6..............@..@.reloc...............<..............@..B........................................................................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\WdfCoinstaller01011.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1805792
Entropy (8bit):	7.979052489757923
Encrypted:	false
SSDEEP:	49152:CRUp077GQSph1DxQOzAFXEfEacq1XT7H:CSoe1GEf5j7H
MD5:	B7B997EEAE8FD59A0566F9875D38782F
SHA1:	39EB78FD8A27B574E0C26EB07DC77F66D8EC7650
SHA-256:	F3C2024FB36DD8F56213E568918C6FEC41D133AAD79A2BA8A47B190D6348AA02
SHA-512:	2511AF59E083C67415D32CF01B4E4AB60BC1B99DC7CF9805368750264CC3D1D32403AE33F7729D74B4616BCAF3B05223F593A5BF58D409AB766F5C8B2743F6DC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.$.u.J.u.J.u.J...t.J.u.K...J...`.J...~.J...t.J...\|.J...t.J...t.J.Richu.J.........PE..d...U..P.........." .........j......................................................m.....@.........................................p........P.......`...O...@.......L...A......0...0...............................0{..p............S..H............................text...a........................... ..`.data....H..........................@....pdata.......@......................@..@.idata.......P......................@..@.rsrc....O...`...P..................@..@.reloc..l............J..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\WebView2Loader.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	162384
Entropy (8bit):	6.192046450871812
Encrypted:	false
SSDEEP:	3072:XoJYlydOX1Q2MHGGHhALkauZy57A8MR78SCLTeKEt+2SbFd2p6:KOyUTMHGQhkDfZMSEttCP
MD5:	A811DC19F3F87E30A3B41B23A4D4095F
SHA1:	3166B82C20060EA0FFCB653E574E86F6BF81D2EE
SHA-256:	96690E989A8EEE97D93DA058A91EA2A98F715DEDD15E3B255852BC1724CA2BB0
SHA-512:	F9A58547C393AB4DB55721FD54E809AC18A2FCD926BC63B2915DF9BF132850847343E7BD79A4F03A27998839F2B8FE1342656AB82D13A3DB1D7A9E067E4A0AFF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....$e.........." .....N...........K...............................................+....`A....................................................(............@.......R..P(..............T.......................(....a..@...................(...`....................text....M.......N.................. ..`.rdata.......`.......R..............@..@.data........ ......................@....pdata.......@......................@..@.00cfg..8....`.......*..............@..@.gxfg........p.......,..............@..@.retplne.............>...................tls.................@..............@..._RDATA..\............B..............@..@.rsrc................D..............@..@.reloc...............J..............@..B................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\app.sig

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	7.209598193198806
Encrypted:	false
SSDEEP:	6:D0LncI5jzmoWVvv2l7BUE+zwzOYUJ8/89Ssyx6C1tIU+cRmITn:D0Ln1Eo4ucE+zwzY/wDxTTfHn
MD5:	84E394F5952229EF69E944B39637292C
SHA1:	FB7F6B738237A72E9F2F16592938AEB6CB2BC88A
SHA-256:	CFA5099D0E96332C6912A861FBE610A8BD1D89E5ED40415CD82A870BA9B415EB
SHA-512:	10192FADA9BE683B45E0A91A76F9E354E27872F203EE1B750589E47DC62884275CAE8F45C35A2F0739F7EB76E108EAA056B4FA3C7A031E70E90BA0090B4C340B
Malicious:	false
Preview:	..0....1..........c....b...qV.b)...r..[..?.....2\|..{C....ev>A...\|..2"..q@e..J.O......^.........x....y.5.....0?..r1 `.".{.&\.}....c}.S.k....G...8.5.[F.v..."Y.nL.....#......u...J...... .<..6...]P\./[^.(DO.......SR.ei2P.+......K....l\|.~....?.QH.g..(_.:....

C:\Program Files\Palo Alto Networks\GlobalProtect\bitmap1.bmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PC bitmap, Windows 3.x format, 10 x 9 x 4, image size 72, 16 important colors, cbSize 190, bits offset 118
Category:	dropped
Size (bytes):	190
Entropy (8bit):	2.238138315339212
Encrypted:	false
SSDEEP:	3:y/lZll1lklIXltHltllvl/Ft/HtAiotuZc/o1ltteGflxmeIlLu/n:mal/ijcAn9NSpu/
MD5:	20CD4FE4ED54D9529F198B7984E79EE2
SHA1:	C09067019768C47F675CC8794CBB2E5475CC4BEC
SHA-256:	3D8FCA9479647B5676AEE59D91E8B5FE939EA0F07C0C53F30A7B0BD93C75A7B3
SHA-512:	51CF66334B016B7874CFA979147A5CCDA9FF4CD0AB08DEE26100DCE51AB538FA7B1FA4023660D60502524CAA7AD84FC4C9325381656BE6E7B4B0F51461E970BE
Malicious:	false
Preview:	BM........v...(...................H...........................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\bitmap2.bmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PC bitmap, Windows 3.x format, 10 x 9 x 4, image size 72, 16 important colors, cbSize 190, bits offset 118
Category:	dropped
Size (bytes):	190
Entropy (8bit):	2.053283190935653
Encrypted:	false
SSDEEP:	3:y/lZll1lklIXltHltllvl/Ft/HtAiotuZv5lnPuZuSdq/uSiuPBln:mal/ijBxAEBl
MD5:	7B12BDCE40352F5835B47A97F60B6C7B
SHA1:	281966975816DB21B38991EB7A1FDD10DF26950E
SHA-256:	18A6A8E7452DD319587EFD4A48206D7D6CECC0DA22FBD92354211A52F499E6A0
SHA-512:	CFA645794A333CC389955CF18F01762D02D1A76FB94247F06280BB25A20B98F0CA63AE71C91EDC8D265FBCB9CB18A9970F5FD1DDFE61EAEB31C9D0C0FEAFFCC3
Malicious:	false
Preview:	BM........v...(...................H...........................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\bmp00001.bmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PC bitmap, Windows 3.x format, 10 x 10 x 4, image size 80, 16 important colors, cbSize 198, bits offset 118
Category:	dropped
Size (bytes):	198
Entropy (8bit):	2.0290308481877335
Encrypted:	false
SSDEEP:	3:Oxll1lnll+lhXl1/l1ltllvl/Ft/HtAiotuZc/eoQoluSSuSlv/ASuSluSQobt:BlOijcWfXyst
MD5:	11A6FC5112B16C750CE9C435B9D9ECDA
SHA1:	30EC46FE5B5EF72BD3318714E1F2BD950E561325
SHA-256:	F9EA18599390E773A66A1B7351DBA4E9ED912405B706EB5938B1E53B38A50157
SHA-512:	E06BC7371D5AF5F9A325555A159ED0624F9AD00DDD45B65194A8F33AD8CAA3E208716524C7AAAB75C3501FE99207F14A417AF7EA942EC00B9BD8CEFF03767349
Malicious:	false
Preview:	BM........v...(...................P...................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\bmp00003.bmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PC bitmap, Windows 3.x format, 10 x 9 x 4, image size 72, 16 important colors, cbSize 190, bits offset 118
Category:	dropped
Size (bytes):	190
Entropy (8bit):	2.053283190935653
Encrypted:	false
SSDEEP:	3:y/lZll1lklIXltHltllvl/Ft/HtAiotuZv5lnPuZuSdq/uSiuPBln:mal/ijBxAEBl
MD5:	7B12BDCE40352F5835B47A97F60B6C7B
SHA1:	281966975816DB21B38991EB7A1FDD10DF26950E
SHA-256:	18A6A8E7452DD319587EFD4A48206D7D6CECC0DA22FBD92354211A52F499E6A0
SHA-512:	CFA645794A333CC389955CF18F01762D02D1A76FB94247F06280BB25A20B98F0CA63AE71C91EDC8D265FBCB9CB18A9970F5FD1DDFE61EAEB31C9D0C0FEAFFCC3
Malicious:	false
Preview:	BM........v...(...................H...........................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\close1.bmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PC bitmap, Windows 3.x format, 10 x 9 x 4, image size 72, 16 important colors, cbSize 190, bits offset 118
Category:	dropped
Size (bytes):	190
Entropy (8bit):	2.0388268936822973
Encrypted:	false
SSDEEP:	3:y/lZll1lklIXltHltllvl/Ft/HtAiotuZc/AaASt/BuSVuZuSlP/AaASaRu/n:mal/ijcftWfaRu/
MD5:	12378638D5D9629DF029B8680F66F623
SHA1:	A9AC4D707781A6BBA1D9890F2BE6981CD51FA4BF
SHA-256:	BAE5470B6825A087B88449D189152807D32DAEDCE5C6D4C4724D4AC60A31E1CC
SHA-512:	61D8C18D049EB96FE44D0021AC5E678983EC1667C6A8CE3ABF158DB9D13A75E3AF2A52570E94F9303AB0C43B8CFB1BF107E411714273C31DCFCD7D3FA93E6D3D
Malicious:	false
Preview:	BM........v...(...................H...........................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\close2.bmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PC bitmap, Windows 3.x format, 10 x 9 x 4, image size 72, 16 important colors, cbSize 190, bits offset 118
Category:	dropped
Size (bytes):	190
Entropy (8bit):	2.001045784067268
Encrypted:	false
SSDEEP:	3:y/lZll1lklIXltHltllvl/Ft/HtAiotuZAMVltaa/qHoqqIta/KaRu/Lu/n:mal/ijAUloa/qHfqIo/7uju/
MD5:	6C08943777106D71DBAD1C57832F7BD6
SHA1:	726CAE4D66D7470BFAEAB7D7A9756813B0ACD542
SHA-256:	654B7A31ED9A0A532BC3851427BACA56BF98B803A34CEED715F7A9C66285378D
SHA-512:	50437BB50D1B325ECCF1B58299CE7AA9909CB084EFD704FF364676C625333B0842FD46BD5A03D185A7AB36C06064D191994440E666E231E572A3488CB189B00D
Malicious:	false
Preview:	BM........v...(...................H...........................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\close3.bmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PC bitmap, Windows 3.x format, 10 x 9 x 4, image size 72, 16 important colors, cbSize 190, bits offset 118
Category:	dropped
Size (bytes):	190
Entropy (8bit):	2.0388268936822973
Encrypted:	false
SSDEEP:	3:y/lZll1lklIXltHltllvl/Ft/HtAiotuZc/AaASt/BuSVuZuSlP/AaASaRu/n:mal/ijcftWfaRu/
MD5:	12378638D5D9629DF029B8680F66F623
SHA1:	A9AC4D707781A6BBA1D9890F2BE6981CD51FA4BF
SHA-256:	BAE5470B6825A087B88449D189152807D32DAEDCE5C6D4C4724D4AC60A31E1CC
SHA-512:	61D8C18D049EB96FE44D0021AC5E678983EC1667C6A8CE3ABF158DB9D13A75E3AF2A52570E94F9303AB0C43B8CFB1BF107E411714273C31DCFCD7D3FA93E6D3D
Malicious:	false
Preview:	BM........v...(...................H...........................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\debug_drv.log

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1798
Entropy (8bit):	5.148239463665984
Encrypted:	false
SSDEEP:	48:Z+NM3bVHItKxHsqz2xHsEvOo0YoJozInR2zxZdDyKpzzIKvzxGR5O:ANiRmQ1HE4hS
MD5:	4D70D3A5B0D8C4E6D60843443C977482
SHA1:	1EAD7618CDC8B324A2E35539F5DBF68ED3845596
SHA-256:	C418633DEDBFFD324A646053C31FC533EBD2804880C1C204D06BF80F2EBCB15F
SHA-512:	A80956E8F826270B270E8AD78CBCA1A6DA172889BA695C326719BD7834D642AD3D7410941AD8A17CE6EEAE79CE5FB3E5F438546B7E0FC4246A8E73D8D739762E
Malicious:	false
Preview:	(P5900-T6148)10/28/24 10:17:55:990[Debug 847]: No oem .inf existing...(P5900-T6148)10/28/24 10:17:58:005[Debug 409]: Driver inf file is installed successfully...(P5900-T6148)10/28/24 10:18:02:927[Debug 462]: Driver gets installed successfully...(P6308-T2200)10/28/24 10:18:03:400[Debug 469]: Set debug level as 4..(P6308-T2200)10/28/24 10:18:03:994[Debug 1304]: Driver status is: 1...(P6308-T2200)10/28/24 10:18:03:994[Debug 668]: Found pangpd device ROOT\PANGPD\0000, remove it now...(P6308-T2200)10/28/24 10:18:04:010[Debug 671]: Search only...(P6308-T2200)10/28/24 10:18:04:010[Debug 1304]: Driver status is: 1...(P6308-T2200)10/28/24 10:18:04:041[Debug 668]: Found pangpd device ROOT\PANGPD\0000, remove it now...(P6308-T2200)10/28/24 10:18:04:041[Debug 671]: Search only...(P6308-T2200)10/28/24 10:18:04:041[Debug 94]: Driver file version is 6.0.0.6...(P6308-T2200)10/28/24 10:18:04:041[Debug 836]: Searching valid GP adapter...(P6308-T2200)10/28/24 10:18:04:072[Debug 902]: Searchin

C:\Program Files\Palo Alto Networks\GlobalProtect\gp-public.pem

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	460
Entropy (8bit):	5.894107282821546
Encrypted:	false
SSDEEP:	12:LrJ8OBKUlhwDXSux72mnioh/tIAKfkbHOuJ:LrWO8agiux72mi5G
MD5:	55DE7241A5CE4738FFDB2B090820A47A
SHA1:	6F5CF924183158EA6A564BF09B3179DFDAF23453
SHA-256:	8763DC9A8CCC052DFF63C04C4DC0333B68E1860B7BDAD824FBAF096275B9F859
SHA-512:	2E428F94CB0B723F17BF9450D691C82DDCCE6F09F0908A11A3E4AC56126AB468DAF444DBB2B641BF9337A21081E10FA14FE0E65C6CE0E12192AF6A7157440281
Malicious:	false
Preview:	-----BEGIN PUBLIC KEY-----..MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq+fkzzMYdkPyJOjRxhyU..MjJuCP1jSpMa0cTvoXnIQcCvvjDnbCCdRO94iR0vHl7E5Kb65Jjs8fiYz3ni2aCX..XS9NvyFUfNDC/PJ5uk40/IpHN8Hr0226MSyRUwMLfgknr9DJ+Eov98yRuRGTw273..0I9CiPABWREHrjc4RXQHdG3sHVN+MNpzPua64FIPXGaODxUklUO91Sbf7CMxpWnN..PmolNU3Ol8A8wgTBASUljhw/L49rvqEjHAaxguRBMhSLQboZtPNTqACb59aa9d+S..3aztnV0bziN6a20XbDQBbSPGv/P7C22PERZe5mwMzKHKKqNWdFtWA1uD457lE5AG..9QIDAQAB..-----END PUBLIC KEY-----..

C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	11211
Entropy (8bit):	7.306867148660512
Encrypted:	false
SSDEEP:	192:FvJVg2OLwB/uyKAUFWQFdvEgd9ZnAOVX01k9z3As3Mbjfi:KLOpUFRvR31AqR9zPSjfi
MD5:	0FF3F46C852A8809AC12AF4AF492D833
SHA1:	B93073ACB1DB35A4DE9475AEDE68766EFB3A4E77
SHA-256:	99A812D309E6B40F75BAF27FACC44880AD4A04F65D9731CDA2F94CAADE530510
SHA-512:	5AF90F7B530AC8F25C944A309277B30EC9DBBE7824820F0DD40E9C8C2BDACC1AF8CEBAB374FE7C324E27830759E1926F78907FA61BA93D5C41914772E139BA57
Malicious:	false
Preview:	0.+....H........+.0.+....1.0...`.H.e......0.....+.....7......0...0...+.....7.......v....F...w.7r)..231218225058Z0...+.....7.....0..X0....\.=..<...$.rR~.\..B.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........g.p.f.l.t.d.r.v...i.n.f...0..........1..4N.!]...~..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........g.p.f.l.t.d.r.v...s.y.s...0.... ..X.t}....!......R.o`.0n..).WI..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........g.p.f.l.t.d.r.v...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... ..X.t}....!......R.o`.0n..).WI..0.... .....".."..<3.I.k.U..P..^.....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........g.p.f.l.t.d.r.v...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .....".."..<3.I.k.U..P..^.*....../0..+0J.

C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1757
Entropy (8bit):	5.245816486911642
Encrypted:	false
SSDEEP:	24:uNPP4S8ohDt+bq8rHCQYw0/G1kvAp9a0BNSY354PDK4S/3ioFlUqwLlsy2i4L:uRA40+ibaq+ApJn35oDNWialNwLlsm4L
MD5:	083330FA0340784145012D1210630F6D
SHA1:	5C9F3DCB0F3CA0050124A372527EDB5CA5EF42CC
SHA-256:	C6D158F7747DA61EB40A21BDAC1EF3DFC852806F6080306E191F29F55749109A
SHA-512:	F09B146803ACA569104219ACF02DF55139EC75844CCFD3FAFFA9A13D771D267E4EFF7EB8D68C40E2AA7590CC1F997CB285826097ACE59C71028048C8779B607D
Malicious:	false
Preview:	;;;..;;; Copyright (c) Paloalto Networks. All rights reserved..;;;..;;; Abstract:..;;; Callout driver install configuration...;;;....[Version]..PnpLockdown = 1..signature = "$Windows NT$"..Provider .= %Paloalto%..DriverVer = 12/18/2023,13.33.59.773..Class = NetService..ClassGuid = {4d36e974-e325-11ce-bfc1-08002be10318}..CatalogFile = gpfltdrv.cat....[DestinationDirs]..DefaultDestDir. = 12..gpfltdrv.DriverFiles = 12 ...;%windir%\system32\drivers....;;..;; Default install sections..;;....[DefaultInstall]..OptionDesc = %gpfltdrvServiceDesc%..CopyFiles = gpfltdrv.DriverFiles....[DefaultInstall.Services]..AddService = %gpfltdrvServiceName%,,gpfltdrv.Service....;;..;; Default uninstall sections..;;....[DefaultUninstall]..DelFiles = gpfltdrv.DriverFiles....[DefaultUninstall.Services]..DelService = gpfltdrv,0x200..; Flags note to stop service first....;..; Services Section..;....[gpfltdrv.Service]..DisplayName = %gpfltdrvServiceName%..Desc

C:\Program Files\Palo Alto Networks\GlobalProtect\gpfltdrv.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	136208
Entropy (8bit):	6.7163880773155205
Encrypted:	false
SSDEEP:	3072:D9/cqmeDhWZWaHW1i9O5LY2GEyZAzTcfx8+:D9/XD4ZTW1i059yyzgl
MD5:	D9B1F383AD60E687B7A8347241683C50
SHA1:	293FE84008105EFF5AB9ED1D0338EEA32138A3D5
SHA-256:	8E438A6E3C6FFE966644E02691CF15D1FAABC522AEF8BA1D6E969A4FB0B650EA
SHA-512:	DBF7EABAF8054028885D183CCA190E00371D7320A2ED01438B2A46AC55A8C09685B524F47C7E057F90EF945AC946FC841DDC3D802DABD7941BB2EBBBAE59B874
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U...4...4...4..._...4..._...4..=C@..4..._...4...4...4..._...4..._...4...@...4...@...4...@...4..Rich.4..........................PE..d.....e.........."..........@......@..........@............................. ......0G.....A................................................0...d...............`........T......,.......8........................... ...................h............................text....\|.......~.................. ..h.rdata..T...........................@..H.data...............................@....pdata..`...........................@..HPAGE................................ ..`INIT................................ ..b.rsrc...............................@..B.reloc..,...........................@..B................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\libwaapi.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1045256
Entropy (8bit):	6.252841758830611
Encrypted:	false
SSDEEP:	24576:mTeY4QNOGZyx0onf3gHgJq4wTsTcXq6c0wBBb1evL78:mqcOH0S3XJq4wTsTyqPdRcvL78
MD5:	98E05F30B856E880453418A67DAB6740
SHA1:	EFA381338AEE5A0FAA4A4BD6CD80DC104938FC74
SHA-256:	25081B547184615E9E9E4E79F18D09135BA15C0C23F0B0E2BA45B87403A6AE04
SHA-512:	271B2C062E8788BEFE65D87DB52327A51B2EF9EEAE2E1B502AAD2F9A45E11B41966567F48E0A142C3F2F70846EA1C95172EF1D14B3E0B716DFE65BC8EF17DCEE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................................................................................y................Rich....................PE..d...{..f.........." .....<...........V.......................................@............`A.........................................z......\{..........4....p..<~.......'... ......`\|..p...................h}..(....\|...............P..`............................text....;.......<.................. ..`.rdata.......P.......@..............@..@.data...Ts.......T..................@....pdata..<~...p.......(..............@..@.tls................................@....gehcont............................@..@.rsrc...4...........................@..@.reloc....... ......................@..B........................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\libwaheap.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	102152
Entropy (8bit):	6.163413971431957
Encrypted:	false
SSDEEP:	3072:PsEMdY59enGtW/zc7fKJP5MLEhmnqZ50R:S4iGtAz0fUv4R
MD5:	92CCC4179E359E9CCAD1130948D64330
SHA1:	829ABBBE9E56BF0DB696A95744F2E4E1D5EF8C0E
SHA-256:	0BEDB14AFDD123A59743B51B7A1AAB8AD46110F73C280C58A5869B22A7D788F9
SHA-512:	B73DF2E46736B9A618E7352663E2549410950A815C4FDB888C0A3D8A41DA4A5CC8448A015DE659E19CCD331A8F752A2E5ED0FCBCDB1CC91708F81BF89B8FA752
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........Z...Z...Z...N...^...N...Q...N.........]......N......J...N...Y...Z..........[......[.....{.[...Z...[......[...RichZ...........PE..d......f.........." ................@................................................v....`A.........................................Q..L....R..(.......8............h...'...........C..p............................C..................8............................text............................... ..`.rdata..............................@..@.data........`.......@..............@....pdata...............J..............@..@.gehcont.............X..............@..@.rsrc...8............Z..............@..@.reloc...............`..............@..B................................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\libwalocal.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1903368
Entropy (8bit):	6.4099552137611004
Encrypted:	false
SSDEEP:	24576:icj8B1SdOTKY4lW8TU6dJihOYqgRPgrhHbUy46XX5gOFQrZJW/aJe/iqDpUg3aK/:Lj8B1Sd84lOp+485gOarZgSJgiq9Um/
MD5:	951778E5CC38970B1CDF6B9169C641A5
SHA1:	C7A5624F24ABF4890735751DCF560FC857F37767
SHA-256:	864166F27ABA6FB7149C57FB5EEB8569459D211A9A4E055D032CF0F16C628E95
SHA-512:	3FA46BA5E4AB49CB51197D7082880FE012F8AF5D7EAFBC2A50E1C13AE4D76B470D6D0E6D631D2D85AB26B2C8FCA914B60B6CDF5647B7F672594DE851E2D55993
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........V.+V7.xV7.xV7.xB\.y@7.xB\.y[7.xB\.y.7.x.4xW7.x.i.y\7.x.i.y:7.x.i.yq7.xB\.y^7.x.i.yX7.x.i.yQ7.xV7.x.6.x.i.yO7.x.i.yW7.x.i.xW7.xV7dxW7.x.i.yW7.xRichV7.x................PE..d......f.........." .....L..........`........................................`............`A......................................................... ..L.... ..P........'...0..P&..p...p...................x...(....................`..(............................text....K.......L.................. ..`.rdata.......`.......P..............@..@.data...........p...n..............@....pdata..P.... ......................@..@.tls................................@....gehcont............................@..@.rsrc...L.... ......................@..@.reloc..P&...0...(..................@..B........................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\libwaresource.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5366536
Entropy (8bit):	7.9856070885371855
Encrypted:	false
SSDEEP:	98304:cnecGJQgXR33lKEtuv+aMxeUYZGE//bzfQYcZKHTucM0ixOHYpcOVL5zgrGly:wecQn8Etu7MeU+/bbckH5xHYT78SM
MD5:	738DCAC532DE76944843D91633A5133A
SHA1:	A062B74368781A6BF035E5738D446E43162300E7
SHA-256:	5DE59EAFAF1B243BE786F48304BD0A1718CC265C474C5A80BBCEA87EB759C0C1
SHA-512:	C6BD67688A5BEB6C69A54258B15A7153166ACC89D5E68D219D7AADF036CA1649D5CDA91D8331B5080DF0548AB75D7916154407B561489EA5D3B3A62E8B2C9BBC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................J...............J.......Rich............PE..L......f...........!..........Q...............................................Q.......R...@.......................................... ....Q...........Q..'..............p............................................................................rdata..............................@..@.rsrc.....Q.. ....Q.................@..@.......f........*...p...p..........f...........................f........T..................f....................RSDS]j.1XfZN..b-.VP.....libwaresource.pdb.......................GCTL....p....rdata..p........rdata$zzzdbg.... ..`....rsrc$01....`&....Q..rsrc$02........................................................................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\libwautils.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3577608
Entropy (8bit):	6.258561400574876
Encrypted:	false
SSDEEP:	49152:m6jZ7zxPG8cKs+1d3l6Afmq4wTcZiLSDoLWeD0gR+j/:fq+lHPEiLSeDEj/
MD5:	C359466310A578FA11D16AD05F4774B1
SHA1:	6D628FE726A48DC27C8728C968728EB73FD85A84
SHA-256:	FAD827890CC73A50B639085E2EAC05EDC0DC135E3FC8BAACD9C42C6EE4A3AD47
SHA-512:	BBFF1CF86AA6D3006F5EA0E14D6C6E086BC00F1B1C5AEFF5AFF75E65EADBD75E66FBF331D81B12086638F7AC03BDEADCF05C3DDDA20779CE6777567A539FC718
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........O...!..!..!."..!.$.d.!.9O...!..."..!...%..!.%..!.'..!...$...!... ..!. ..!.. ...!.`.%..!...(...!..."..!...!..!......!....!...#..!.Rich..!.................PE..d..._..f.........." ..... "..L................................................;.....a^7...`A........................................p.2.<....#4.......:.@....P9..D...p6..'....:..'..`_.p...................._.(.....$..............0".@.....2.@....................text...\."...... "................. ..`.rdata..R....0"......$".............@..@.data........P4......@4.............@....pdata...D...P9..F....4.............@..@.didat..0.....:......<6.............@....tls....a.....:......>6.............@....gehcont$.....:......@6.............@..@.rsrc...@.....:......B6.............@..@.reloc...'....:..(...H6.............@..B................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\license.cfg

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6305
Entropy (8bit):	4.089516564588072
Encrypted:	false
SSDEEP:	192:7nNsf3Y0csch+gzJYnIGf87PFhoyjURLWw:qfqsc7CMhnoD
MD5:	68C9C3FED0718775973952E8EA2BDF82
SHA1:	1F6A66A905EEDA7C8450202B301741B4649C69FB
SHA-256:	28B72358D00A0380F22A5C60F7C8AF6B9D62DA3F2C419FBFDA809A7226C39C15
SHA-512:	0A07F1C9A53A4AE96BE713939EDCB43E3E008997710744068E372102BA7FDC3A5345D8F7A39D5259ECFF19C107AB57B000D8FE91A76C1DC45E42875DD9E3AC11
Malicious:	false
Preview:	{"user_id":"53a4c0c0e4b0f503bd6e4368","timestamp":"1487714270","license_key":"53a4c0c0e4b0f503bd6e4368_d2486e8a623e450d1b2b55b93bdd41438d763e685dc22352aa7bc3e0da04bc288794b48e43aca757bef2ea0adcf958c645f9a0c0059d50c85981da09bdd629a438ec41247eca96de3e07838ee27fa023e525a60d50e417cb360b31f58bc00a160ccd2eb8c13fdc27c7c98a5d76c8f2b1e169320ee6d667c263678eb96c80e0aff5f27fe8f0f61e62e315bfa3b80c4250098280161687167c562e22cc3f2941155a5064dfa5474431ea4c9e52f0e86e5b1294cf22d63bf4f819e1da3b2588ca8b1a614af1f5732b134c7d80c43d332cddd7c9a3cdd98a79cd711edbc18563828efbf994e0bfc930b066b3475a15b554b7b45ed76ad857344e12b4024f5056ace0def0fc2e6f9b095ef6d9dde0fd1e1cf33498c796a56e14962e23a3f27e0340a4c8afcf6001791d17149c788608b65074f22f7a19d79ced7b276e0b7d5706ae3c263901594f31b0313b74ba241213f06af94eb46489ce98d0b342e5a3801a8a0ba9276ce54893b1c23e7e93d1141db9fb3bd665e0fa9b7476216885b1604dc409dba13cd7da79c4c89719ba0fe686b7d5651ed0a5d75787a880ea88d0a9a81a3b3e477bbe3fb94e57064d22b96d7cf46661f66afd28d42f823284eeae0c2d80eb7

C:\Program Files\Palo Alto Networks\GlobalProtect\message.bin

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	124
Entropy (8bit):	3.1948907482604465
Encrypted:	false
SSDEEP:	3:DrAdlTrHblGjlTHlpMUXlHlyGlMUlSlXlA1lCzWlAmKDU61ln:3An/HMjjp3V6D3AvC6lALDU6vn
MD5:	8B1870BC7E7914D528927EE60DF8DB32
SHA1:	63B92F21223FE76BD4369BBCB5FFFE8193E6195A
SHA-256:	269AD59FF16566940EE349E1B79A922D011D94C882081362C3F6D4BA25E581B2
SHA-512:	B24234D188C164BC8DB8489B0874337E80E17E9A5D8677B7874578221B3220FD27B95E77A25A7A8C9596E2D28147D48D99A3F193C96746A46EF1E1799601CED5
Malicious:	false
Preview:	0.1.7.e.6.9.2.6.e.b.6.3.f.1.1.9.d.3.d.3.e.d.b.5.9.b.a.9.2.b.9.c.8.a.c.a.c.b.7.2. .....g.p./.r.e.l.e.a.s.e./.6...3...1. .....

C:\Program Files\Palo Alto Networks\GlobalProtect\pan_gp_event.log

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	140
Entropy (8bit):	4.9228540018972184
Encrypted:	false
SSDEEP:	3:MKX8nVR8ms3eSMI8AQGTRuk3KbMNVTrRX/AujyM1K8v4LdIsRD:MKuVKms3kIRTd53cMNJN/Zj1h4LdIst
MD5:	6DC292C79D71268EFFA76DB7062D55D6
SHA1:	B83A3BD5B80FD4A9CF5070E35F97E987ED5A70DE
SHA-256:	7F74B32645D9D6D3F58BA02B6BBA32D55B0B7F8C6A5A33D151B3E64312875D52
SHA-512:	8B12DE4B7DC581D5E5395880715DBBECA15ED9DB97DA2DE007EA91E79789AA45230E83D4B1AB02122574BE2482B8C189D236487C4B2406E3D877073F254C2A69
Malicious:	false
Preview:	10/28/2024 10:18:04:182 [Info ]: GlobalProtect service started (client version: 6.3.1-376, OS version: Microsoft Windows 10 Pro , 64-bit)...

C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	11088
Entropy (8bit):	7.301773192041184
Encrypted:	false
SSDEEP:	192:HaR/MeSBIyxyhxJCvramyKQFWQFURMwnh5EHX01k9z3A38H/xdt:6RU56w8FR6b7EHR9zSA7t
MD5:	A17145CED05A0C6F38AB3C0425701732
SHA1:	4EF64B143BBE05FBBE0D053B80088C0BBAF1FFE9
SHA-256:	BB0FF85E3D7E8B12EBAEAEB2EE77CAA702E5439718609C1D62074D6F594E3CF9
SHA-512:	52E2842AD81310292EB76260FAB59B478DB1BF9B653A96F331E5EDDF64DF9E280017D67300420674512E21E604B91C6B03F8B1F3D30379FDC1BFDE4451092152
Malicious:	false
Preview:	0.+L...H........+=0.+9...1.0...`.H.e......0.....+.....7......0...0...+.....7.......&.J..A..y.D..I..230303031742Z0...+.....7.....0..G0....p...y.:2...=q`.T...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...10(...F.i.l.e........p.a.n.g.p.d...s.y.s...0.....4.h..c.Eg.<_..^..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...10(...F.i.l.e........p.a.n.g.p.d...i.n.f...0... .Nf..k.\|9k. f...5./j_)}...z(T..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...10(...F.i.l.e........p.a.n.g.p.d...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .Nf..k.\|9k. f...5./j_)}...z(T..0.... ..F.J...'..."z+...5..h..H..W...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...1*0(...F.i.l.e........p.a.n.g.p.d...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..F.J...'..."z+...5..h..H..W......_0..[0J..+.....7....<0:.&

C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.inf

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	4333
Entropy (8bit):	4.760587896237931
Encrypted:	false
SSDEEP:	96:I23N5XHo7pnFhdhEykjSY/BR9Ch60jelHWVx2IscstJqM1pMJM1McMrMZM9iDCZ/:pnX0hFhdxwIh60jel2Vx2TcGJqeEO9qR
MD5:	FC97A101113D88276C58400BBA7AAF77
SHA1:	814D0C9FBDEE6B3DABA6D18389536FDE536D3B2D
SHA-256:	20B44F3859A6FF1B7C644FC90CED4E7AB37CCF5CB50EC21D59A92906932A4842
SHA-512:	616AC0EB0BF54E4EFB94B9CF1A301E8AD08F13D7477256552BE616D450DB84614A3A7E5376EC7D3FC11E893C38CF578EB826FBF156B17B2CF48E5004470E5BDA
Malicious:	false
Preview:	;-------------------------------------------------------------------------------..; PANGPD.INF..;..; Palo Alto Networks GlobalProtect Virtual Ethernet Adapter..;..; Copyright (c) Palo Alto Networks. All rights reserved.....[version]..Signature = "$Windows NT$"..CatalogFile.ntx86 = pangpd.cat..CatalogFile.ntamd64 = pangpd64.cat..CatalogFile.ntarm64 = pangpdarm64.cat..Class = Net..ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}..Provider = %PAN%..DriverVer = 03/02/2023,16.15.20.869....;-------------..;For NDIS 6.x..;-------------..[ControlFlags]..ExcludeFromSelect=....[Manufacturer]..%PAN% = PAN,ntx86,ntamd64,ntarm64....[PAN.ntx86]..%PanGpd.DeviceDesc% = PanGpd.ndi, PanGpd ..[PAN.ntamd64]..%PanGpd.DeviceDesc% = PanGpd.ndi, PanGpd ..[PAN.ntarm64]..%PanGpd.DeviceDesc% = PanGpd.ndi, PanGpd....[PanGpd.ndi]..Characteristics = 0x81 ; NCF_VIRTUAL \| NCF_HAS_UI..;For NDIS 6.x..IfType = 0x6 ; IF_TYPE_ETHERNET_CSMACD..*MediaTy

C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.sys

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	78712
Entropy (8bit):	6.731129659479318
Encrypted:	false
SSDEEP:	1536:aaqBCIdZxkzMsEG66LS5+e8ouaA6e9C/TpGTAIJaw4A7eJ6FPx8xKUxzeO6:afBCWZxkzMsEG61+Z2A6e9C9GsIJawzh
MD5:	6CA91596CFAE2079BA66BFBB099F41E6
SHA1:	12729569CA22D782630E988C56A6472D8CFB96AA
SHA-256:	9CC08F70555E3958E1676FBA56B12D482EF961F8FDBBA9E69DB7A44F3B007A02
SHA-512:	F06F785AA445C1F77D6B3553D3DB99C1373F99FF55505BEA71763F15B62334EBE1DD77550110179942FBB44B85EE7330EE59F888E409C8600F6DF7A7611B8ACE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.u.)...)...)... ...*... ...+...)...{...L...,...L...,...L...-......-......(......(...Rich)...................PE..d....<.d.........."............................@.............................@......;v....`A................................................t...P.... ..`.......4.......xQ...0..$......8............................................................................text...o}.......~.................. ..h.rdata..............................@..H.data...............................@....pdata..4...........................@..HPAGE.....0.......2.................. ..`INIT................................ ..b.rsrc...`.... ......................@..B.reloc..$....0......................@..B................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd64.cat

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	11096
Entropy (8bit):	7.297347328750378
Encrypted:	false
SSDEEP:	192:ewinWnVyXJCCramyKQFWQFgjI+yGI+X01k9z3AGRkt6yXX:hY18FRcNrR9zXRc6yn
MD5:	6F4E74E781E6BCF142DD838CFEBB41C7
SHA1:	F4943F6168827C6E6E5CB4F9E7D34B35398D66C9
SHA-256:	F6F9275BE2DA16360F7498DD1B4631F9B19FFF816D8A025B0146C20572B1A1EA
SHA-512:	6FE8ED0041CB9E9F0ED350DF512738164B1F26A475A50DB2F9691E7855D6E5AE1DE590CAB13E190EBD66765A722B39153C90E913CFA00835C0FC3CCE347BAA85
Malicious:	false
Preview:	0.+T...H........+E0.+A...1.0...`.H.e......0.....+.....7......0...0...+.....7........Y...J..........230303031743Z0...+.....7.....0..G0... .O8Y...\|dO...Nz.\|.\....Y.)..HB1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...10(...F.i.l.e........p.a.n.g.p.d...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .O8Y...\|dO...Nz.\|.\....Y.)..HB0....&.....c...-.SO.H.hCG1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...10(...F.i.l.e........p.a.n.g.p.d...s.y.s...0.....M....k=....So.Sm;-1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...10(...F.i.l.e........p.a.n.g.p.d...i.n.f...0.... .}.K.~..I..H.f.4...<TN%.H..._..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...1*0(...F.i.l.e........p.a.n.g.p.d...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .}.K.~..I..H.f.4...<TN%.H..._.....g0..c0J..+.....7....<0:.&

C:\Program Files\Palo Alto Networks\GlobalProtect\res\Panw-Logo.png

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PNG image data, 497 x 69, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2019
Entropy (8bit):	7.522575447752399
Encrypted:	false
SSDEEP:	48:qA/6Uw4dieD2+LWlekwUIhHvNhMp+1OWfweLyAIJIrmgAl47SkuX40OlFs:rSUJICK4jTCcOWYeGIoflkFs
MD5:	FB91B28E8398A4ECDA31A0AAFFEB2B82
SHA1:	F5D7F15476CBC090DB457C52069BBF77C013EC07
SHA-256:	304E8284FC9DFDB620216A10E76C7FF7EC1025E10B49D26A1E0B81C4881ECA9E
SHA-512:	80C5089414F8DBD83790A0002A9EC81E84F57FAA5D7E88CC9C31DDD13FE52A43122E0DD60167993880AA741EFBA9F8FD663050FB4D388C7826AC244FA09DAC88
Malicious:	false
Preview:	.PNG........IHDR.......E.....Z......pHYs.................sRGB.........gAMA......a....xIDATx...Qr.F...B..s.....Fz...@.....s.8'H8...q...=..3..8.M.i..?.W....D..gf..Z.../+........................................................................M{qg..s6.=.W........v....yY8e ....C"....ZM.<.o...E..F. .._H4....EA~.u...g....8...e.K.kV.~..........2..E^..+..w..h.@.[6........L..g._......[....d.....Bk..E>%.(:.r77`>.A....0.I=......B..9..ht........$/...].s..T...=.e.NL{...tM_.}....a..,......7....?.%2..d.B..Z&..\|..u.&.......5..H....T!.l.}........,/.^...s(..~..m!z_Y....V.s)&.u.....i^.e..U}HL..."8...u...p?]..,pL..-5..=q.h.".....w......h.......gf.>..Is.+.k....u.+..f.:...$....k.+...J.O"E.w.9r.4.2A..@K,...U;..W:.m!...P.k.Q$g.Nv....u.y.N..X....S/..r....1..3..\...#.o..R.d...%.T...m...X.?6\.~j].\.@.J....@.l..:..B..,.....n..`.[E Y.::c....w.O.Z....ns............8......U.g^......]Y}O=d...H......~.s...a...#q.../..{...j..........5....v..z.[..B.[....hu"....yn[W...>

C:\Program Files\Palo Alto Networks\GlobalProtect\res\help.chm

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	29844
Entropy (8bit):	6.821451945908383
Encrypted:	false
SSDEEP:	384:w//YtPT2h5Apf+tFljGJvjXaych4BeweZTeMcAg+eXnxYLXkHeFS:w//k6hakxGbX7Bejecg36fS
MD5:	530E871CA76D7DAF1BCEAF6A3F91CA2A
SHA1:	87554907394F32689BAD4AE02362EF58DF726C5E
SHA-256:	D17AAD0639FA874F2C9AE69D5DA43A237BB162A2397B20ACA813B13421756137
SHA-512:	0310122136047F9AAF46BDBC73FC4916FAF822086E9C6D2C70B41C10D213D94916C688AF8316EC568E2817C77DA70DAF22B4C7C8C23780DCAADFFDC52DCBCBC1
Malicious:	false
Preview:	ITSF....`..................\|.{.......".....\|.{......."..`...............x.......T........................t..............ITSP....T...........................................j..].!......."..T...............PMGL................./..../#IDXHDR......./#ITBITS..../#STRINGS...].d./#SYSTEM..^.`./#TOPICS......./#URLSTR...f.w./#URLTBL....`./#WINDOWS...t.L./$FIftiMain...G.?./$OBJINST.....?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property....../$WWKeywordLinks/..../$WWKeywordLinks/BTree...@.L./$WWKeywordLinks/Data....N./$WWKeywordLinks/Map...Z../$WWKeywordLinks/Property...d ./css/..../css/helpGPclient.css...'..M./css/webworks.css.....%./helpGPclient.1.1.html..Z.h./helpGPclient.1.2.html..B.z./images/..../images/collapse.gif...<5./images/expanded.gif...q4./images/next.gif...y.+./images/nextx.gif...$.)./images/prev.gif....././images/prevx.gif...J././images/seebttm.gif...%,./images/seelflow.gif...Q2./images/seeright.gif.....!./images/seertlow.gif...$+./images/seertup.gif...OO./index.hhk...".../sc

C:\Program Files\Palo Alto Networks\GlobalProtect\tray_busy.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	6.290081649155872
Encrypted:	false
SSDEEP:	24:s18CiWEu1JiVds2ts0hxVLoGjQX9EdeXvO2E+:sOjWEvTLz5ogqLm3+
MD5:	5E3A3BD61AB39532B1BFB045066F6ABF
SHA1:	063E92D47F1E2C7381916336736E557EAC49C88E
SHA-256:	DE96FF2264AF2B47289AD255FA68B2790433298916231226B4B83D3DE6D859A5
SHA-512:	9749F6A2895DC2DE5B188E81791FC70B7F4303DC86894D7B72BB1604970CCE2E43C653804FAC62DF64ED1C4283FC32D04BED280FE6C74A2DB0035090D5C21764
Malicious:	false
Preview:	............ .h.......(....... ..... .............................................%..i$..., ..64...iYM%ub.................................6).m0$..&...+!..G9(.@;)..cU.)o\.WE!c....................F6..<...2'..$...%...PF9.zlX.YH+.4QB..rb.LX7.cE..fM$.............E5..;-..!..) ..^SG.........pS".lW2.>dS.3~g.bP'.jO#.........K9.4F5..<-..) ..MC6.............xY$..`.l^:.&...UqM.qP!.rW(8....M;..J8..@1..."..d[P..............b(..g-.ya6.-...K.p.vY(.x\.{^+.Q>..P<..G6..3'..h_R.................].\|f:.2...X.r..^..`+.c-0VB..VB..N;..:,..peW..................v..tJ...Z..q8..g-..g/..f/L]G!._H!.[C..L;..\|se.............{G...^...a...A..y@..v=..q;..r<RdM#.fM#.jN#.J}_.`sb...........u.{g?..i?...j...`...Y...R...O.~M8kR&.nR%.p[,.:...8...H..b...t...........w...q...j...d..._...\.rW(OuV&.sf7.:...;..Q..k...\|.................z...w...q...lS....y\).\|\(.X.o.3..A..W..l..........................{...v.........~h3.C...7..F..[..k.........~....................................K...O...]..f..n.........\|.......

C:\Program Files\Palo Alto Networks\GlobalProtect\tray_ok.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel
Category:	dropped
Size (bytes):	16958
Entropy (8bit):	5.725469731624699
Encrypted:	false
SSDEEP:	384:Hx1+P+JQ9daMpwN2Xx2GyfE5Yqyw2omMi:Hx1+PEwC8x2GyfYpy8i
MD5:	5CE27F3AE8EBE259AB7C07E5B3FCDBFF
SHA1:	9C47C6D079C807AC2BDED50FEF226F1D00F13FEE
SHA-256:	FBF8BFD212ADF90ED0B77A9F925EA1A54048E4E30F85D7B33FBEA016066507AC
SHA-512:	DF165C9BF6BAB32FA891AD4479ADB2FD71590CE126A90CFC27DDD54F036646869286002635FCD833302F23D28385083C206131256D1A00A7ED17046C177E187E
Malicious:	false
Preview:	......@@.... .(B......(...@......... ......@..#...#.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\tray_ok_msg.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel
Category:	dropped
Size (bytes):	16958
Entropy (8bit):	4.061025246615539
Encrypted:	false
SSDEEP:	192:w7helzMhGRZ1RMgzFE8Qu4DMIgSBjjUKPS5I3HhTpvJ:w7oMOZ19cOQnUjIXhlvJ
MD5:	73EAC94B0F95147466F346156AD520F5
SHA1:	DE51716E7E17686DA59C1BCA9AE40517A89B91BD
SHA-256:	91F2C66868A593185BEB0284A602AF85B098C576ED0190B6D25BFFA7B538BDD1
SHA-512:	62999A8E22DA131BE13C438A899657725AAFDF4F43C48C1F95AB04262219B6AC391AAF2CA90C04E36C711A189B8F5DB32CBFAE2A6CEFD81EA2B63EB5A804C71C
Malicious:	false
Preview:	......@@.... .(B......(...@......... ......@..#...#...................................................................................yc=:m[=.fU5.aN..[G%.YD!.WB..WA..ZE".^H&.dQ0.\fI.O.l.U.xj8..........................................................................................................................................................................................taACfV8.VC%.I7..K9..L9..M;..O<..O<..P<..Q=..R>..R>..R>..6\E.!uf.!te.'.o.A.t.T.zv........................................................................................................................................................................q^Be_M/.H6..K9..M9..N;..O<..Q=..R=..S?..T?..T@..VA..VB .VB .VB .9cK.#zl.#zk.#zk.#zj.#zj.>.h.zgJh........................................................................................................................................................vbA2`O2.I7..K9..M:..N;..Q=..R=..S?..UA..WB!.WC!.YC!.YC!.ZE".ZE".[F".\F".AdK.'.p.&.p.&.p.%.o.$~n.$}n.OL,.lZ:.~kO5..............

C:\Program Files\Palo Alto Networks\GlobalProtect\tray_stop.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 1 icon, 64x64, 32 bits/pixel
Category:	dropped
Size (bytes):	16958
Entropy (8bit):	5.009083477350243
Encrypted:	false
SSDEEP:	192:mtg0MzcyaAFFtS6cwTeEzxjGaobaJNmG/Kr2/M/VrNbt:Ag06tFI6cgXxjGaQanmWKB/l7
MD5:	98D1ED97265CD2F09211A006F896D145
SHA1:	11CCAB22535BDD2EE25DA99F536C4B52A06B66F1
SHA-256:	97A5443C3FA89AF6A971E42CBDBFA6280EC79624AC942E2580F21519F34F1CB0
SHA-512:	63FA9D5323FA303E4648D1B56A688CB68A719B0A54A8C5563EE3959DE4C75921E405E62CF5FE5294BCB6E035660257B8CAD82735527ECD0A600096F268F28C61
Malicious:	false
Preview:	......@@.... .(B......(...@......... ......@..#...#.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\uninstall.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 12 icons, 48x48, 8 bits/pixel, 32x32, 8 bits/pixel
Category:	dropped
Size (bytes):	171014
Entropy (8bit):	5.211441545204587
Encrypted:	false
SSDEEP:	1536:+Bisab1mVVV/6xUostSfCxBvglkkkkBqPrjECQpBMtz+TDfMFH36:+i/1JkDBvgYhSTDfMFHK
MD5:	BB92CF1770EE4753DE901FFFB459B10C
SHA1:	1792E3C335B123317643561AEE8BAE0EA4FCC99A
SHA-256:	46F7E20DDD21BAC0C45B01F0DB1C5458FFDA24CA61F9D03B874DBFC3A2DBE41B
SHA-512:	C923D3BAF9262B436F773876F61D5548B9DA35BF019C84402872BA7A6C9965B58AD2AA6B99A11789A1EAC1EAD56B26A9FB4AB234F67B87A75E2B75972AC60836
Malicious:	false
Preview:	......00.............. ..........n...........................h............. .(...F$..``.... .....n,..HH.... ..T......@@.... .(B......00.... ..%...W.. .... .....n}........ ............... .h.......(...0...`...................................o7..t:..z=..r=..x?..}A..hA..oH..hG..iH..tJ..{R..\U4.kM$.{V#.sZ7.s[D.SbK.Nl[.QfR.PhV.zdF.qcU..iT.teX.{l_.Kqd.Iti..E...I...L...K...N...Q...P...P...T...X...a...V!..Y!..["..^+..Z"..^ ..b+..c"..h6..c0..j)..p,..m:..t5..}=..n@..xK..w\..{T..{C...C..vb..ye..\|g.w.g...F...\...W...]...l...l...w...z...z...d...l...o...\|...z...J..O..W..Y..]..a..c..w..h..m..{..v...w.......... ...............#..,..#9..&&...1..13..&J..;I..B..:H..:U..Ao..CT..NY..Cd..X\|..A\|..GH..WW..cg..ls..x\|..hh..xx..=.......4...6...3...7...8...v...A...F...F...g...8...3...=...4...<...6...7...J...\|...B...S...@...Q...[...y...f...9...;...>...m...t...c...}...A...@...W...C...]...c...t...y................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\wa_3rd_party_host_32.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2252040
Entropy (8bit):	6.628328351958888
Encrypted:	false
SSDEEP:	49152:mjU9tI/hh9HHvmf63aZNQaEV7LBsSFMPwAUV68Tz+yvxYGKiuNftZxxeC/I:mjwtI/lHHvySHz+yvGGKiqY
MD5:	FBF3F390C34BCBED6BEADDB22DA21925
SHA1:	F25A4655C55F46FE4A8AD453CA1CDAE4490B0132
SHA-256:	8A0186470697C903944F194AD4C7B6A5F1062AB420F3CF33CC53305ACD10F6D3
SHA-512:	8AD15A5CC49D94131FEBEE765B8CBC8AC00C11CBDAD7D05EAC1929FF4B71FC09AC7E19393E9CF33A18D427ED186E36DCE10CBDF88C41280A0EE30CC598682BFB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........p>...m...m...m..lv..m..l...mVn.m...me..l...me..l...me..lA..m..l...m..l...m..l...m...m...m...l...m...l...m...l...m...m...m..m...m...l...mRich...m........PE..L...n..f.....................(......0........ ....@...........................".......#...@.........................@[ ......` ......`!..=...........6"..'....!.\...P...p............................7..@............ ..<....Z .@....................text...*........................... ..`.rdata...W... ...X..................@..@.data........ ..v...f .............@....didat.......@!....... .............@....tls.........P!....... .............@....rsrc....=...`!..>.... .............@..@.reloc..\.....!.......!.............@..B........................................................................................................................................................................................

C:\Program Files\Palo Alto Networks\GlobalProtect\wa_3rd_party_host_64.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2828040
Entropy (8bit):	6.395986963488891
Encrypted:	false
SSDEEP:	49152:RGF/42G2dZJusd71smTtV539E6TBJdy5nV1X7E7:wF/2s0F6FvIC
MD5:	B484EC47569E3F315AD7087F69D2B230
SHA1:	60A77774FCFF9AD4F77A3559BB27BA14DB932956
SHA-256:	7FE717EDDAD5176E525C3B5A66711A8121D7A09D61178A9DE99FF0EA03648962
SHA-512:	CD4DDDC42062707693F1EA1803E5FA8311911417C4478A704A6BAA15055F3141C3D121B96BF6A10DB34D137792157A78AC784ECE27F06C285012E6B9B09A5E2F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........<V.noV.noV.noB.mnZ.noB.kn.no.#.oU.no..mn_.no..jn~.no..kn.noB.hnT.noB.jnN.noB.onG.noV.oor.no..jnE.no..fn..no..nnW.no..oW.noV..oW.no..lnW.noRichV.no................PE..d...0..f.........."..........v......P..........@..............................+.......+...`...........................................(.X...H.(......@+..=....)..f....+..'....+..(...y$.p...................@z$.(...`".....................@.(.@....................text...,........................... ..`.rdata..............................@..@.data.........(.......(.............@....pdata...f....)..h...).............@..@.didat.. .....+....................@....tls......... +....................@....gehcont$....0+....................@..@.rsrc....=...@+..>.................@..@.reloc...(....+...................@..B................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307397378436924
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDuga:gJjJGtpTq2yv1AuNZRY3diu8iBVqFE
MD5:	9E2DF59D67B604737E1E936078DE0396
SHA1:	6EFECBBB8D843F0B5E782501D0DCE08523D90E32
SHA-256:	AA897DDB2B48E90B8D3E6C7C2806681AA606BF1504DE3CFC353F3E7AC0FDA15C
SHA-512:	8F69053E90D3C0CBC3F9C0BC72DADA973E20BD320BE1B4EFB63CAF56FA8BEDF327FC1B9B60008D55DF2A3E7AC9891E460CE8C3F067F52D66C5BF4522DE38C145
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x9ed53046, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6586166084607906
Encrypted:	false
SSDEEP:	1536:hSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:haza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	D18C2E1B79CFF2544BE795809B598B24
SHA1:	E1B3223F3AAC10045176F06285F946AE526C4329
SHA-256:	C33B81287658D3EFCFD93F607F955566C577EE856650BE99DE51C295ECF9C2C4
SHA-512:	41089ACE1C599204FB55C40A3306E8A3C9D76749F3C2CC5102354C004DEFBF9F37C77A42B890F80052EC5634BA0EE3A1E6DDBE72949E631C40C8E544A2878D86
Malicious:	false
Preview:	..0F... ...............X\...;...{......................0.z..........{..#....\|..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................f=#....\|......................#....\|...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08084840095642432
Encrypted:	false
SSDEEP:	3:Vil6Yexg+hVGuAJkhvekl1DbstollrekGltll/SPj:Al6zxg+brxlxbJJe3l
MD5:	F13B341FC572C6BDD6A4624B1533EBDB
SHA1:	8F03F13E578592DB382F875DF060B98E5B1B83D6
SHA-256:	2603186EB81E01588EF267CAE22561ACF945F71BBE67E2A369099CA4B0E8B494
SHA-512:	3F21E5A3D0FFEED2F4B07853B12855696E20D2676FC0ACA7DD844073D8DBF304B93957710169C3579F97CA2AA1FD8CFB132711E7056F080CC5148C4EA736A311
Malicious:	false
Preview:	..&^.....................................;...{..#....\|.......{...............{.......{...XL......{......................#....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Palo Alto Networks\GlobalProtect\GlobalProtect.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Icon number=0, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	2655
Entropy (8bit):	2.6365895706593645
Encrypted:	false
SSDEEP:	48:8wp7i/GpUxt+XGM/UxtAXxdIscQve5/UxtA5ySOkQUW/UxtA:8wVSxjMcxaXUwG5cxa5IUWcxa
MD5:	0C070B9BAF164D8D4A0FCDF4105D4003
SHA1:	8D3DB81256DFEE7FE9C70ECEBE7FCB6561AE7E77
SHA-256:	946668AF1E595790ED79F9BC5CD634943131E75D986416A8974734F3961B86A8
SHA-512:	FE83556444A2547077E52CAF8323E1A8B3A4B7AD57C3B99E54AABA518D3C0DB7793A739D530674B347C17506AB17FD6EAECC2387D750A3895D047FD8266919E0
Malicious:	false
Preview:	L..................F.P...........................................................P.O. .:i.....+00.../C:\...................V.1.....DW#r..Windows.@......OwH\Y.q....3........................W.i.n.d.o.w.s.....\.1.....\Yr..Installer.D......O.I\Yr.............................I.n.s.t.a.l.l.e.r.......1.....\Yr..{62BC3~1..~......\Yr\Yr.............................{.6.2.B.C.3.D.7.7.-.3.D.5.D.-.4.8.2.1.-.B.1.6.2.-.5.B.F.5.2.C.6.B.1.1.A.F.}.......2.....\Yr!._F385D~1.EXE..h......\Yr\Yr.....2......................._.F.3.8.5.D.C.A.0.A.7.C.7.2.4.8.F.5.4.C.3.C.D...e.x.e.......i.....\.....\.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.6.2.B.C.3.D.7.7.-.3.D.5.D.-.4.8.2.1.-.B.1.6.2.-.5.B.F.5.2.C.6.B.1.1.A.F.}.\._.F.3.8.5.D.C.A.0.A.7.C.7.2.4.8.F.5.4.C.3.C.D...e.x.e.2.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.P.a.l.o. .A.l.t.o. .N.e.t.w.o.r.k.s.\.G.l.o.b.a.l.P.r.o.t.e.c.t.\.W.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.6.2.B.C.3.D.7.7.-.3.D.5.D.-.4.8.2.1.-.B.1.6.2.-.5.B.F.5

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Palo Alto Networks\GlobalProtect\PanGPSupport.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Icon number=0, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	2655
Entropy (8bit):	2.643671686963694
Encrypted:	false
SSDEEP:	48:8wp7i/GOUxttIR+/UxtepxdIscQve5/UxteLHazSO+W/Uxte:8wVzxs+cxUpUwG5cxULHvWcxU
MD5:	855A989498313154B2F31113886CBAE8
SHA1:	3C9E6EA3D858D820856DBAACA7F76511A6110B11
SHA-256:	9FE583482555579F11665082F54AFB10B7CD2754A6674BC0C79B1711BA816DF7
SHA-512:	D492BE84D99B1C37A0E5CDDD400E6D15D004ADF5C3F25AC37B8ECB8D2ADEF69D1EB2461457F853C76A032E71683CEC1FE90C12B56B234064197729A8B1D0CB0A
Malicious:	false
Preview:	L..................F.P...........................................................P.O. .:i.....+00.../C:\...................V.1.....DW#r..Windows.@......OwH\Y.q....3........................W.i.n.d.o.w.s.....\.1.....\Yr..Installer.D......O.I\Yr.............................I.n.s.t.a.l.l.e.r.......1.....\Yr..{62BC3~1..~......\Yr\Yr...........................u..{.6.2.B.C.3.D.7.7.-.3.D.5.D.-.4.8.2.1.-.B.1.6.2.-.5.B.F.5.2.C.6.B.1.1.A.F.}.......2.w...\Yr!._2AE9C~1.EXE..h......\Yr\Yr.....4.....................u.._.2.A.E.9.C.4.5.0.2.1.E.1.A.9.6.B.A.1.E.3.3.A...e.x.e.......i.....\.....\.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.6.2.B.C.3.D.7.7.-.3.D.5.D.-.4.8.2.1.-.B.1.6.2.-.5.B.F.5.2.C.6.B.1.1.A.F.}.\._.2.A.E.9.C.4.5.0.2.1.E.1.A.9.6.B.A.1.E.3.3.A...e.x.e.2.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.P.a.l.o. .A.l.t.o. .N.e.t.w.o.r.k.s.\.G.l.o.b.a.l.P.r.o.t.e.c.t.\.W.C.:.\.W.i.n.d.o.w.s.\.I.n.s.t.a.l.l.e.r.\.{.6.2.B.C.3.D.7.7.-.3.D.5.D.-.4.8.2.1.-.B.1.6.2.-.5.B.F.5

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\1bf33a02-f4dc-428a-b8a6-f5eb9dde1474.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2901
Entropy (8bit):	5.308790822360244
Encrypted:	false
SSDEEP:	48:YDEFMsFiHGS0afMeQFIF5oif93p8QSh/cIgwLURMYXylVotoWR5K1DAHB+mdrxmC:PNkGS1f3QFY5lf958rh/cI9URoDotosL
MD5:	853EEE2C56907EE962C494B631F386EC
SHA1:	1AC92AD371B448D71BEFE26C903FA206E932C3D1
SHA-256:	C5DF2B53980E8FF7CB3DB2FA4C15F029502427CDC50A94AC5E664F107F2A998B
SHA-512:	675B27ED3853F3378F5E2A3E2E962475F80682B2119296E7D7EA3327DB34CE51E41EC214DCC9C8CD2774681A8B38A2A9E7F463830EB1487C40CEF42DBFE738A4
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACs2ipmYAX7Q5eLDfKhmCSzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAGJqjE6k+gmz4o0SRufQ6JT0qwvjNTL7fHy1ZdzJjx4QAAAAAOgAAAAAIAACAAAABlihj6X+k1o+AlgQy2GAAwDu0zpRj/08eeT7CIPXx2cTAAAAA1A7nMzPQN2Oj3vDVrgkHCVAx7Vf7jdTDZ0TaP0Lkfi+XMxItzVyiFMrqAtWFlZfpAAAAA/mo43xL2ClCF835ZvmHabFModP8yuKV/jLK5BTTirkuA7ntxEEXxfhg9BSi2O7B2m9VSfjNPkoHqbE9RMFc7Ug=="},"policy":{"last_statistics_update":"13374598654399654"},"profile":{"info_cache":{"Default":{"avatar_icon":"chrome://t

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\5b1008cf-42f4-4961-bfa0-57a7ed4e3ae7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	951
Entropy (8bit):	5.733488904893808
Encrypted:	false
SSDEEP:	24:YKWJu5rrtueQVoEIF5oifiVFBIaeCaWOkPybvXzQQRCYfYg:YqfMeQFIF5oifSBIZvkPUvsB0
MD5:	892CCD8595A8BD46AEC4117C3F35BE28
SHA1:	78FFA6639E437E4EB98680EC544ABA5517B9E601
SHA-256:	0829349B10B000EB9BB884ECD36D529E9B0E8A5CC2AE32B388F1FC5721746F57
SHA-512:	288CBB9AF2A8703848D1A1D29C8708B0F778C6147FAF580AF7A604A35BD68B04D2BAE2F689FFB634A5F2F674A181F91A562A825ACC1D54B77CD7F67EDF9F07CE
Malicious:	false
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACs2ipmYAX7Q5eLDfKhmCSzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAGJqjE6k+gmz4o0SRufQ6JT0qwvjNTL7fHy1ZdzJjx4QAAAAAOgAAAAAIAACAAAABlihj6X+k1o+AlgQy2GAAwDu0zpRj/08eeT7CIPXx2cTAAAAA1A7nMzPQN2Oj3vDVrgkHCVAx7Vf7jdTDZ0TaP0Lkfi+XMxItzVyiFMrqAtWFlZfpAAAAA/mo43xL2ClCF835ZvmHabFModP8yuKV/jLK5BTTirkuA7ntxEEXxfhg9BSi2O7B2m9VSfjNPkoHqbE9RMFc7Ug=="},"uninstall_metrics":{"installation_date2":"1730125054"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":2058,"pseudo_low_entropy_source":7162,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13374598654179063","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\BrowserMetrics\BrowserMetrics-671F9CFE-578.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.30868677801731464
Encrypted:	false
SSDEEP:	768:YYpMUbZW+4rmiAkgxhLd8OMoQCD8oG7RGO:YfGZW+4r4kahLd8OMoI7RG
MD5:	28FDFA86040BC21D5FEBFA181B3C67DE
SHA1:	8D5E02428562ADA1F31B45E74214C5C3867C6031
SHA-256:	AB7CA73BCBBB956767623985E1575A7A6DB5C4CFBD3C1E2CC04CF98E1EB9602B
SHA-512:	2007165FBEEB675F968F0EF90DB59D23B77782C097F7DF2D62D9734E9BFD2CF0556EFACA394EBABFF4DB14953B9EFCEB45B484716E08BFC536D80455D8EB1AB9
Malicious:	false
Preview:	...@............C.].....@...................H...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....7.........117.0.2045.47-64".en-GB...Windows NT..10.0.190452(..x86_64..?........".quxswq20,1...x86_64J....?.^o..P....................7.>........fW:00000000000000000000000000000000000000000000!00000000000000000000000000000000000000000000!PanGPA.exe..1900/01/01:00:00:00!PanGPA.exe".6.3.1-3762...".*.:..............,..(.......EarlyProcessSingleton.......Default3.(..$.......msEdgeEDropUI.......triggered....8..4... ...msDelayLoadAuthenticationManager....triggered....<..8...#...msSleepingTabsShorterTimeoutDefault.....triggered....8..4... ...msEdgeMouseGestureDefaultEnabled....triggered....8..4.......msEdgeShowHomeButtonByDefault.......triggered....<..8...$...msConsumerIEModeToolbarButtonDef

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	1.8846982569091677
Encrypted:	false
SSDEEP:	3:FiWWltlfe+NEjYb1gmlx/ll:o1fe+fCmlZl
MD5:	E17F12CF68D08BDBAC228FE580FC5C1F
SHA1:	A26EB34365BF50D6E964B07C41281D786905389C
SHA-256:	0A94C85088FC49E0076A5C731058D40DA4365BA05A6B62E17AD203A89011D0C8
SHA-512:	006112F11F05AC945B747AB93542D70255056AD41F539317FE999C5E40B46CCED97958E1CA4D5E2CF7042BAE61B110BACE81EF8E49760884BFB3D0307847553D
Malicious:	false
Preview:	sdPC....................ERY..*M.u{..<i>................................................................................................................................................................................................{F3017226-FE2A-4295-8BDF-00C3A9A7E4C.}C:........

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Crashpad\throttle_store.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.6219280948873624
Encrypted:	false
SSDEEP:	3:8g6Vvn:8g6Vv
MD5:	9E4E94633B73F4A7680240A0FFD6CD2C
SHA1:	E68E02453CE22736169A56FDB59043D33668368F
SHA-256:	41C91A9C93D76295746A149DCE7EBB3B9EE2CB551D84365FFF108E59A61CC304
SHA-512:	193011A756B2368956C71A9A3AE8BC9537D99F52218F124B2E64545EEB5227861D372639052B74D0DD956CB33CA72A9107E069F1EF332B9645044849D14AF337
Malicious:	false
Preview:	level=none expiry=0.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Cache\Cache_Data\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Cache\Cache_Data\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Cache\Cache_Data\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Cache\Cache_Data\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Cache\Cache_Data\index

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	524656
Entropy (8bit):	5.027445846313988E-4
Encrypted:	false
SSDEEP:	3:LsulYKll:Lsc
MD5:	F3B9B7E4F634D6192DCA62E96046C17F
SHA1:	E67AEC7F63C47C61BFC9F6A74EB660A9952AC3E8
SHA-256:	7731C61DA3395E87DEA67DB7BF6E3F16C99AD8FF76224E217BB9D8F8C9333FEC
SHA-512:	995D3CB36983D1D1044621642EF9516D8CE63278767F2F36FDA8C50AFB76BB88F5B4B881CCFDFC5D9F99C75F2A11C1CF6D2CFE1073D2E2437BE3789B0880702B
Malicious:	false
Preview:	.........................................{.j ./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Code Cache\js\index

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Code Cache\js\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:8Z/aEQGb+n:8l1L+
MD5:	4D0CB186B7935FE5BA0D074D42FAF8C2
SHA1:	1A31CCB9BE9725C488645A39D0FC4747E15E0AA1
SHA-256:	1AD7194F7ACD2DA5A347FEDF0B000695D6CC7F6679CD2A8FAF5FB2B6D1B14355
SHA-512:	753F380AC8D92C7F5E82A92CB53DF48520A865B9F364509A781CE1F3886B7AD32BE8AED637C72E93D4FE8DDC332CB0E1F3018368716C0A5F4E2DA7385D97CAFF
Malicious:	false
Preview:	(...!.oy retne..........................i ./.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Code Cache\js\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:8Z/aEQGb+n:8l1L+
MD5:	4D0CB186B7935FE5BA0D074D42FAF8C2
SHA1:	1A31CCB9BE9725C488645A39D0FC4747E15E0AA1
SHA-256:	1AD7194F7ACD2DA5A347FEDF0B000695D6CC7F6679CD2A8FAF5FB2B6D1B14355
SHA-512:	753F380AC8D92C7F5E82A92CB53DF48520A865B9F364509A781CE1F3886B7AD32BE8AED637C72E93D4FE8DDC332CB0E1F3018368716C0A5F4E2DA7385D97CAFF
Malicious:	false
Preview:	(...!.oy retne..........................i ./.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Code Cache\wasm\index

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Code Cache\wasm\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:8Z/aEQGb+n:8l1L+
MD5:	4D0CB186B7935FE5BA0D074D42FAF8C2
SHA1:	1A31CCB9BE9725C488645A39D0FC4747E15E0AA1
SHA-256:	1AD7194F7ACD2DA5A347FEDF0B000695D6CC7F6679CD2A8FAF5FB2B6D1B14355
SHA-512:	753F380AC8D92C7F5E82A92CB53DF48520A865B9F364509A781CE1F3886B7AD32BE8AED637C72E93D4FE8DDC332CB0E1F3018368716C0A5F4E2DA7385D97CAFF
Malicious:	false
Preview:	(...!.oy retne..........................i ./.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:8Z/aEQGb+n:8l1L+
MD5:	4D0CB186B7935FE5BA0D074D42FAF8C2
SHA1:	1A31CCB9BE9725C488645A39D0FC4747E15E0AA1
SHA-256:	1AD7194F7ACD2DA5A347FEDF0B000695D6CC7F6679CD2A8FAF5FB2B6D1B14355
SHA-512:	753F380AC8D92C7F5E82A92CB53DF48520A865B9F364509A781CE1F3886B7AD32BE8AED637C72E93D4FE8DDC332CB0E1F3018368716C0A5F4E2DA7385D97CAFF
Malicious:	false
Preview:	(...!.oy retne..........................i ./.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\DawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\DawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\DawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\DawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl28l:Ls3ll
MD5:	491B130011A7003FA65E0964A22FF327
SHA1:	4100A89B7BD7E49813CFF125B69586A02FFBDC96
SHA-256:	04C29A3FC07675DF464DF996767CB196EDE42B7F142A714A79199CBDBC1F13F1
SHA-512:	A0EFD622DEC29DB3E6B6EE094F1BA83D7F29F83071DC57923D947548C338644B75A45DCDCF2AE9450AC2264C64E00D15392069A5D721861280C95944DD6BEE6C
Malicious:	false
Preview:	.........................................c.i ./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Extension Rules\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	38
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlX:qTCT
MD5:	51A2CBB807F5085530DEC18E45CB8569
SHA1:	7AD88CD3DE5844C7FC269C4500228A630016AB5B
SHA-256:	1C43A1BDA1E458863C46DFAE7FB43BFB3E27802169F37320399B1DD799A819AC
SHA-512:	B643A8FA75EDA90C89AB98F79D4D022BB81F1F62F50ED4E5440F487F22D1163671EC3AE73C4742C11830214173FF2935C785018318F4A4CAD413AE4EEEF985DF
Malicious:	false
Preview:	.f.5................f.5...............

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Extension Rules\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	367
Entropy (8bit):	5.263308521840882
Encrypted:	false
SSDEEP:	6:ybNz1923AkIJOd9IiDuXqjyqpaVdg2KLlkbIN1yq2P923AkIJOd9IiDuXqjyqpaY:m25IJi9EXqWqHL3Ov45IJi9EXqWqo3F2
MD5:	5C15F20F4AB653286EB88B5F2B7217EB
SHA1:	B6CD3F942C2E5CFC2C5CAD275B4F57CB1A1BB107
SHA-256:	93F2508852BF96442E4F1F0732AA440763D524A087330EEE645C27B5754C3DEA
SHA-512:	70DD14000ECD195F7F875D04625195A4596FAC9CDA9B2B128D10DC323DEEAA01CED469332EC1FFB2526DBD8B70235518683F5DB3AF70B04DE4CD29833C9197FE
Malicious:	false
Preview:	2024/10/28-10:17:34.531 a50 Creating DB C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Extension Rules since it was missing..2024/10/28-10:17:34.547 a50 Reusing MANIFEST C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Extension Rules/MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Extension Rules\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Extension Scripts\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	38
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlX:qTCT
MD5:	51A2CBB807F5085530DEC18E45CB8569
SHA1:	7AD88CD3DE5844C7FC269C4500228A630016AB5B
SHA-256:	1C43A1BDA1E458863C46DFAE7FB43BFB3E27802169F37320399B1DD799A819AC
SHA-512:	B643A8FA75EDA90C89AB98F79D4D022BB81F1F62F50ED4E5440F487F22D1163671EC3AE73C4742C11830214173FF2935C785018318F4A4CAD413AE4EEEF985DF
Malicious:	false
Preview:	.f.5................f.5...............

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Extension Scripts\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	371
Entropy (8bit):	5.279872959176679
Encrypted:	false
SSDEEP:	6:ybeb1923AkIJOd9IiDuXqjyqp6FB2KLlkbh9yq2P923AkIJOd9IiDuXqjyqp65Ig:m5IJi9EXqWqQFFLFv45IJi9EXqWqQWF2
MD5:	EA0CD158644D162CC3BB56745C20F22A
SHA1:	B05BE662F4BD33475B1FEC2ECACF5E5D28FCB90C
SHA-256:	0C800D534FCCAA2C128877AE948F5035E46AB74005548C60F2353731CF61555B
SHA-512:	F69BB99CCAD40300E6A528FC904F4D43B70594DB4822D994106B08A825B2F83C4E10E2FCDECE9A3321CA7BB770733AF9B2279EED20383FA54895BE5A5D384C99
Malicious:	false
Preview:	2024/10/28-10:17:34.592 a50 Creating DB C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Extension Scripts since it was missing..2024/10/28-10:17:34.683 a50 Reusing MANIFEST C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Extension Scripts/MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Extension Scripts\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Extension State\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	114
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlXNQxlXNQxlXNQxlXNQxlX:qTCTCTCTCTCT
MD5:	891A884B9FA2BFF4519F5F56D2A25D62
SHA1:	B54A3C12EE78510CB269FB1D863047DD8F571DEA
SHA-256:	E2610960C3757D1757F206C7B84378EFA22D86DCF161A98096A5F0E56E1A367E
SHA-512:	CD50C3EE4DFB9C4EC051B20DD1E148A5015457EE0C1A29FFF482E62291B32097B07A069DB62951B32F209FD118FD77A46B8E8CC92DA3EAAE6110735D126A90EE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Extension State\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	367
Entropy (8bit):	5.254287908031889
Encrypted:	false
SSDEEP:	6:ybyQb1923AkIJOd9IiDuXqjyqpYg2KLlkbNVjyq2P923AkIJOd9IiDuXqjyqpNIg:6O5IJi9EXqWqNLsVOv45IJi9EXqWqwF2
MD5:	70B0535FE749571E3532E63676AA5165
SHA1:	D4CB255456FBE035DE6B83A4EC473D5CD431EA7A
SHA-256:	A4C92D3B51F0E676BD0E563EC90522D7F1F1A7F115E71F36A82F28067CAB06C9
SHA-512:	881EAE2746A1502AF936E76ECEC0C78D090034BE4F860413E5CDF503F5592A9936D74F05B9E26CFE2C58801790194A3D2AEFFA05DB1010B85848DFB9B6041AC6
Malicious:	false
Preview:	2024/10/28-10:17:34.847 a50 Creating DB C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Extension State since it was missing..2024/10/28-10:17:34.863 a50 Reusing MANIFEST C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Extension State/MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Extension State\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Favicons

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 10, cookie 0x8, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6975083372685086
Encrypted:	false
SSDEEP:	24:LLiZxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:EBmw6fU1zBmI
MD5:	F5BBD8449A9C3AB28AC2DE45E9059B01
SHA1:	C569D730853C33234AF2402E69C19E0C057EC165
SHA-256:	825FF36C4431084C76F3D22CE0C75FA321EA680D1F8548706B43E60FCF5B566E
SHA-512:	96ACDED5A51236630A64FAE91B8FA9FAB43E22E0C1BCB80C2DD8D4829E03FBFA75AA6438053599A42EC4BBCF805BF0B1E6DFF9069B2BA182AD0BB30F2542FD3F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....._.c...~.2.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................s...;+...indexfavicon_bitmaps_icon_idfavico

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\GPUCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\GPUCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\GPUCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\GPUCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlPl:Ls3Pl
MD5:	6714B696C8B19E9DC3E8A9A6798B9ACC
SHA1:	04DA8AB26168502C9581D1305F72A8711F281068
SHA-256:	7354F060DA519C782BA4459374423DF52051D85E7E0B47F6B39846DB1D4A32B1
SHA-512:	CCBD0D251E91FF02B82ADE5945759B5B000FE1765404FB28715F67A037D59C37CA54F40A1177D282083A251373224051D8DAC05A49EEB48F5E06217FE802C92D
Malicious:	false
Preview:	........................................I..i ./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\History

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Local Storage\leveldb\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Local Storage\leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	modified
Size (bytes):	381
Entropy (8bit):	5.236922220758127
Encrypted:	false
SSDEEP:	6:ybTJ81923AkIJOd9IiDuXqjyq1a2jM8B2KLlkbTAYDVq2P923AkIJOd9IiDuXqjN:IJx5IJi9EXqWq1jFLgAYhv45IJi9EXqR
MD5:	6D18A5EEB5EDA546094FBF9CD45E5A54
SHA1:	906144F0F24A37113C74955A99D29E31DB77C223
SHA-256:	D6B2AEAE502A9A7869F570B530CE59BD0DE9B3C6CF6C718A70A9E28C6BA7EB4D
SHA-512:	44C332E8F489996D065DF79EDE9711D3F96C51206C2F1CCD01DCE5668DA774812F5F3A06D37176870B6D939450838BF119340B1EE006AAA103476701759C7487
Malicious:	false
Preview:	2024/10/28-10:17:35.560 1de0 Creating DB C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Local Storage\leveldb since it was missing..2024/10/28-10:17:35.676 1de0 Reusing MANIFEST C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Local Storage\leveldb/MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Local Storage\leveldb\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Login Data

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 21, cookie 0xc, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	43008
Entropy (8bit):	0.9009435143901008
Encrypted:	false
SSDEEP:	96:C2BeymwLCn8MouB6wzFlXqiEqUvJKLuyn:C2TLG7IwRFqidn
MD5:	FB3D677576C25FF04A308A1F627410B7
SHA1:	97D530911F9CB0C37717ABB145D748982ADA0440
SHA-256:	A79300470D18AF26E3C5B4F23F81915B92D490105CE84A8122BF8100EC0C7517
SHA-512:	ED6666B064958B107E55BD76E52D2E5BF7A4791379902D208EF909A6B68803240D372CE03641249EB917C241B36A5684656A48D099A8A084AD34BA009857B098
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Network\8ff8253f-6b68-46e8-8f4c-2409e7add71c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Network\9027cd4e-491b-4d2a-bad3-d38ca88a2101.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Network\99277476-34d4-4b90-97f2-35d8c7a1d2f7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.5559635235158827
Encrypted:	false
SSDEEP:	48:T6IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:OIEumQv8m1ccnvS6
MD5:	9AAAE8C040B616D1378F3E0E17689A29
SHA1:	F91E7DE07F1DA14D15D067E1F50C3B84A328DBB7
SHA-256:	5B94D63C31AE795661F69B9D10E8BFD115584CD6FEF5FBB7AA483FDC6A66945B
SHA-512:	436202AB8B6BB0318A30946108E6722DFF781F462EE05980C14F57F347EDDCF8119E236C3290B580CEF6902E1B59FB4F546D6BD69F62479805B39AB0F3308EC1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Network\SCT Auditing Pending Reports~RF491dc6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.36515621748816035
Encrypted:	false
SSDEEP:	24:TLH3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:Tb31DtX5nDOvyKDhU1cSB
MD5:	25363ADC3C9D98BAD1A33D0792405CBF
SHA1:	D06E343087D86EF1A06F7479D81B26C90A60B5C3
SHA-256:	6E019B8B9E389216D5BDF1F2FE63F41EF98E71DA101F2A6BE04F41CC5954532D
SHA-512:	CF7EEE35D0E00945AF221BEC531E8BF06C08880DA00BD103FA561BC069D7C6F955CBA3C1C152A4884601E5A670B7487D39B4AE9A4D554ED8C14F129A74E555F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......X..g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Network\aeb49034-d027-48bd-824f-cbaba04607bc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	59
Entropy (8bit):	4.619434150836742
Encrypted:	false
SSDEEP:	3:YLbkVKJq0nMb1KKtiVY:YHkVKJTnMRK3VY
MD5:	2800881C775077E1C4B6E06BF4676DE4
SHA1:	2873631068C8B3B9495638C865915BE822442C8B
SHA-256:	226EEC4486509917AA336AFEBD6FF65777B75B65F1FB06891D2A857A9421A974
SHA-512:	E342407AB65CC68F1B3FD706CD0A37680A0864FFD30A6539730180EDE2CDCD732CC97AE0B9EF7DB12DA5C0F83E429DF0840DBF7596ACA859A0301665E517377B
Malicious:	false
Preview:	{"net":{"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5560
Entropy (8bit):	4.784566079327545
Encrypted:	false
SSDEEP:	96:st//BXs13Trb9YG8zqd81h6Cb7/x+6MhmuecmAeXZ2MR7K:stH9sRKGkM8vbV+FiA+PhK
MD5:	DC92F638DDDCF0F15FDEA6F5DA306084
SHA1:	BCEB07885376A01E7C11CBC182F6AE807B9CC0E1
SHA-256:	26C066615C968DC1ACBEADB1D393E0A5A096B9C59CA1E624CCE3E3FBC641D19F
SHA-512:	B6508A7D342FD69BE0478BFC5F306B90707DB27DDF171735E24592F074EF225D1C4D8B21264B57E3819BA523D06666EE748FA830B30E76180243BDBF9D9A3191
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374598654630969","alternate_error_pages":{"backup":true,"enabled":false},"autocomplete":{"retention_policy_last_version":117},"autofill":{"autostuff_enabled":false,"credit_card_enabled":false,"custom_data_enabled":false,"custom_data_fill_enabled":false,"custom_data_identify_info_from_form_enabled":false,"custom_data_save_enabled":false},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"browser_content_container_height":561,"browser_content_container_width":761,"browser_content_container_x":0,"browser_content_container_y":0,"countryid_at_install":17224,"credentials_enable_service":false,"dips_timer_last_update":"13374598654997315","domain_diversity":{"last_reporting_timestamp":"13374598654630802"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\README

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.2629097520179995
Encrypted:	false
SSDEEP:	3:RGXKRjg0QwVIWRKXECSAV6jDyhjgHGAW+LB2Z4MKLFE1SwhiFAfXQmWyKBPMwRgK:z3frsUpAQQgHGwB26MK8Sw06fXQmWtRT
MD5:	643E00B0186AA80523F8A6BED550A925
SHA1:	EC4056125D6F1A8890FFE01BFFC973C2F6ABD115
SHA-256:	A0C9ABAE18599F0A65FC654AD36251F6330794BEA66B718A09D8B297F3E38E87
SHA-512:	D91A934EAF7D9D669B8AD4452234DE6B23D15237CB4D251F2C78C8339CEE7B4F9BA6B8597E35FE8C81B3D6F64AE707C68FF492903C0EDC3E4BAF2C6B747E247D
Malicious:	false
Preview:	Microsoft Edge settings and storage represent user-selected preferences and information and MUST not be extracted, overwritten or modified except through Microsoft Edge defined APIs.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6780
Entropy (8bit):	5.580225345611818
Encrypted:	false
SSDEEP:	96:vMi0Plf/ROoBpkF5d1OiH7VaTEv9V5h5pg5vezodIU8LSpsA5IOrMn3YPo0MG6+V:1griB9l5LSpFIOAn3go0iu7
MD5:	C755CECBCFD865EB9EEFFEDD916671A6
SHA1:	A49F89D34A8B7F140417E042D20A573A0DB24375
SHA-256:	4B0DBD5DA257BEE9085A0F3D4843FD22EA7D5BD009A4C16C92747909BB1AF564
SHA-512:	E9E425BE25D2E32F9A7181F32E7D782D2DF3F65237A5861E138B08DCF37CC71B0903AB472755780F73F2DE2375AC850C77D3B27B018CEC12073FD7610AC40C1F
Malicious:	false
Preview:	{"extensions":{"settings":{"dgiklkfkllikcanfonkcabmbdfmgleag":{"active_permissions":{"api":[],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374598654528014","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374598654528014","location":5,"manifest":{"content_capabilities":{"include_globs":["https://excel.officeapps.live.com/","https://onenote.officeapps.live.com/","https://powerpoint.officeapps.live.com/","https://word-edit.officeapps.live.com/","https://excel.officeapps.live.com.mcas.ms/","https://onenote.officeapps.live.com.mcas.ms/","https://word-edit.officeapps.live.com.mcas.ms/","https://excel.partner.officewebapps.cn/","https://onenote.partner.officewebapps.cn/","https://powerpoint.partner.officewebapps.cn/","https://word-edit.partner.officewebapps.cn/","https://excel.gov.online.office365.us/","

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Site Characteristics Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	3.473726825238924
Encrypted:	false
SSDEEP:	3:41tt0diERGn:et084G
MD5:	148079685E25097536785F4536AF014B
SHA1:	C5FF5B1B69487A9DD4D244D11BBAFA91708C1A41
SHA-256:	F096BC366A931FBA656BDCD77B24AF15A5F29FC53281A727C79F82C608ECFAB8
SHA-512:	C2556034EA51ABFBC172EB62FF11F5AC45C317F84F39D4B9E3DDBD0190DA6EF7FA03FE63631B97AB806430442974A07F8E81B5F7DC52D9F2FCDC669ADCA8D91F
Malicious:	false
Preview:	.On.!................database_metadata.1

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Site Characteristics Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	395
Entropy (8bit):	5.203944826521109
Encrypted:	false
SSDEEP:	12:K5IJi9EXqWqrhHJL7Iv45IJi9EXqWqrhHh2FUv:K5ki9+FqVpL7645ki9+FqVBS2
MD5:	85988E782E23040711C47C9ADBE2D7F3
SHA1:	59D9E70D23EF7FD08D0073700B0439D6FE8EE545
SHA-256:	FD8565CF305F775CA0829E6C87B1D8F95C290A4BAE0355FB02183C1BB462710E
SHA-512:	0754121A2AB5CBF5520B2A1BE5DB97182794AF955160477354CC5D61261034C3EF80100A2533BC2DFE03C3F23BD3F69CB5C0E8664180C9837E753EE97F9A7232
Malicious:	false
Preview:	2024/10/28-10:17:34.515 f10 Creating DB C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Site Characteristics Database since it was missing..2024/10/28-10:17:34.681 f10 Reusing MANIFEST C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Site Characteristics Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Site Characteristics Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.019797536844534
Encrypted:	false
SSDEEP:	3:sLollttz6sjlGXU2tkn:qolXtWswXU2tkn
MD5:	90881C9C26F29FCA29815A08BA858544
SHA1:	06FEE974987B91D82C2839A4BB12991FA99E1BDD
SHA-256:	A2CA52E34B6138624AC2DD20349CDE28482143B837DB40A7F0FBDA023077C26A
SHA-512:	15F7F8197B4FC46C4C5C2570FB1F6DD73CB125F9EE53DFA67F5A0D944543C5347BDAB5CCE95E91DD6C948C9023E23C7F9D76CFF990E623178C92F8D49150A625
Malicious:	false
Preview:	...n'................_mts_schema_descriptor...

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Sync Data\LevelDB\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	373
Entropy (8bit):	5.302410944383979
Encrypted:	false
SSDEEP:	6:ybTBJxGq1923AkIJOd9IiDuXqjyqgx2KLlkbTBQyq2P923AkIJOd9IiDuXqjyqWh:IBJI5IJi9EXqWqgVLgBQyv45IJi9EXqy
MD5:	C5D692B99189A53D22FA6AB90EB9193C
SHA1:	BBA12975D0BFBF2521D134EF0627CC5A2EFA6490
SHA-256:	6AFF3FC95DACCE7E912418163905BFBBEB98A909442C42630D2DD3D30596DACC
SHA-512:	342910E9866C30D46B63CE783910CD549A9CC75EF2A9C38DE63BCB478D0A0E95AF37477E75D940430D023AFCAACD6C10DE1AB89B6C1E07D8DBE18D2B52C7F49F
Malicious:	false
Preview:	2024/10/28-10:17:35.026 1d90 Creating DB C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Sync Data\LevelDB since it was missing..2024/10/28-10:17:35.098 1d90 Reusing MANIFEST C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Sync Data\LevelDB/MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Visited Links

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	0.002110589502647469
Encrypted:	false
SSDEEP:	3:ImtVF3t:IiV
MD5:	EB0A70F03C0737E9E5F5BDA5E4DE961F
SHA1:	FAADAE16508EBB0C818DC2B6C954887FB78B1E0B
SHA-256:	72E16163A57423AFABDCF1AE9E0F96AA3C510F82B22E22CC4C72F80EF98500AC
SHA-512:	44F0728016B64EE15433D6386FF4EE18F6A3E40A3DCE2C17AF96339743E9BC8761641E559A0A3E3C9867AE7F3D13213D0DFF436BE03850E2BEC3E64FAC2D251B
Malicious:	false
Preview:	VLnk.....?.......Y.G....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 87, cookie 0x36, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	178176
Entropy (8bit):	0.9328712687751187
Encrypted:	false
SSDEEP:	192:R2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+c:R2qOB1nxCkvSAELyKOMq+c
MD5:	6B2D5ED0A90C99FD05D58FE8E924C886
SHA1:	34E1103E18E57E9D1769C89DFB2DAD84BFDD54B5
SHA-256:	2873E973AB5B91CD07405FD5D35E2A843A408AD53696372BEC794F4582368E49
SHA-512:	08373748A19C0381866090CB60929A4642BB624AF777240CB63B918180CEEE0C80DFAD852830FC6821AD6266DF1A865940A90D2089621F612617C5E92A4B29B2
Malicious:	false
Preview:	SQLite format 3......@ .......W...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\d1941063-6f88-439b-a677-13f57d0e2c89.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6780
Entropy (8bit):	5.580225345611818
Encrypted:	false
SSDEEP:	96:vMi0Plf/ROoBpkF5d1OiH7VaTEv9V5h5pg5vezodIU8LSpsA5IOrMn3YPo0MG6+V:1griB9l5LSpFIOAn3go0iu7
MD5:	C755CECBCFD865EB9EEFFEDD916671A6
SHA1:	A49F89D34A8B7F140417E042D20A573A0DB24375
SHA-256:	4B0DBD5DA257BEE9085A0F3D4843FD22EA7D5BD009A4C16C92747909BB1AF564
SHA-512:	E9E425BE25D2E32F9A7181F32E7D782D2DF3F65237A5861E138B08DCF37CC71B0903AB472755780F73F2DE2375AC850C77D3B27B018CEC12073FD7610AC40C1F
Malicious:	false
Preview:	{"extensions":{"settings":{"dgiklkfkllikcanfonkcabmbdfmgleag":{"active_permissions":{"api":[],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13374598654528014","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13374598654528014","location":5,"manifest":{"content_capabilities":{"include_globs":["https://excel.officeapps.live.com/","https://onenote.officeapps.live.com/","https://powerpoint.officeapps.live.com/","https://word-edit.officeapps.live.com/","https://excel.officeapps.live.com.mcas.ms/","https://onenote.officeapps.live.com.mcas.ms/","https://word-edit.officeapps.live.com.mcas.ms/","https://excel.partner.officewebapps.cn/","https://onenote.partner.officewebapps.cn/","https://powerpoint.partner.officewebapps.cn/","https://word-edit.partner.officewebapps.cn/","https://excel.gov.online.office365.us/","

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\fc8f09c3-9971-4c52-beef-f140f31879f3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	5560
Entropy (8bit):	4.784566079327545
Encrypted:	false
SSDEEP:	96:st//BXs13Trb9YG8zqd81h6Cb7/x+6MhmuecmAeXZ2MR7K:stH9sRKGkM8vbV+FiA+PhK
MD5:	DC92F638DDDCF0F15FDEA6F5DA306084
SHA1:	BCEB07885376A01E7C11CBC182F6AE807B9CC0E1
SHA-256:	26C066615C968DC1ACBEADB1D393E0A5A096B9C59CA1E624CCE3E3FBC641D19F
SHA-512:	B6508A7D342FD69BE0478BFC5F306B90707DB27DDF171735E24592F074EF225D1C4D8B21264B57E3819BA523D06666EE748FA830B30E76180243BDBF9D9A3191
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13374598654630969","alternate_error_pages":{"backup":true,"enabled":false},"autocomplete":{"retention_policy_last_version":117},"autofill":{"autostuff_enabled":false,"credit_card_enabled":false,"custom_data_enabled":false,"custom_data_fill_enabled":false,"custom_data_identify_info_from_form_enabled":false,"custom_data_save_enabled":false},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false},"browser_content_container_height":561,"browser_content_container_width":761,"browser_content_container_x":0,"browser_content_container_y":0,"countryid_at_install":17224,"credentials_enable_service":false,"dips_timer_last_update":"13374598654997315","domain_diversity":{"last_reporting_timestamp":"13374598654630802"},"dual_engine":{"consumer_mode":{"ie_user":false},"consumer_site_list_with_ie_entries":false,"consumer_sitelist_location":"","consumer_sitelist_version":"","external_consumer_shared_cookie_data":

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\shared_proto_db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\shared_proto_db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	367
Entropy (8bit):	5.307201115403136
Encrypted:	false
SSDEEP:	6:ybfR1923AkIJOd9IiDuXqjyq4rl2KLlkbB0syq2P923AkIJOd9IiDuXqjyq4rK+h:t5IJi9EXqWqqLXBv45IJi9EXqWq53FUv
MD5:	F99EC253D8EF9DF8201E9CB3EF8BD6BA
SHA1:	3ECE3A6EFF05A79FFFA5334720ACE731CAFA3B2C
SHA-256:	326B559E546EF227BAABA6DA4C0AD85C61C8259B2B183D8E01E6DC68882D693D
SHA-512:	EA80B4C5F00EA7640A9485BC6E1A2912EF04EBED47EEB5674E434103096F38515232F516C70825C43AAF49F26FC91973FAC036A2A43EF24903137F0AC42301DD
Malicious:	false
Preview:	2024/10/28-10:17:34.767 4c0 Creating DB C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\shared_proto_db since it was missing..2024/10/28-10:17:34.819 4c0 Reusing MANIFEST C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\shared_proto_db/MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\shared_proto_db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	184
Entropy (8bit):	3.71325125317076
Encrypted:	false
SSDEEP:	3:G0XttkJcsRwI9tkJcscml9t3moBNJ4XlfmoytfmEa8q///fmEbn:G0Xtqcsqc9Ct3msNJ4mv1m9p//3m8
MD5:	AF826572446A866B993052AEC9760422
SHA1:	2BA6EF209765B9CEB75F4C7698F20A0992119565
SHA-256:	FE6EC58485FFA98BA4F69C7B67348F8F8128DD58AD3DAE577F993C32EEFA48ED
SHA-512:	538D97BEAEECAB5E24E628B2ED42C799DD82E12624C1077D1AE70FC2B5ED81EC1BC261C39B509C96AFF98DF0E837CA68A27A1032299B386C8590F046EE4391FE
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\shared_proto_db\metadata\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	385
Entropy (8bit):	5.27395006094897
Encrypted:	false
SSDEEP:	12:yU/5IJi9EXqWq59LGTv45IJi9EXqWquFUv:H/5ki9+Fq59L045ki9+Fq62
MD5:	56269630B06ECD76CDBCEB6E1043B4F5
SHA1:	932D6BFF866EFCA455E26CE0922D0E833AFDAE18
SHA-256:	87E6F38C487AFC3D6588589541D4C63C160B1680EB2685611BC0E144EB8BCB69
SHA-512:	8B359C004E57F310FC7226C6E9117B799F2F1396CA4E801A08F0BA6BC6F450E2A2DD78FB3DAD469FF30FD6ED66AF012FF80E362C1782ADF24399B9AEF97E55D4
Malicious:	false
Preview:	2024/10/28-10:17:34.691 4c0 Creating DB C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\shared_proto_db\metadata since it was missing..2024/10/28-10:17:34.764 4c0 Reusing MANIFEST C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\shared_proto_db\metadata/MANIFEST-000001.

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\GrShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\GrShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\GrShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\GrShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\GrShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNl6V/:Ls3q/
MD5:	8CD9D50EA9DCD046F73D71E908987126
SHA1:	95ADB47D6E64AC20D5BE6B5DB3A1CD1323E87158
SHA-256:	7790A3FDE96989C8E39E4A46296113F187F206FBC4156DF4CA4BBA8A67DF79FA
SHA-512:	B4889370B349FF630A7AA05F100D12A1059D20DABF9F8314950536B4A9BEF0295CD6748C4999FB329BF5E9DF0D3B33AD991E07AC48D8EBF31DB0B44F8346F76E
Malicious:	false
Preview:	........................................O..i ./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\GraphiteDawnCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\GraphiteDawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\GraphiteDawnCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\GraphiteDawnCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\GraphiteDawnCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNlcl/:Ls3U/
MD5:	CF95F367B98B6745AA448D12B6282478
SHA1:	FB1EEE09B2532E27339AF73AD6AFD710AC9C8319
SHA-256:	E4AA75FB3F3EE468D47BDE0F02CDB80209D4B561035DDFBAB111C19B3216E31B
SHA-512:	7C2F64BEBF0E36A0E2D35C88C599A7BFDBDE08FAD7A0188EA29B0EE4735FF263EE44EBF27F6AC7835136FB7F937CF80C2534295A42E6E2FB09E37A14E6A69D33
Malicious:	false
Preview:	...........................................i ./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	951
Entropy (8bit):	5.733488904893808
Encrypted:	false
SSDEEP:	24:YKWJu5rrtueQVoEIF5oifiVFBIaeCaWOkPybvXzQQRCYfYg:YqfMeQFIF5oifSBIZvkPUvsB0
MD5:	892CCD8595A8BD46AEC4117C3F35BE28
SHA1:	78FFA6639E437E4EB98680EC544ABA5517B9E601
SHA-256:	0829349B10B000EB9BB884ECD36D529E9B0E8A5CC2AE32B388F1FC5721746F57
SHA-512:	288CBB9AF2A8703848D1A1D29C8708B0F778C6147FAF580AF7A604A35BD68B04D2BAE2F689FFB634A5F2F674A181F91A562A825ACC1D54B77CD7F67EDF9F07CE
Malicious:	false
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACs2ipmYAX7Q5eLDfKhmCSzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAGJqjE6k+gmz4o0SRufQ6JT0qwvjNTL7fHy1ZdzJjx4QAAAAAOgAAAAAIAACAAAABlihj6X+k1o+AlgQy2GAAwDu0zpRj/08eeT7CIPXx2cTAAAAA1A7nMzPQN2Oj3vDVrgkHCVAx7Vf7jdTDZ0TaP0Lkfi+XMxItzVyiFMrqAtWFlZfpAAAAA/mo43xL2ClCF835ZvmHabFModP8yuKV/jLK5BTTirkuA7ntxEEXxfhg9BSi2O7B2m9VSfjNPkoHqbE9RMFc7Ug=="},"uninstall_metrics":{"installation_date2":"1730125054"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":2058,"pseudo_low_entropy_source":7162,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13374598654179063","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Local State~RF491876.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	951
Entropy (8bit):	5.733488904893808
Encrypted:	false
SSDEEP:	24:YKWJu5rrtueQVoEIF5oifiVFBIaeCaWOkPybvXzQQRCYfYg:YqfMeQFIF5oifSBIZvkPUvsB0
MD5:	892CCD8595A8BD46AEC4117C3F35BE28
SHA1:	78FFA6639E437E4EB98680EC544ABA5517B9E601
SHA-256:	0829349B10B000EB9BB884ECD36D529E9B0E8A5CC2AE32B388F1FC5721746F57
SHA-512:	288CBB9AF2A8703848D1A1D29C8708B0F778C6147FAF580AF7A604A35BD68B04D2BAE2F689FFB634A5F2F674A181F91A562A825ACC1D54B77CD7F67EDF9F07CE
Malicious:	false
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACs2ipmYAX7Q5eLDfKhmCSzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAGJqjE6k+gmz4o0SRufQ6JT0qwvjNTL7fHy1ZdzJjx4QAAAAAOgAAAAAIAACAAAABlihj6X+k1o+AlgQy2GAAwDu0zpRj/08eeT7CIPXx2cTAAAAA1A7nMzPQN2Oj3vDVrgkHCVAx7Vf7jdTDZ0TaP0Lkfi+XMxItzVyiFMrqAtWFlZfpAAAAA/mo43xL2ClCF835ZvmHabFModP8yuKV/jLK5BTTirkuA7ntxEEXxfhg9BSi2O7B2m9VSfjNPkoHqbE9RMFc7Ug=="},"uninstall_metrics":{"installation_date2":"1730125054"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":2058,"pseudo_low_entropy_source":7162,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13374598654179063","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Local State~RF491895.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	951
Entropy (8bit):	5.733488904893808
Encrypted:	false
SSDEEP:	24:YKWJu5rrtueQVoEIF5oifiVFBIaeCaWOkPybvXzQQRCYfYg:YqfMeQFIF5oifSBIZvkPUvsB0
MD5:	892CCD8595A8BD46AEC4117C3F35BE28
SHA1:	78FFA6639E437E4EB98680EC544ABA5517B9E601
SHA-256:	0829349B10B000EB9BB884ECD36D529E9B0E8A5CC2AE32B388F1FC5721746F57
SHA-512:	288CBB9AF2A8703848D1A1D29C8708B0F778C6147FAF580AF7A604A35BD68B04D2BAE2F689FFB634A5F2F674A181F91A562A825ACC1D54B77CD7F67EDF9F07CE
Malicious:	false
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACs2ipmYAX7Q5eLDfKhmCSzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAGJqjE6k+gmz4o0SRufQ6JT0qwvjNTL7fHy1ZdzJjx4QAAAAAOgAAAAAIAACAAAABlihj6X+k1o+AlgQy2GAAwDu0zpRj/08eeT7CIPXx2cTAAAAA1A7nMzPQN2Oj3vDVrgkHCVAx7Vf7jdTDZ0TaP0Lkfi+XMxItzVyiFMrqAtWFlZfpAAAAA/mo43xL2ClCF835ZvmHabFModP8yuKV/jLK5BTTirkuA7ntxEEXxfhg9BSi2O7B2m9VSfjNPkoHqbE9RMFc7Ug=="},"uninstall_metrics":{"installation_date2":"1730125054"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":2058,"pseudo_low_entropy_source":7162,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13374598654179063","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Local State~RF493fa5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	951
Entropy (8bit):	5.733488904893808
Encrypted:	false
SSDEEP:	24:YKWJu5rrtueQVoEIF5oifiVFBIaeCaWOkPybvXzQQRCYfYg:YqfMeQFIF5oifSBIZvkPUvsB0
MD5:	892CCD8595A8BD46AEC4117C3F35BE28
SHA1:	78FFA6639E437E4EB98680EC544ABA5517B9E601
SHA-256:	0829349B10B000EB9BB884ECD36D529E9B0E8A5CC2AE32B388F1FC5721746F57
SHA-512:	288CBB9AF2A8703848D1A1D29C8708B0F778C6147FAF580AF7A604A35BD68B04D2BAE2F689FFB634A5F2F674A181F91A562A825ACC1D54B77CD7F67EDF9F07CE
Malicious:	false
Preview:	{"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACs2ipmYAX7Q5eLDfKhmCSzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAGJqjE6k+gmz4o0SRufQ6JT0qwvjNTL7fHy1ZdzJjx4QAAAAAOgAAAAAIAACAAAABlihj6X+k1o+AlgQy2GAAwDu0zpRj/08eeT7CIPXx2cTAAAAA1A7nMzPQN2Oj3vDVrgkHCVAx7Vf7jdTDZ0TaP0Lkfi+XMxItzVyiFMrqAtWFlZfpAAAAA/mo43xL2ClCF835ZvmHabFModP8yuKV/jLK5BTTirkuA7ntxEEXxfhg9BSi2O7B2m9VSfjNPkoHqbE9RMFc7Ug=="},"uninstall_metrics":{"installation_date2":"1730125054"},"user_experience_metrics":{"client_id2":"{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}C:\\Users\\user0s:92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","diagnostics":{"last_data_collection_level_on_launch":1},"low_entropy_source3":2058,"pseudo_low_entropy_source":7162,"reset_client_id_deterministic":true,"stability":{"browser_last_live_timestamp":"13374598654179063","stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}}}

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	9.553120663130604E-4
Encrypted:	false
SSDEEP:	3:LsNly6:Ls3y6
MD5:	6C8BAE8E844C81EF55AA8489EAD9D416
SHA1:	B4A7C596A0CF400188D89439449C9C199261E525
SHA-256:	63A61B5A6ABE834461E4043A005B17FC14A7DEFAC5A66425CFE7879C0C899C6B
SHA-512:	37F4B3DC143B557A0E4D1D49E669F982CBB6712DE6EED0044D2B121DF003949F534715C68D84D39072F7A3650AD432D76AF19B3D63C69FC6532CAE391EF7C201
Malicious:	false
Preview:	...........................................i ./.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQan:YQ3Kq9X0dMgAEwjM
MD5:	961E3604F228B0D10541EBF921500C86
SHA1:	6E00570D9F78D9CFEBE67D4DA5EFE546543949A7
SHA-256:	F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
SHA-512:	535F930AFD2EF50282715C7E48859CC2D7B354FF4E6C156B94D5A2815F589B33189FFEDFCAF4456525283E993087F9F560D84CFCF497D189AB8101510A09C472
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":0}

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\d08dbfb9-0357-4081-8a94-60f729b73bac.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2054
Entropy (8bit):	5.478704532012267
Encrypted:	false
SSDEEP:	48:YDEFMsFiHC0afMeQFIF5oif9t5n9HB+mdrxmBIZvyRPUTsBG/d2a:PNkC1f3QFY5lf9DlBLQ6ZaPUTsI4a
MD5:	369D3C1818810A30B1CC4105FF8C5ECC
SHA1:	C535AEF30CADAB25D84D043976828A341284C714
SHA-256:	EC98C566478B03543895F6B8E2DBA283FCE2FE4AA9BF5ACC6A9B7CD192E8CDB3
SHA-512:	4DBE5CC5361C5EE57AEEC2A9C5AF45BA8FDA11589FACE61ACBD3FBC0C48F60E8EF364BCA00FDC51A4E0D8D0821AD12A36794524E7509E40B846C5ED365B41867
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACs2ipmYAX7Q5eLDfKhmCSzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAGJqjE6k+gmz4o0SRufQ6JT0qwvjNTL7fHy1ZdzJjx4QAAAAAOgAAAAAIAACAAAABlihj6X+k1o+AlgQy2GAAwDu0zpRj/08eeT7CIPXx2cTAAAAA1A7nMzPQN2Oj3vDVrgkHCVAx7Vf7jdTDZ0TaP0Lkfi+XMxItzVyiFMrqAtWFlZfpAAAAA/mo43xL2ClCF835ZvmHabFModP8yuKV/jLK5BTTirkuA7ntxEEXxfhg9BSi2O7B2m9VSfjNPkoHqbE9RMFc7Ug=="},"policy":{"last_statistics_update":"13374598654399654"},"profile":{"info_cache":{},"profile_counts_reported":"13374598654453711","profiles_order":[]},

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\fd017f07-a120-4a38-a571-0c78ac643f5b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3423
Entropy (8bit):	5.287724246642185
Encrypted:	false
SSDEEP:	96:PNkGSC8Af3QFY5lf958rh/cIyURoDotoxPsQB2i6ZaPUTsX4u:PNBSvFmWVoDULU2Yk+
MD5:	8C11F831779E51B493944E38DF03C31C
SHA1:	DBED13D46784C179C22DA3442A0D3E9B0C31BE2F
SHA-256:	5F19DE5862E77D50C2CA61DDCF7B48818B7F2502B19FFA39685E422A5F717A29
SHA-512:	5BD4CDC1479971407F1B8717B830331D34C2222615772D68B6A7B7D8CEA6C1FFEE55FBD537AA0E86DE747FA8AE37BC663BF30DC51F1F6F72559AB7161DA3146B
Malicious:	false
Preview:	{"dual_engine":{"ie_to_edge":{"redirection_mode":0}},"edge":{"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fre":{"oem_bookmarks_set":true},"hardware_acceleration_mode_previous":true,"is_dsp_recommended":true,"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.73012505657689e+12,"network":1.730125057e+12,"ticks":4792603992.0,"uncertainty":2965741.0}},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACs2ipmYAX7Q5eLDfKhmCSzEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAAAGJqjE6k+gmz4o0SRufQ6JT0qwvjNTL7fHy1ZdzJjx4QAAAAAOgAAAAAIAACAAAABlihj6X+k1o+AlgQy2GAAwDu0zpRj/08eeT7CIPXx2cTAAAAA1A7nMzPQN2Oj3vDVrgkHCVAx7Vf7jdTDZ0TaP0Lkfi+XMxItzVyiFMrqAtWFlZfpAAAAA/mo43xL2ClCF835ZvmHabFModP8yuKV/jLK5BTTi

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\PanGPA.log

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11295
Entropy (8bit):	5.414441399751646
Encrypted:	false
SSDEEP:	192:0cmdEnfr37GAwkZoCWqwqwt1vr4fQK+TuEYFfH/4fwAMbh3latyz04IH64JpPRNB:0cmdEnfr37GAwkZoCWqwq61vr4fQbTuS
MD5:	CAFB384CE7BE514D05A12AE601D70FA2
SHA1:	1E65438044A237C4B382F6443084F0D3EC6F6F37
SHA-256:	D042162D9B1E844A392CC56F9D4C5B051C0F3343F1CE5EFBC8DA9E957390AF76
SHA-512:	6D959FEDCFAFCA6CC83ACD7952F27C3A07DFE974692CA3953F55716F505A06FF33DEC37572432521DF15ECFB3315F15D931C28CF3AF35EA0EF1E61ACC270FDE4
Malicious:	false
Preview:	(P5408-T2828)Info ( 368): 10/28/24 10:17:31:789 UI language id is 00000809..(P5408-T2828)Info ( 370): 10/28/24 10:17:31:789 locale name is en-CH..(P5408-T2828)Info ( 387): 10/28/24 10:17:31:789 resource dll name is PanGPA_ENGLISH.dll..(P5408-T2828)Info ( 389): 10/28/24 10:17:31:789 full resource dll path is C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_ENGLISH.dll..(P5408-T2828)Info ( 397): 10/28/24 10:17:31:789 load resource dll failed!..(P5408-T2828)Info ( 430): 10/28/24 10:17:31:789 InitInstance - GlobalProtect_InstanceChecker mutex created to detect previous instance. ..(P5408-T2828)Info ( 461): 10/28/24 10:17:31:789 InitInstance - Not detected any previous running instance. start PanGPA ..(P5408-T2828)Info ( 686): 10/28/24 10:17:31:836 ####################### Start PanGPA #######################..(P5408-T2828)Debug( 696): 10/28/24 10:17:31:836 ##################### AfxOleInit called and disabled the dialog box!!!gpb...(P5408-T2828)Info ( 704): 10/28/24 10:17:31:836 The

C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\pan_gpa_event.log

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	619
Entropy (8bit):	4.759797558510154
Encrypted:	false
SSDEEP:	12:MebFV+mQl96o00qW6n1klrr8Y00qW6n1klrr8Y00qW6n1klrr8y:MeL460tika0tika0tikN
MD5:	F0DF7F885E5743BFB2FF634658AF8380
SHA1:	3B1BDC5AEC2B339487150A4AD521E1271D3EAFF8
SHA-256:	BB40B47B3BB907C80052A56D2427FD4B1B2456B3757E0C6BF562A2FF3324FD00
SHA-512:	D2F510BAA2D2B0005CDBFCA2CD545F196E8E23A2E9DB4706E35AF8F3531715176764CB1E4B026A843564E1F718C0C28149F29418FEC183955BFA1BFF52E47A83
Malicious:	false
Preview:	10/28/2024 10:17:31:899 [Info ]: PanGPA Started..10/28/2024 10:17:33:180 [Info ]: Showing the main panel..10/28/2024 10:17:33:180 [Info ]: Hide the main panel when popup dialog is on and user click outside the main panel...10/28/2024 10:17:33:211 [Info ]: Hide the main panel..10/28/2024 10:17:33:211 [Info ]: Hide the main panel when popup dialog is on and user click outside the main panel...10/28/2024 10:17:33:211 [Info ]: Hide the main panel..10/28/2024 10:17:33:211 [Info ]: Hide the main panel when popup dialog is on and user click outside the main panel...10/28/2024 10:17:33:211 [Info ]: Hide the main panel..

C:\Windows\INF\3ware.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1b58 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9948
Entropy (8bit):	3.627011127610481
Encrypted:	false
SSDEEP:	96:BY+D9DwxZOR63U3tQW0FwkY688zxXJTCmc3r1AQy6sR/hFXKtyoTDIYNCuOQxQ5u:BIEhdQxibz89ZTcWSsXFEmaQ5F58eFy
MD5:	10E8D5FC036FBD505CE8140631C899E6
SHA1:	761545FB6C61918CBF311AEE2835F7BCFF7906D6
SHA-256:	158027CDABF2737A9BEE7CC433BE69B4A45580323500F95C5C2B3095CF376336
SHA-512:	54CA281B86A1D2B5031218F6683277522F060854EC5F02B0E6EED26C8A79705ACDC246E04844D40A7D52611C1725091DF779F376794DEFB585C9AD32CA012F06
Malicious:	false
Preview:	....................X....b.........................P...T............ ..(....#..h................&......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................D...........................................................................P.......................................<...........................<.......x...........<.......8...................................................................................................................................................T...................................4...........................................................................................................x...................................................................0...................................................................................................................................................T...@...P.......................................,...................t...........,...........................................

C:\Windows\INF\61883.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x18f8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9052
Entropy (8bit):	3.549933421863094
Encrypted:	false
SSDEEP:	96:AsAIvXnOw+yNOSWGql3gUxMG6Oda/En1YkcRTLz5C7Vpim2Cbw07seReSGa2V5nT:9ZOT3q5ewN5aIy7cxS3O
MD5:	847765E33765BEE645BD25AD8673266F
SHA1:	59742670ADF30BCC6CB07EADABABE9DEE57AB69B
SHA-256:	41A9016299EB3590ADBEF19B383F326AA7C1871B1698F069E91486C773A5ED16
SHA-512:	0ABC4D4EFB32F0B8E23781D43F9D8CE950AA689B60499AB33920C6E7FD16D751B44299D01DCF7744C3CC77EB3F48B5DF9BE38D405F80399F2530B44190A52E31
Malicious:	false
Preview:	..............................HR..........h...........\|...p...d............ ..h...............X#......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................................................................................................................@...............D...............................<.......t............................................................................................................................................................................... .......................................................................................................................................,...............................................................................................................................................................................................................p............... ...........................................D...........................x...$...........L...........................

C:\Windows\INF\BthLCPen.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x11e0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6020
Entropy (8bit):	3.2521548873280417
Encrypted:	false
SSDEEP:	96:oFmVi9sVF+KXp2JW6T5R/ZiQ0AM+cAwUe5Jx5+54Zjp:oinXpOb1dZb0A1cPHD2e
MD5:	155BACAFF609DDEBC381E0B22D0B8E7F
SHA1:	8A98E5EEE76BA58893070956AA3FCA65715E9CE5
SHA-256:	5974191AF180B5DFEF79F9B6D7ED18DAAEBBEB85C03B4D28DCEAFC2314776D09
SHA-512:	63198FC6AE04BED94B372F06375DFB50AC903D62B43B9AFAD883C87C2905CA23786B973BD46A79ECBF8F0CFBF41A8F5BE47A863E507F86D2FDDF37DE7A1AB41E
Malicious:	false
Preview:	........................Lk~.....4..........P................... .......<...@...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................t...........................................`...........................h.......................................................................................................................................................................................................................................................................................................p.......................................................................................................................................................................................................................................................................................................................................t...................................................................................................................................

C:\Windows\INF\BthOob.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x10b8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5508
Entropy (8bit):	3.2131416782234257
Encrypted:	false
SSDEEP:	96:nzWMNk9B41kNqsR+KdDwDiVPGKaoiE14nCU:KB41cqsZEaQq4CU
MD5:	3436BD243AC26DEC62587B05D0E4B7F7
SHA1:	7263FCC2D2EBE18C052E2A601F2380FC84FC9B5B
SHA-256:	DA30462B777671F7DADD21D42A4D92C6E5E22EDCAF9C2E4F9B110AF6A2C9DDA9
SHA-512:	CC43C034EDB6F713E10406FCAF4658D1580246B31887059AFCF2C54A0ADCAF20CAB365A97A020CB54ADA7CCD8F2B0E6DDC456E83126BB68CA7F84CF2C7FD30AB
Malicious:	false
Preview:	........................Lk~.....4..........(...................................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................................................................T...................................................................h...........................\|.......................................................................................................................................................................$...........................................................<.......................................................................................................................................................................................................................................................................................................H...`...........................................................t.......................................................................

C:\Windows\INF\HidTelephonyDriver.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1980 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	8388
Entropy (8bit):	3.5414073165449027
Encrypted:	false
SSDEEP:	96:+vxe0Z7UQzMT6aso1vDWx/kNE1iRV//Y7ywKgH78ba1DfwCA0mr/x4KfSivnBUet:+L7q6FlkNE07Y+JIcpaivWejR
MD5:	ACFE08733795C22AF938F98DCD558AC6
SHA1:	BDDC6B7B6CDF90F39F24234DF93D6FEED47B2934
SHA-256:	F7F0866A39F6F96633BB10AD872A25897AFEF12FF6161957D7A04B063D9441AC
SHA-512:	4DFE14FE7E0A82EBE7EDB3F201699EBB0FAD75577B94F373626ECD0AF841DFC35E76CEA5C9F8E8B05F7F159D05152C1B76DFA5C79414202A2A4C0977E4FB4A57
Malicious:	false
Preview:	........................8.../.......................................P...........h................ ......C.:.\.W.i.n.d.o.w.s.............................................................................................................................L...........................................................................................................................................................................................................................................................D.......$...............................................................T...........................................................................................p................................... ...................................$................... .......................................................................................................0...........................................0.......................................x.......................................................

C:\Windows\INF\ItSas35i.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5150 "signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	32996
Entropy (8bit):	4.075655488134738
Encrypted:	false
SSDEEP:	384:9vzUQ6m9KZu7RnDmMGcj8p24/Yilciycph5Dqk1kra7LlOL/gQng+r1VYuRpFVL/:Na4FRnDmMGcsrciyMaLr1VYuRlAAj
MD5:	042A940CAE6F074CC539EA0C47D7CAD1
SHA1:	9DCA2E9652AF0A8BBF1527B54A051E91A5922B87
SHA-256:	6CB221C06B8A67905AE9CF6B5699D2376FBC0E5D02230F9E71BBAF739BB24FFE
SHA-512:	19E9D42B42DA6E395A6EDB2F7ED97449459DB74208ECCBC51899F0D3CB5DDFBDACAE4594CF82B4FC10120E6856B9EF8553930DBA4215C82B82D14047D24B0CC2
Malicious:	false
Preview:	....................PQ......................P.....hR..H....U......Pb..D....q..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......PE......t<..............................`O...........1..............$....F......H................4......................\|=..X...4E...........>...P.......................D.......6..T...........@5..L...............PN..t....P...........N...............L.......................@.......F...................................!..........,..\>...........H...................7...9..0 ...$...6...:.......8... ...........4...........!...E......."..........................<=..........................h"...........................!.......H..dI............... ..83.......................;...........>...4..........(...........(....D..........<>..........................\|....M..............\=...........................O...............................J...J..........4(.......................&..,....&...-..T,...)......P+...)......t........2..............................

C:\Windows\INF\PerceptionSimulationHeadset.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1b68 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9124
Entropy (8bit):	3.573025546752117
Encrypted:	false
SSDEEP:	96:NulMOVko89iFS3Veh2Fg+R86b1RgQiGMb4pQOw0enelbS4Qb7Oba7VQ3Bq4dJRnc:2FSCm5D8GMohC4jy
MD5:	51243BD426A7A7999F58D1F68F53701C
SHA1:	E66F0FDE43C3D17A085E36B9544BFBA1193AAD45
SHA-256:	587ECE0A00DE23C5811EF73F1E2BBB0AB7588E9BBA6B11450DB9C0B4BD06A655
SHA-512:	6A8D6E1FCBC047E08C46344D48B9E1A097B1FAE44AA3E85A88FDCFB485B5E0BF60E239699693FA809823C0B08306E7B62479F819CCCE43E55A7CCF4BED602DA5
Malicious:	false
Preview:	................\...h.....F............................,....................!..h................#......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................4.......................................................................\|...................................................................................................................................................................................................................P...................................................L...................................T...................................................................................................................................................................................................H...............................l.......................................................................................................<...........................................8.......................................`.......................................

C:\Windows\INF\PerceptionSimulationSixDof.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1fa8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	10820
Entropy (8bit):	3.641317137864762
Encrypted:	false
SSDEEP:	96:gJPSDBok/BkMSScbz/32XPScs4eFRr6C1VbmGSECJkK1rGHq9ZcG0bp3QbW7U7VW:gI6MmMUfUEkQUkK1ruq9AJgpdPCT
MD5:	79A5DB440F0B9D9008850FA5DC9DDF01
SHA1:	32EAE6BAAB64831CDE7898D131607D38435084A9
SHA-256:	201746D60D8F456F2EE7C85DF97BE8ED283603A3FEE2791B0D5E5EC19D7621B3
SHA-512:	9C312E8F553085F51084EFB40F1E7FA3F5B387AF088DBF9311D40DD837E4FE5083D94A94D09546B9F020BED9ADA469C85200B627AE933F5CCDE2A11F08FF3E4A
Malicious:	false
Preview:	................l.......n.#s.........................!......."..X....%.......'..h...............@*......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......$...........................d.......................................................<.......d.......................................................................................................P...........,...................................................................................................................................................................................@...................................(...................................................................................................................................................................\|...................<...........................................d.......................................................................................x.......................................................................t...(.......................................

C:\Windows\INF\PerceptionSimulationSixDofModels.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1968 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9452
Entropy (8bit):	3.5384987861831956
Encrypted:	false
SSDEEP:	192:/uWnEQP8x2iQ6eEkyFwHYkees/CKkMMcEPcDBy:/uWnEQEo+PwHYHesKKkMMcEPcA
MD5:	331688BB61A0C865943BB5A077311D6F
SHA1:	A4DA9C67CC2A9B3898AA06F2BA677936EEE08F07
SHA-256:	D26BCD495FD6096EEB083AC8CBFFC97E30D80C49F08B1BDFE8236160689FBB16
SHA-512:	BEA16E0907F56BA957F7B0B1DD43DC80EB63B8B02B662A39B82BCDF029927466BD0953D7B7800F8B1A8947F85CB4B096FE7F14A46F7C22B1396E93D4601BD8FA
Malicious:	false
Preview:	....................h.....co........................0...........L...8...X....!..h................$......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......x...........................................................................................................`.......................................................................d...............................0...............................................................................................................................................................p.......................................................................................................D...........................(... ...........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\SDFLauncher.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x15a0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	7260
Entropy (8bit):	3.410665641446272
Encrypted:	false
SSDEEP:	96:LMbSWUqHghsfG1A1AQJe6bold9SK030kyR7NSYxtTdxfReoU:+XfG1H0bold7ndE
MD5:	29C506C089EBA3D196F897196D976563
SHA1:	E5245B7049754555AF67F5561FDF58E6E8A906ED
SHA-256:	0ED73A4DABAB10CF905C66E90A25E0007E6C4C568E6A9AFB666FC559ADFDE969
SHA-512:	A2815A3BBA6D68BB65F3AFCF53D5DEEA3692C5F74CB74B2ABA84C23013FBB2F8208BF4BE1D7EEA6F7A1C24E1AB733375615B667CB3AB621F5FB5D0D5C8C5C6D0
Malicious:	false
Preview:	.........................+....yl..............................t...H...........h...............X.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................................................................................................................................................................................................L...............................................................................................................................................................X.......D.......................................................................................L.......................................................0.......................................................................................D.......t...............................................................................................................,.......................................................................................t... ...........H...........................

C:\Windows\INF\SensorsHidClassDriver.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4b48 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	23916
Entropy (8bit):	3.7821213245878234
Encrypted:	false
SSDEEP:	192:lc3iO8SH28fdamYkOznZ+QAnarCdfqIO8LUy6vNJWtT7wSR8adOjuiMEwCyPqcY0:lc3iOvH2rF6+KNc3dGINum/+A5Dtpu
MD5:	9D256B65925921E9A7CC0490CEBBD0FC
SHA1:	EB6E90A99FFFF8817FBA9DA47ADAA00775183387
SHA-256:	F0D34B1407B4C67F2C31102AF886147296C3D24A0AC33E7FB702EE5049B2A64A
SHA-512:	759629B05DA8D6059121ADD824D889DF75C9AFE41BEF83424BFEF8CD95C022D38A5AC372B25D0D238685B23C68E8FE7284164E42FD67CDB73B9F0D23FF50E96D
Malicious:	false
Preview:	....................HK..Lk~....-............J......`L..h....M.......R..\....X..h...............h]......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......@H......4...........<D.......!..........48..................................................x0......$ ......................\|#...=...(...)..L-...,...................3......./...4...A...........-...!.......E.......................................................................................6...........'......\!...........$..t:.......;...........6..p2...).......7...9...H.......B...+...........H.......................A...>.......<..................................................................................."......................................."...............................=.......................................D...... ...............l?..........@>.......................,..t...........4/..`D.......;..p<...!...............E..............................L....?..........................\|+......8G...G.......?..............................

C:\Windows\INF\SmartSAMD.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2400 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	12964
Entropy (8bit):	3.7651444814632837
Encrypted:	false
SSDEEP:	192:L9BWg+81rGkQzJ7KicGj6m2RFguopE3nK+jE+ZZT4ZnvE8Jpc3QU5l0gcHBhCGPc:LMRk4Ki/uFRF/pUb/6l0ThhpwPUiGi
MD5:	F0B8BC76465458EE6F5B540FE48AA3B3
SHA1:	0A06B49F5646B0A94D1B1EA81FE9333467770F1B
SHA-256:	A7128E95039237BDACEFEBCBC8CCA4A0440FB69D912796A7F4183EF82FDB2AE8
SHA-512:	BAEB0379901D9C4163A2D4711CA77978D5C365FEF90D2AC85549BB3855310708BA9AF986C83B515A943E8D37FF26714018E361FC101AD1782819462625C8717C
Malicious:	false
Preview:	.....................$.........R..........p#...... %.......&..l...`*..........h................2......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................D#......................................L.......<!..................................@...............................................(...............................H.......................................4...h...............T...................................."..............................................................................................D........ ..................h...H...........\...........t...............................`"..............................................................................................................................t...........x!..............8....................................................!..............................4...................`...............................................................L ......x ..........T.......................................................

C:\Windows\INF\UsbccidDriver.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2d80 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	16908
Entropy (8bit):	3.831611239531834
Encrypted:	false
SSDEEP:	192:6skbF7UB/AJisEjkQsf1q5k9EDmWxTcMsHsJUoCek:6skbF7U1OisE4BqiW1SsJUfek
MD5:	998A07E5C65EBCD18FB204539C29F826
SHA1:	6F916068035A8768E17ABE2DC5F48FC46BF0BD94
SHA-256:	E5378F3411986AECF8F55D50CCF8DC3BD16D369409C8A43A80F1E24602B96853
SHA-512:	11B9400C46382032B680861D289DC60606982CC4FE278892EBFBF3B0E51E976BD5A44371B3ABD963EBDD6C5DCCB24577949CB5E28B93B7E6D7B57A6C01A4AAD6
Malicious:	false
Preview:	................(....-..Z.{.................,..&............1..h....6.......<..h................B......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................@'............................... ......................."......................,...t&..d...................l...............................................T...<...............`.......,+.. $..................4...............<................................................................#..........................\|...............................t...h,..@.......................d.......................................................<(...........#...................................(.......... .......$..............................4...............................................................4#..................................................X...................$)..................<...H.......D..................................X................ ..........x)...............).......%......l...................................

C:\Windows\INF\acxhdaudiop.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x94d0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	65692
Entropy (8bit):	4.010765222604476
Encrypted:	false
SSDEEP:	384:9qm8W31qiP2nEZYZrZjZMlRjvuiP2BQj3jMBoRUBT6f3GfkSDkPz0FSeFXr:9qm8W31qiP2nUlRjvuiP2BQj3ABotG7r
MD5:	12F7FE12DEBA235AF61C9C87EE056C4C
SHA1:	42922490DCAF5AB0B6A75CFDFA7DF03789649BC0
SHA-256:	810027B1C0B6B3672C7F9DF6CCD4F5A1ECEBDA503D3454695CF78838AB4D31AF
SHA-512:	80CD98C1A2E79793619FC093EE11729AA033D848069C1043DC08B64DA87D739A6F8FDBD957CC42F8DF9AAB9432B8A9F9732E0710D86B9F1C73876F870480E9FC
Malicious:	false
Preview:	.......................l../...............L..........D...0............&......h.......................C.:.\.W.i.n.d.o.w.s......E...w...w..La..Lx..Th.......c..p............V..................(........e.......................&..<a...................Z..\|O..`i...................l..P...................tL......`*.......Y......0...0I...I...U.......a.................0...............................(.......(...................H'...(...e...)..,Y...........P...P..LQ...Q...t.......................p.......M...M..DN...N...4..p5..T6......................\|R...g...................A...B...B...C..........8/...0...1...1.........d .. !...!..............P`...........J...U...K..0...Tu...u...u...c..X....p...q..L#...$...$...%...................d.......[.......R...S...T...T...............\.......................X...g..L.......DC...........f.......................b..lV..........\|j..t...........T...........h...............Hm..P7..dy...y.......s.......e...l..................q......p... ...................L...

C:\Windows\INF\adp80xx.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5138 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	27524
Entropy (8bit):	3.922934299169667
Encrypted:	false
SSDEEP:	192:2pcxX0vlvzrFsJfzVb18U3nbl7C/y1Gky54JqyQQlzu55F4mRq5MffyID3lkPUJb:2qxXkl8lqS4amxm456lIlxyoM5dkSAZt
MD5:	58EA231A0DA660D73F4EB42A73F8AB9B
SHA1:	4AF5DDE49F1B421EA09771FD8A4777C07A49BC6E
SHA-256:	97418477EF87981C210760A1AC4F402FBACDFF45E06B06B0571D97D9F838DB6C
SHA-512:	0C46329DA0C44404AA9DCF14C315B99DDC854EC4B6ABA6473F5F7EF816F013EBC9987C40A4C3F33B12F6DD47F0940784D74AA67C9E7F4B34E64B2CB555C092D8
Malicious:	false
Preview:	....................8Q...b..................P......@R..\|....S.. ....Z..L...0c..h................k......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........L.......)...........I...'.......5...;...N......$4.......+...F..........PI..8?......................d#...........................%..............(O...............$......X&.......O...!........... ... ..............,M...#..LO...P......PM......X.......hB..............................$I...D..............................................................................4#...M...%......................\|%...........................H..............4!..............................................t"...........................&.............................................. "...........G...........L.......................H...............(..............T'..$1..L5...........E...................=...........L......@N...............................J...I...............................&......XL..................l ...........%...$...........$.......3...:..............

C:\Windows\INF\amdsata.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2500 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	14524
Entropy (8bit):	3.78564687123715
Encrypted:	false
SSDEEP:	192:LGCCLfWAqmV8JYqdM6k63iS38yal58vPmlJRD1JbneXcJgn30USn:fCLVa1dMmsD8nSDfbesJeE
MD5:	5356BB0C973BBC4E14FE3F87EB1A12EB
SHA1:	9BD6B081127D3513C274BE2D0929DF44A5B6C519
SHA-256:	3B34E121D38C4D054F55252C844ECDF7C47739C7E0862FDF2E7A9991C25DD418
SHA-512:	A672B4A6B8F20F668841385A7BC06A41655D9F9DFC2B87BA77A1E1403EC33913DB0E911374F8E36B0519F6095D522C2C7531D414ECDEA2974F4605A483EB283D
Malicious:	false
Preview:	.....................%...b.................p$.......%.......'......x,.......2..h................8......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................@...."..........................................................\|...............p.......................p ..h.......,...........d......................................................................................., .......................................................................................!...... .......P...................................................H...................................4...............................................,.......................................................8...,...............................................................................................@#......................................4....................................... ...`...................................................d...4...........................@ ......................

C:\Windows\INF\amdsbs.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1f20 "signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	11924
Entropy (8bit):	3.6817993616405755
Encrypted:	false
SSDEEP:	192:lilla61/U5vzxVq5QVhDVDjU7YoIFyuqQM//4Wpb7dYvU+aaaj+SJXpm7sd9c:cYt/DhjUsoIIzQXs+XHaj+SU7sdG
MD5:	FCD5AE961D0A54A2544C133331A5961C
SHA1:	1E05C993E561317853101B9B72B1DA521DACF822
SHA-256:	F5BFD522E0F5626B2FAF158065519672DB746437E8DF0D0F44BB638CABDAC3B7
SHA-512:	9C08CB5541F83CC19794E2FF2AF2F5D856275EB76B418149B34CC0688F46BFBBDF935F347C8823A0DC5058B4861186B4F9561D718379708C7D7F7D4E1F34D99C
Malicious:	false
Preview:	................... ....b.........................P ..\|....!.......%..\|......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................................................................`...........................................T.......................8.......@...............,...........P........................... ...........................................................................d...................X...................................0...............................$.......T.......................................@.......................................................................................................................................................................p...........................................................................................................................H...X........................................................... ...............0...........X...........................

C:\Windows\INF\athw8x.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x191e0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	230388
Entropy (8bit):	4.247715539147767
Encrypted:	false
SSDEEP:	3072:YldIKzjCr9f4q1S3ojaTgRVb4JKsBRybovrnx0K5kfTG7zc:YtCKERiMsBIbovETr
MD5:	102DB2D2B3920BC832B4B9ECCB98274F
SHA1:	DF6C2D87A5E48535CF50029FF0DAB36738A55F71
SHA-256:	A802FFA38AAF1D951CF99F8D74589EB45F46AED313F2535168933E6E6AF6F449
SHA-512:	1CF505838063536311629D952D23F46922E2E67D9592A172E1BEB16165D095EBFB82B0E48046D61DB6FC5BA293548CC6781EDE7500A96E470352648D833459A2
Malicious:	false
Preview:	........................oI(......t.........L...........$.......\|..@4.........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........X.......@.. E...\|......N......t...................h..../.......=.......U...a...\|...F...D......@p..<q...+...P......Ti..4............... 3...\.....0...."..p... j..........\|.......`........... ~..D...\....m......P...L...p5..D.......T...4................Q..4....s.......i.......(.......s..H2......P-.......m..lu...+......HN..8L.....L....k..........,...`...\...$0.......~.....d....................g..xd..$...\............f..p&..,{..\|h......4b...Q..........L...............h...........4...D>..`.......Hm...,...-..8....}..4...................\|.......d-..8,.......'..8......l...\|...........<...\w......H...`D..\|......\g..(.......t...\.... ..l#..............8....\|...!..(....-......XG..,P.......y...'......$Y...&...O.......`......./......8.......\|....B..tH..pl...v......4W..l7..t...(%...0...........W..P8..(M...d......T...............pN...*..................

C:\Windows\INF\avc.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1d08 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	11444
Entropy (8bit):	3.6210799099683144
Encrypted:	false
SSDEEP:	192:Hp2LJ0p4AzKXhoCBPUshe2FTCtPjx1XO3O:J2LJ0Vebasc91XWO
MD5:	FAB123659AC24F1D0BA558E013562859
SHA1:	D9A0B3A0CA916D05953387A6D22C3CB76CB32511
SHA-256:	A680E312DA48E4C73F86A033C0B43213F8814C9A224487FC0D74D6D7FE65AE37
SHA-512:	A7ED3397581D5B00E395E8639AD096F0B03E497688FE6F01CC7F371B5BED0FDEC2AD9B4EFC789CBA44E01EBFAA3081C3BA8A3665F244831FA5C03C03B0B4DF45
Malicious:	false
Preview:	..............................HR..........t...........l...p .......$..X...X(..h................,......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......X...................................................................................................4...........................p...............................................................`...........................................................................................,.......@.......,...........................................................`...\|...T...0.......................................\...........4...................................................................................................................................d...........................................................................................@...$...............D...............................................$.......................p...............................................................................................t...................

C:\Windows\INF\b57nd60a.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2da58 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	473236
Entropy (8bit):	4.47576331336566
Encrypted:	false
SSDEEP:	3072:AVeEjelt5v9fIAGCpYLKCVurCACB1aiKrvv9gNtb2i2Dtq85gYWmka6HAh8ngmy5:KejG1ay+ql07btv0yb5E16u7G
MD5:	2DEBCF6D745AF29EAE7823FE3F314932
SHA1:	D10CD0D2C3879F1EE6A815CD3D26EE00B1989D9E
SHA-256:	7D637A1B563A92713CE7A71F36D0A145A5C96762DC6924D2FD276720C485D9BC
SHA-512:	EA82D0FCEE5F8ACA6BC757C2C157D7324BFD7E35CC4ECE12C98451807F8574C2D1EB413E7E0D949582387A933107A90FA8BE67C7C414C1312EB1A76268B769CE
Malicious:	false
Preview:	....................X...QZ.........................h...LJ...%......`8......x...h................8......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........8....x.........d....Y... ...X..............Lo...6...........5...+.......C...8...g..@...8...\|...dY..H....:..$O..\|............R..\|c..@.......,... ....(...x...-...)..$!..............T......X....D.......S......HN..DJ...g...Q...,..(........%...N..h...X....0..0...............H..,K..d................l......d........b......\I..8r..$'..X............8..P....z...W......................T...S...6..4U..<....4......0....P...-...-..\|.......(...<..............`j......P`...X.....t`..`....F..h...lC..<i........h........J...O..\u......l... ....q...%...........#......R...p...c..d....7.......7...8...V.......+......P....D......d...4....g.......S...J..x.......@q...)..<9..<...(...x...4D..........\|m..\;.......g.......u...h..,.......,..............<....=...........[..."......\|'.........0...Pn...... ....j..Tk..\|...l...(....9..0...0:..l>......{..\|...0.......

C:\Windows\INF\battery.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1528 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	7740
Entropy (8bit):	3.42125738574714
Encrypted:	false
SSDEEP:	96:Fl4A8zFGrP7zE7B1AQB6qRVesLRLzHPKT+3Z5hBuxouJ/N86ELVgSVTd:z0BGrU7kJqLeeRLbPY+zuxouJVA3b
MD5:	366BF8F2DB914A0847F1E5787E7C5BAC
SHA1:	92CFFA69209744A02CB13C1E864EBF9F17CCE63E
SHA-256:	AEC6D964857BA8506FD2E4D13DD0F5BABB907FCE7DC327A47F26F6054AAE9E5C
SHA-512:	F7555F0030D2B6CA6A9A1BDA5A3C79ED450C78205A41F2F9492962E522597A3449F4513DC5E1AC1D4A5C0A5BC1F578F3DC7066FA4A9B7A339FC05E83027002B9
Malicious:	false
Preview:	....................(...QZ.........................(...\|...............<.......h...............8.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......\.......................................................................................................................................................................D...............................................t...........................................................................................................d.......................................d.......l.......................................................................................................................................................................................t........................................................................... ...................................................................................................................................................................................,...........................4...............

C:\Windows\INF\bcmdhd64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x6718 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	47348
Entropy (8bit):	3.9285481517685046
Encrypted:	false
SSDEEP:	384:duglycimOl+O92HZZdK/JSXv2Qyq4k5PhZI5cx08XHB41IpBd9B5BOV9zE1sF4WQ:QE9bdK/JOvHyq4kZI5/8/09z0mDWBPZ
MD5:	CF370977933D87B22307A9BB2A04D343
SHA1:	84C0FB7E92294A833ED9ED3522841F64671BAED4
SHA-256:	E028A9B96A99D0D0ABDC4E0AFC55C98016F5CED390D19AA620B36D535BCD4FFF
SHA-512:	72AA15C55C09E74D26E64B49D084C81364E76D07EACA2A549FC93B06206E2E287F3DA0B39ADCA24043BF76E1E18EE964521F927984C6E55B0101581E79855457
Malicious:	false
Preview:	.....................g..oI(.................f..$....h.......j..............P...h......................C.:.\.W.i.n.d.o.w.s..................e...%......./...E.......]..P...............................T4...U..HW...!......x,......l/.................$........C...+.......R...=...0.................. 4......LI..t>.......=..p=..h@...X...X...X..<...<.......TE..`5..8O.......Q..D...@...t<.. c..,R...............5......N.......F......d...........O..........pc..\|c......\3..$3..@(.......V...,......</...S...C..@B..........\|O..$D...W..4....U...]..<U..<H...c......de..pV..0X.......c.......B.......F...........7...^...&...^......\".. _..D_..`_..(Z...Q...Y...(..........(..._..dD...7..._..07......x=..pI..pa..L1...'..l%......<-...H...W...........D...Y...D..."..<2...?...e..H#...H.......(...................;..\|[...........6...-...).......b..L>..TU...........V.......U.......c..L@...........>.......4..d#...1.......I..`H...........]......................<D.......... S..h]..<...XX..."..L)..........P...........

C:\Windows\INF\bcmwdidhdpcie.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x54e0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	39780
Entropy (8bit):	3.941986611910635
Encrypted:	false
SSDEEP:	384:A1gzAOE+OT1sNDx5mnfh4QkCHR/WcDm7Tn8d2F/h2SmzWQOLkvACEMeGZdnQP1bo:XJDxIfh9kvnxF/h2TS1xlB7BE
MD5:	A7C342BF2486E8154FCEA2FD09C3A2F3
SHA1:	94C3BED49B84FA581B844C790F23835E8E641A23
SHA-256:	C647C7A931CAEAF641A6F9A305DA7FD0FA6477A90DF1E69B5F9E4B3B70414A09
SHA-512:	C9660152551243C34CF4C9572A414F9642AF7FA9CE675E401BBE0098C27E0A2B9DFDE68896D81AB679BD8399A62704EE8A0D91276FDEC8E3DC875DE7233CC849
Malicious:	false
Preview:	.....................T..o.*......t.........LT.......U..X...0X.......j..8...(...h...............`.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......h8.......=...............-...........K..\.......(R.......................1..dG......P........'......8-...........$......8.......X6..l%.......D..\9.......................1......./...:......h...T9...;...6...P...,......P............2...R.......J..P...T...L8.......C..X.......$....3...$...Q......x.......P$...........R...................)...........".......G...(.......-..\E...?...I..............p?..\|?..H....F...K...F..@2......H........H.......Q..............................."....... ...............&.......................#...................?...........F......................L"...4......`(......................t,........... ..d;...O..X...0B......(#.......................................(...$.......N...9...'..........\H.......F...... @...;..$........9......,2......./......hA...N...........K...................?...?......p....D..TK...........(...#......

C:\Windows\INF\bda.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1fa0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	11756
Entropy (8bit):	3.708976582443073
Encrypted:	false
SSDEEP:	96:JHSwW5w3icr8KiKJ86PqsLPBFbHSso1oQuPppngQvCvsMeOc1pdqc/EITXz+LCkQ:kk36cTPnbBFbHlPrtvCvsTpdh80XK6
MD5:	553F598FC8F0505E448A5EBB7B337C65
SHA1:	E812E5F9BC0FEFD40098D5D01228161E431BC664
SHA-256:	E88960C0558898809E14E383E64B4E56D22AF604998CF6F2D5E1C3676C394365
SHA-512:	98F9F36B458FEC517F637C3969537FC0DC6EAA0760C3956EA43DE4A40C0F538272B24006C8A1C82AFA07354414395C8394640506960BC4136B97C1F5038D97BA
Malicious:	false
Preview:	..............................HR................... ..@....!......h%..<....)..h................-......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......4...........d...............$.......................................................................T.......................(...................8... ...............l...........................(...H...................................................................................................................\|...................................................$...........x.......P...t...................\...............`...............................................................................................@...................................................................................................\|...................................................................................................................................0...........\.......4....... ...........................................D...X...T.......................

C:\Windows\INF\btampm.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xf78 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5084
Entropy (8bit):	3.0519227071211144
Encrypted:	false
SSDEEP:	48:+jYT5/uxvh1vCiGG4Ut5iLb1AQ0LMopGQjRA5QJ8G7+Gt5z+tF9:cYTFuxp1vCrG4UUb1AQz01jRuEVJ5WF9
MD5:	59CA480369A146D590AE3C2DEDEA00D6
SHA1:	77D47D6C55C2E5FCD6BDB5313062C42879593F53
SHA-256:	7DBC4FAB4CF597A6BA873783E3C83CEBF29BE0FD5A9EA87885EE0F4B52A487BB
SHA-512:	726599C0980457A79A7859396D5E46E9199BEAB0812047DF5CC07C58F6199B69E11CB678C2EB6FD8ACC0B058E952F467985916C0193012F390953278EDB83D27
Malicious:	false
Preview:	....................x...y.%........................x.......X.......(...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................................................................................................................................................................................................................................................................................................T...............................................................x...............................,...............................................................................................................................................................................................................................................................................................................................................................................................................................X...............,...........................

C:\Windows\INF\bthmtpenum.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1a40 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9044
Entropy (8bit):	3.60232718516397
Encrypted:	false
SSDEEP:	192:tVYe3lsD1x1sgljF6Lk77BLk8D/jz2OQdS1g:tVYe3lEbsgh4Lk7XD3nQd8g
MD5:	926A3A79DE4D3F3C06096A360DA706CD
SHA1:	4AC8C74CD158B71F85681D019EB3401E5B8CBD5F
SHA-256:	F52BB497E7AD7CEC9BD01CBA4D72316322D06F4806B40264FD035345ED6CBC9B
SHA-512:	C10DC37EAFFB7D45D59BC8FC39E3FAD88BD8CB0454E80DF6582DD5E262E1409B140A602D2F639662DF8E0A4B2BBA076707E39B38462DE910C2A7B793AED49739
Malicious:	false
Preview:	....................@....[.p......q.................`...h...............<....!..h...............P#......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......t...........................H.......................................................................l...........................................P.......................,...........\|...........\|.......8...P...................................................................................................4...........................................................<.......4.......................................................................................................................................................................................(.......l...................h...............................................................t.......................................................................X.......@.......@...........................................................................\...............0...........................

C:\Windows\INF\bthpan.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1e30 "Provider", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	10972
Entropy (8bit):	3.6941034505233477
Encrypted:	false
SSDEEP:	192:yLpVUYDtkkJACgcg09BSpa/46DwVO4y3aj2aX:yLpz5jgcgyBSpXzfcopX
MD5:	03E708E0C1771CD7AEE92C31C0D020CE
SHA1:	663EC4A3C16B9F29FC3F9F4532596660F11C9B93
SHA-256:	5D2A82A32E6AA51BC48D8A47AF5F7DD00833A12AA285C70CBEAEA9A6175E882B
SHA-512:	8080F614D623A14652899A8624B871E8E3980CDFB527DA98566735A40BF33B88A493C7A36C558F5EB41F18ED5472ED8A0BFCF3A7C4CB4E354BED42DC4D760DA0
Malicious:	false
Preview:	....................0...Z.{........................@.......X ..<....#......8'..h................*......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......................................................................0...................................p...................................L...............................H...........X.......\|...T.......P...........................................................................0.......................................................................................@.......................L...........................................l...........................................................@...........................................................................................................\|.......$...............,...t.......................................................................0.......................,...................................@...............................................................0...p...........................

C:\Windows\INF\bthprint.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1600 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	7444
Entropy (8bit):	3.4325687399905247
Encrypted:	false
SSDEEP:	96:Vg53gk1W1DY+g561Kfz3gCvJr1Rq6S9vKk8Ec00zZH1Ph222JSq+lLa1onG:VggRg561KjgChr19Wi3EA22OSDC
MD5:	8F1DB4B4F7027C1893F712433B629676
SHA1:	DE0688EC84DF968AE02F9A564C36F7766DC0E6B8
SHA-256:	369E6C8F9D67C1C29DE7544EE752487FAE0918C9A95C7A902A50B72C3933F905
SHA-512:	4FDD1B9F8E2A6432F390C2DC7EF0C5395295F3C9730525486747D73813BF784D858AD2AEE49F0BE9F1D754DD441D4D43587458ED245AA7A4C6D6784880C075C5
Malicious:	false
Preview:	........................kMt./...44..........p...........@...@...............h...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................P...........0...........l...........................................................................0...................................................d.......................P.......................................................................................................................................................................................................................................................................................................................................................................`.......................................................................................(...........................................................................................................4...............................................................................................

C:\Windows\INF\bthspp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xfb8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5148
Entropy (8bit):	3.0861660326815454
Encrypted:	false
SSDEEP:	48:nXfJzqldQBOm2hphWtl53h8FgabpRC5mVqU7EnLONKRSVokb9t3:nXf9qldBhphWtlGgabpRC4kU7eMK0xhd
MD5:	7110C8D2E13707220D131F8D6860D8BA
SHA1:	B63D784795AD985DD7DB254E164E0395E78685CB
SHA-256:	86F41D75157EF30D4A4F460D2106D31C19F7D46B250ED798CCD32AC4F836CEA4
SHA-512:	9AFB7EACCCF9A3FF22FDA05667CC6CB5419990732815359D74FF074A69F1FF0B40E5C26A4B35428D8E5269E1F9F51B4EBC69E0F9198A0B012A4CC87F7975BC66
Malicious:	false
Preview:	...............................44..........$...............P.......(....... ...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................................................................T...............................................................................................................................p.......d...............................................................................................................................$...........................................................T...............................................x...........................................................................................................................................................................................................................................................................................................(...................................................................................

C:\Windows\INF\c_1394.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe18 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4596
Entropy (8bit):	2.8966240091454494
Encrypted:	false
SSDEEP:	48:d9fcJEblhAvtSfOQgdwW5f8srswIu76QyddrbIDbcdORbcyAwgWrgw89rDh:3cmbPwSW17NR7YHuc8NcNw7+h
MD5:	38C6EE75B71217BF24F05AAD95C9DB1E
SHA1:	F5ADFDBB7BB80DE328950F978A09A818FCB01E23
SHA-256:	2A7B425110FA791A39BB3F7EA2563643EA6D6C534CD50461060671AA0B063D3B
SHA-512:	05337ADB7687DD5CBFF03021D664594138C8B1146FF4FE63F1113E17D97C2FE1685B497482D7DB026D0B53CFE30629C27937CF70C6EFA7704CB9B9AFBD4107B4
Malicious:	false
Preview:	..........................x............................d...x.......0...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S....... ...........................................................................................................l.......................................................................................l...................................................................................................................P.......................................................................................................................................................................................................................................................................l...................@...........................................................................................................................................................................................................................(...................,...................

C:\Windows\INF\c_61883.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xd98 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4364
Entropy (8bit):	2.8166639538441176
Encrypted:	false
SSDEEP:	48:cflobZJIgW9bW5fD0wEKIB9rbIDbcdORb/fwZPn68+xP:el7Pwr+huc8NnwZPG
MD5:	505C69581D7AC91C7419D6531A380C45
SHA1:	1586AD3AB288C9D6D1D1EEE1FC5680F6091D6ADF
SHA-256:	FEA4BAA46CE2C07A8298A331F7AF8F1B8BDC27F7B3AD2E15769CA26A5F0DD954
SHA-512:	29C7A935A37BFDD3B9A186D18FF65510FB3E294F899A3634E898C6D2BCD1E744060F4FBB1D0F5316C17072A93130D7C332666680CBDEB198D363D79086819F37
Malicious:	false
Preview:	..........................x............................d...................P...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S....... ...........................................................................................................D...........................................................................................................................................................................................................P...................................................................l...............................................................................................................................................................................................................................................................................................................................................................................................................................................................(...........................

C:\Windows\INF\c_apo.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1418 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6964
Entropy (8bit):	3.390880791386117
Encrypted:	false
SSDEEP:	96:GjnKL502juqw2xRDq+9nZoaxP9dQl/kuRuC2toD4Hbz8Xfs3Pn0880v:GmLhxRDqonZbhQlHoC22D4Hbz8Pscm
MD5:	50ED4B2949D4ECDAEBB258010D98D05C
SHA1:	B2B0C02F2FF8EEB7AF2F4E92FD782EAFEB4E0C58
SHA-256:	444382D5EA503C8A4F940B81172988C47B7D05FB2BE2731691B402DAD5464697
SHA-512:	28A4B9AB74FC6FBC30E0F064EB5A5C9CF695D2F100B914E2082A6DE7B6DF84B2F311FECC2F920F06D01CBD0D181896D18E9F773454D051DF90836184CD07CB11
Malicious:	false
Preview:	..........................x........................0.......H...h...........p...h...............0.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................P...................................................................................................P.......................................................................l...................................................................................................................................................................X...............................t...............................................................................................................$.......d.......................................H...........................................................................................................................................................................................................................................................................................@...............

C:\Windows\INF\c_avc.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xd90 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4356
Entropy (8bit):	2.8438312268993555
Encrypted:	false
SSDEEP:	48:Yfx3hg0jJY5fkPUng8IUxuaoDbYxbcQDFnnL1:ixe5rkaOYtcMRp
MD5:	0CFC750F3CBD831E7E7FF562DC825A23
SHA1:	5B89A7D7037D879A89036AC1706FA05DC84CE9A3
SHA-256:	5BEC8D5879C006DE64AF183E8455FE33E908F0149D9464547766D89D38ED6F56
SHA-512:	550DDD960E58B9772891CE25876A530429A4AFCDE3EDD8377A5EC57F7B047D09E47E089C3B5C63D290B1F4B2C7D01B1243C868DECB9542313C62895DB7446196
Malicious:	false
Preview:	..........................x............................d...................H...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................................................................................................@...........................................................................................................................................................................................................h...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................$...............................

C:\Windows\INF\c_barcodescanner.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xc28 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	3972
Entropy (8bit):	2.600098567676139
Encrypted:	false
SSDEEP:	24:dXTn+ljJQpSN26cemL5cc6rO9kdKfchF8vLVTnFvrAefhehj9kdCpwHVITaAz:NTnmJASN45f0O9/WF8TVrFzAuI9e69
MD5:	5F7FEAF81B2344757C857B0E240727CA
SHA1:	2176B826271E477FD5FFA38DE85FDDD8ED2663C5
SHA-256:	DE46A5C8B7AE97D5AC9DA3D2AB4D80DB64CC557E129CF396B5DAAC10546E12F7
SHA-512:	749DF7EDBECCC4145B5B399023EE75741ABDF3C9A93F5574DBEB83F8B230FB67D0AD0A0775BA0FC103F5BB36172616A6CADD9E6CF392EA621A027B59EECAA11C
Malicious:	false
Preview:	....................(...Z.{......n.................8...d...........0...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......D.......................................................................................................................................................................................................................................................................................................................d...................................................................................................................................................................................................................................................................................x...........................................................................................................................................................................................................................................................................

C:\Windows\INF\c_battery.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xdb8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4460
Entropy (8bit):	2.875311435631876
Encrypted:	false
SSDEEP:	48:4f8LDpsu0iNf4/F5fSFoBa0+aoTe0/HAX:C8LTlNfBeF8eH
MD5:	B1AF8D548BE9EE386D9C4EE82C7D5B27
SHA1:	78BF920E59A645858ABE41804FFD0BE531FEFDE3
SHA-256:	D0AB2FC1980601BA58297280035BB59B7A7735352A4F96BBCD6AEBD429992831
SHA-512:	1EE9136AB25AF40F968EB9D91064B960B9A7312162D4EBCCCB4FA195755EE64696C69ACB4B7F39636E8DD4A040AC397D76B4C42DE0E1D72868187940091A72D9
Malicious:	false
Preview:	..........................x................(...........d... ...................h...............h.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......$...........................................................................................................................................................................p...........................................................................................................................................T...................................................................................H...................................................................................................................................................................................................................................................................,.......................................................................................................................................................................................................

C:\Windows\INF\c_biometric.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xda0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4380
Entropy (8bit):	2.8645727318386522
Encrypted:	false
SSDEEP:	48:XfWEDIUP1AK5f1D+dSnF4IbWR3rbIh1eQD+Gnz+Fj:vWE1NCknqkWR/uAQCGS5
MD5:	B844E696227133ECEBBE8E5481BFC2E0
SHA1:	19C3142B297B1496D9744A818C2D83D2A1DE3C2C
SHA-256:	189514401A73525A6D41F2638CF7EDB1C745BF80E385FB940273C1AA1427C735
SHA-512:	241698C2545B9D8D736ED4F772C0FA6200A0A78BE9FF6B8C4E4F099F4797D729DDD28B583931FD2ABB6013C999065800BE5CB006EB43657E22E09387CDE6E165
Malicious:	false
Preview:	..........................x............................d...................`...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......(...............................t.......................................................................................................................................................................................................................................................................................X...........................L.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................0...........................

C:\Windows\INF\c_bluetooth.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe00 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4532
Entropy (8bit):	2.898008103302491
Encrypted:	false
SSDEEP:	48:E9fEv10yExc5fRgiJqioTockddeaoqw645JqiRAmzK:AEv1BE0giJEzk9VwT5JxK
MD5:	FED67D0F84DFA096CBF3D0630BD0FC9B
SHA1:	22492874953509504AACA316526432FA12A8DF60
SHA-256:	2ADE048D2491CA6EFC39D26019A054965B0094353B4229D759BB061CC78A4490
SHA-512:	04740E6C7DFB8BA0A417FC86BB4202470C0203EBD1FDAA4ACD2D82A984638E536AA4C96C762C27BA249A02645340667B30F8A050CEF33E35ADB0D78B30401B77
Malicious:	false
Preview:	..........................x................l...........d...h...................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......(.......................................................................................................................................................................................................................................................................................................................X...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_camera.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1728 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-GB
Category:	dropped
Size (bytes):	8948
Entropy (8bit):	3.47502175035322
Encrypted:	false
SSDEEP:	96:hc1OCKsKeUCBXxFEsy4/H8JcqR0xXR765BWtphBVaTKG5qfeJw5W/39rdeTNy/p:iNPEsvwn56Qq5WxZ
MD5:	F1A3165DF48876C2EF5C412554FEF22E
SHA1:	E7A1ED95EEB6D91EB23B9C55A25CD2E7BA244EA7
SHA-256:	FCEC2CFB91D2196C2669AA88335A12564A57A9022A45E16691C6C77269ACE824
SHA-512:	CEA17BC1B83BDFA243C41E5DA8364E96CFF3BFF19140563CA12A374D612D72CA9568EB6965A5FA08E5ED374E98D625C78638D3A97CA2B8DA2B321660A6151D07
Malicious:	false
Preview:	....................(.....x........................(...............P....... ...h................"......C.:.\.W.i.n.d.o.w.s.....e.n.-.G.B.......................................................................................................................................................................................................h............... ...................................................,...........................<.......................0...............................................................H...............................d...........................................................................<...............................,...........................................L...........................................4.......................................................................@...........................................................................................................(.......................................................................

C:\Windows\INF\c_cashdrawer.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xc28 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	3964
Entropy (8bit):	2.6310670857245015
Encrypted:	false
SSDEEP:	24:PkM+EPFMILVL5kc6HJhH17nTXYMSvLvdvrlyewNH17NpgHvV4ITOd:Pz39LF536JhRLSTVzsFRMt3ad
MD5:	D2BAA0C5C20D20393B4436981ADDFD1A
SHA1:	204A7F740D1EF95FB7C9BBA24F8B3C889D17A70D
SHA-256:	5A865A380C8E6BC97159D2128979CB470B743EAC2BAE651CFF6084A6BD3284B3
SHA-512:	EFB39371E9E8B8D2624C94853E6FF79CA9E8C9730BF76E34064068AEF1750931A8BB8A341DEA961159CC765713CD490C7CD4EA8DD74C3D037CEEFA9A7D7170DB
Malicious:	false
Preview:	....................(...Z.{......n.................0...d...........(...........h...............x.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......@...............................................................................................................................................t.......................................................................................................................................................................X.......................................................................................................................................................................................................................................................................................t.......................................................................................................................................................................................................................................................................

C:\Windows\INF\c_cdrom.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1118 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5876
Entropy (8bit):	3.1909377376253714
Encrypted:	false
SSDEEP:	96:y6UBSnAcGW5suaZcMOetTdkUZFixpi7w81N:yhGAZcMVrKq3v
MD5:	9999E296D674A39BE39930AB6EBECBDF
SHA1:	F504846271E3A1CC1E2FE5D6E2971E9C12D1D1E9
SHA-256:	05EF58D11B23FF8A22ED3089340890971C160172ED405F9F540461CC6F06B724
SHA-512:	FDE43D9023138EDD4179DDA0FAC0D91E6E7FF4443968ED5D9F32F3EB6A2D9ECA1A97350F7039A506CCA2209D4434DDD8D851EA667D073D45FFC01B0A6244CD4B
Malicious:	false
Preview:	..........................x....................................,...........`...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......l...........................<.......................L...........................................x...h...............................................................................................D...........l...............0...............................................................................................................................P...........8...................................................................................................................................................................................................................................................................................................................................................................................t.......................................................................................................................

C:\Windows\INF\c_computeaccelerator.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe78 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4868
Entropy (8bit):	2.994102268975931
Encrypted:	false
SSDEEP:	96:yWizsiofROKFlYu7Vybe4OdteN/f4U3uh:yaXOkxxGN/fM
MD5:	A7D075F2D766FB9E512FBDF8B85DAC56
SHA1:	D99144EB9E845608CEFD16DC9EFAD9E76E619682
SHA-256:	C9593F62950440BC241236CC52DEA736605F2876FA9099B98DE1E5B0F007C269
SHA-512:	F74161133E49A76C6C5987A5EFF89B9775D5CC1696177E0143F11B89E08EB508B373ECA1F07442E04EBADB3F5067EE2033E2880814447BD588BC412A2BF9FE25
Malicious:	false
Preview:	....................x.....x............................d.......................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................x...............................................................................\|...........................................8.......................................................................................................................................................................................................................................................p.......4...............................................................................4...................................................................................................................................$...........................................................................................H.......................................................................................................................

C:\Windows\INF\c_computer.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xdc0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4468
Entropy (8bit):	2.872820030728998
Encrypted:	false
SSDEEP:	48:GfNIvMbyUm1c6Eo5fJu2s3Ix0eaIDb8RbVxFIoA1LFv:YuvMONFHu2s3O2u8NV0Fl
MD5:	6AFDB82A09647DCB38F25A0C062313A1
SHA1:	8C2257D472A9D279D07C274AA8773DDD1A5A0348
SHA-256:	6A42248B606C24DC8F39F80B24A1008EAE2662C9053D8A17BE3534D056A7AE74
SHA-512:	094B9518234B38C90C1C927C3C5AB8F1632A54D274CC2243BF2DD4B9DBF7ED31512C5966A254636934E05355D59760C48DC5DB75DB7882C64128EF829F73C758
Malicious:	false
Preview:	..........................x................,...........d...(...................h...............p.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......(...................................t...........................................................................L.......................................................................................................................................................................................................X...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................0...................................................................

C:\Windows\INF\c_diskdrive.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1248 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-GB
Category:	dropped
Size (bytes):	6436
Entropy (8bit):	3.304237130463518
Encrypted:	false
SSDEEP:	96:grmsu4xFuKeBTfneqGfOY2uuTN4MDcbcqJ:1cZCy7xB
MD5:	799661C11F5A2A85A0DBE653F3227144
SHA1:	4925B4EB1A50E6D8C38EEA242DF5EBC998DDEA8E
SHA-256:	457156B0C563C06E21177CE14583D309FCB138C8124558D008F3C1B23D224A66
SHA-512:	A274694E5B7D7E50FBD42ECFABADCF4A3ED2E13CE3B7B22CF9EE26E41000D8B3E6C2D0E498FF2028965E5F45B4E136886CF4B0108CBF7BE213966D0D597EBFE6
Malicious:	false
Preview:	....................H....../.......................H...........t...P.......8...h............... .......C.:.\.W.i.n.d.o.w.s.....e.n.-.G.B.......8...................@...............................................................................(...........................................................................$...................\|...................................................................................................................................................................................\|...........................................................................................................................................................................................................................................................................,.......................................................................................................d...........................................................................................................

C:\Windows\INF\c_display.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x15b8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-GB
Category:	dropped
Size (bytes):	8660
Entropy (8bit):	3.389259678677475
Encrypted:	false
SSDEEP:	96:66BcwTdCMNyL4zlFpHPGWOrtlr8RhIgqO74ufHRY0BnkOTIZdk7VGpR2bQjN:67wQMYyFCr8nnxxNnk16u
MD5:	91136D59B339C34E62BFBB536BF2B39D
SHA1:	4A32B30C8875B99947AB2D5F0164E7046DEB8DE9
SHA-256:	820D9F328D7A4B3ED2B7EC7ED423CE4BF644C27B45F3B1DF3F3730DC8FC98F0E
SHA-512:	DC483D9C660B19C45CE23890E9757741C96D779509D0459436F48E188F1B1A9713BA4ADAC025738B56FC9CEE6BB8BA77D11668B14D553722CF01549173938D44
Malicious:	false
Preview:	..........................x................$...............H...................h................!......C.:.\.W.i.n.d.o.w.s.....e.n.-.G.B...........................................................D...................................................................................................h...........................0...........\|...........<...........t.......(.......................$...................................................................................................................................................................p...........P............................... .......................................\|...\|...........................................................\|...........,...............................................................................................................................................$...................p...................@...................................................................................................

C:\Windows\INF\c_dot4.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xd68 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4268
Entropy (8bit):	2.827896699727498
Encrypted:	false
SSDEEP:	48:HGftJtSdocGEwK5f/n4jTo2HAaHbop95Vj8VS:4tj6mTXzG9
MD5:	401DE67E26D8D484B0714F6464E821C9
SHA1:	BB1F0ABC977A3C2924AA32AA2BF733DE1A31769F
SHA-256:	6D3E5DF98F53E90865C321080CA2A7F75130079129978AB5C8E834E30EA5E530
SHA-512:	38DC2A9537517FDF761661AD0D0C4F3EF0472F4E9234D2164DC6D825CE87E761D643D8821B27FF435C5E8F284F07BD53BA40C6A6D1194E99B031E0953FFAB25B
Malicious:	false
Preview:	....................h.....x........................`...d...........X...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................................................................................................................................................................................................................................................................l...............P...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................(...............................................

C:\Windows\INF\c_dot4print.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xd70 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4284
Entropy (8bit):	2.8375637874250144
Encrypted:	false
SSDEEP:	24:Q7fVj+NPcTclCufZi1PdQL5cc6F8aTCcnn4o0/PJ4q/P1Dg4o0rt4qrbJe38spPL:efVjqETUCuAK5fu4of+DoXaJioFQ
MD5:	92C55A6CAB9AFCF09A74431E12464C93
SHA1:	809AE57659657CD88961949B534360182066C897
SHA-256:	7A84F52255AD858C0A74355190B761087F3FF61C208D4CD9EACD3B530E559578
SHA-512:	3BF355887E421D78544F8749405282E47B201528B1AC886EDB90B61D21B0A9650AEF960AAB0C9F478267698DFE0D37CFAC79176BFECD899A670EBAAD984BC94F
Malicious:	false
Preview:	....................p....Q{........................p...d...........h...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S....... ...............................................................................................................................................................................................................................................................................................t.......t...............X...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................0...........................................

C:\Windows\INF\c_extension.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xd78 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4468
Entropy (8bit):	2.826823599136625
Encrypted:	false
SSDEEP:	48:BAKFa45bM6Htqlh5ieqo6YHPIddeaIDbEORbBuqefop7iMfD:BdFa76Hc6YHg9uPNsfopJ
MD5:	39EA04A40A9DAD1C64CD4417E722DE45
SHA1:	A4B0333BDF33B4152434091CD54B17354492B378
SHA-256:	32237E334248551084AAEB2014BE26EB07A34D76060A29CC1C521EC73DCA5ACF
SHA-512:	B0EB8D550A9005334E3E4F62CD78F6CF6480E95556FB235E2519B9FE9AFD8BF8BF71FF7FED1C43E7A404CA3278059636D29366D57F5E0AD8AC9115DCB6D8334E
Malicious:	false
Preview:	....................x...../....yl..................x...d.......................h...............p.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......t...................\|.......D.......................................................................h.......................$...........................................................................................................................................................................................................................\|...................8.......................................................x...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_fdc.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe80 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4828
Entropy (8bit):	2.9754257848656067
Encrypted:	false
SSDEEP:	48:sf9diGZaEGK8anI5ioO6I7HEwNqR3mIDbkORbekY2p7B9UopN:O9diGZaEGHaoTEkVR2uvNekDpl9UsN
MD5:	87FBC0F7D8D96CF7C2785CB02CC56397
SHA1:	34F550E0FDBE745957914551F3D4C2B5601B0641
SHA-256:	2F1C000ACBB62F9F9E2110881E33E07CC4E0876AE60B5B4BB50994600E36E0F9
SHA-512:	034004A623626705256F7BB739F62E13ED521CF2C596114C69530059CAE6155B44EE8A8810EBB8ED42DFCB27274E1058C517708C3591B373375EDA1F06493B08
Malicious:	false
Preview:	.........................Q{........................x...d.......................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......h...........................8.......................@...............................................h...........................................................................................................................$...........................................................................................................................................8.......................................................d...........................................................................................................................................................................................................................................................................................................................h...................................................................p...................................................

C:\Windows\INF\c_firmware.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x15a8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-GB
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	3.430139299219039
Encrypted:	false
SSDEEP:	96:/xqGmZupFBY3UOOHu3Nqg8RjqLWEMoKdB3Ry/T:/3akO+jWW9oKdDE
MD5:	C780D2AE2FA78A54F63A036797BF399E
SHA1:	CFE736C829A1C8D2423206832F1380D51C4134FE
SHA-256:	0218683605CDD6970DDB0A8C7F2873F75BB1582D01529A186670084E8B04556B
SHA-512:	E32A15C2EC8276312651A70DFDFB9AE59AB4F591C78203EA1E32806AF22380FBA5724395136274AD07477952894B267C684166D11C8713366FBA69E61C9BC4E9
Malicious:	false
Preview:	.........................Q{........................................X...$.......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.G.B...............................................................................................................................................................................H...................................................................................................................................................................................`...............\|...........................................................(...............................................................................................................................................................................................................................................................................................@...............................4...............................................................................h...............................

C:\Windows\INF\c_floppydisk.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x10b0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5740
Entropy (8bit):	3.178595602749464
Encrypted:	false
SSDEEP:	96:fUognPm0cv+dpaYrKM+X9bgcApFVmTZViejvp:fngnuDYopFCoL
MD5:	3240123A6A0D5E15193D00A11FFF24CF
SHA1:	11DD5107E80C0C94E81F3280D342DFF7B2807D76
SHA-256:	78342DB2B18665ED0B9CC5E565C53665178334E1D088A3C9092321F58BD33D2B
SHA-512:	C754B77F08B79FC183A70398ABFB69BFB82E3891DCBDA177DE8AA4B841A0C4B6D6D78912DFA809D5408CD0230D93C0EB2C3CA1B0AF76D9977F89175B38348791
Malicious:	false
Preview:	.........................Q{................ ...............H... ...h...\|.......h...............h.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......x...............@...........H.......................P...............................................h...........................................................................................................................4...........................................................................x...............................................................8...................................................................................................................................................................................................................................................................................................................................................................................x.......................................................................................................................

C:\Windows\INF\c_fsactivitymonitor.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xde0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	2.9184857630319545
Encrypted:	false
SSDEEP:	48:yfR8PNpH84Vx1jb5C6oZRlHjIcjaG5eaIoN+q9KZRlmwp7fSg8fMT:cR8VV84Vx1vcYEXNfKKwp7G4
MD5:	EBC46C17D35057AB3068D0E57AB1BC81
SHA1:	B7CCF745D89BE7521E8B630CA282A29C6171D701
SHA-256:	949D85863B5F4139D94783A7DA389AB9C49073A23B976A75EB3AA88D38AB8153
SHA-512:	FF8B8245866495BDAE628FB9E07C72652049CAA38764AD65B54984F77FB9CE48A2832BE5F1AF55B956EBB5B1CDB7A15098B291FE7AD323D015AC651E82F66A58
Malicious:	false
Preview:	.........................Q{................P...........d...X.......0.......@...h...............P.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................p...............................................................................................................................................................................................................................................................................................................................................X...........................................................(...............................................................................................................................................................................................................................................................................................................\|...............................................................................................................................

C:\Windows\INF\c_fsantivirus.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xdc0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4644
Entropy (8bit):	2.881997416263287
Encrypted:	false
SSDEEP:	48:Efh8iOaT5SQWc5eMqylSddNIVJpQp7fg0PlaChB:mh8iZVXd416sp7g0tJhB
MD5:	AAFEC387E149B28F8B5EF57389D0EA91
SHA1:	8AF408176D78A6BA105AE94B50B517BA3B6F77A8
SHA-256:	793BD7859553F2F0C8DB0EA537D2A3454649236F55D0C6709416029172B41E28
SHA-512:	314ECA6D62D659305AF4A9189066565DF47EB0710C7F366F787EE351FF00C6A939840E7EB1B67CE94A59101CA31C9DB53DD677373497A6274A402E6B0EAD06B0
Malicious:	false
Preview:	..........................................0...........d...(...................h............... .......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................X.......................................................................\|...........................................................................................\|...........................................................................................................................................................................L...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_fscfsmetadataserver.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xde8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4700
Entropy (8bit):	2.9015351015470956
Encrypted:	false
SSDEEP:	48:cfSmXkr5jZPWUc5qHz5ygyiIJiBIoUNtGg7ap7fMUHn6h:eSmXkr5lPWUIiXU5ap7MUHnE
MD5:	334653419AF0F2C5B7C206347EA43EC3
SHA1:	B6C9123EB56CFB0C40113D391EE228FD02562202
SHA-256:	92E0F5C4F77C61222F339E3127D638209E1FB0FBB4292568B091F35CA49F679C
SHA-512:	30267287A9F60C5172F1116BC01AF30F3D0FA13C99CDE9A8C7E43575EA26257C7076E6BA138FA64D454C53B732B18A0560889C3D8C8B6BD4AA9A66736FAE445E
Malicious:	false
Preview:	..........................................T...........d...`.......8.......H...h...............X.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................\|...............................................................................................................................................................................................................................................................................................................................................`...........................................................4...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_fscompression.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xdc8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4660
Entropy (8bit):	2.9005209697059695
Encrypted:	false
SSDEEP:	48:2Vfs/VBrjhTGseWV8as568z8Lyr5XIQ6F8RCp7fl4G51LF:KeVfTsWlLQR/Up79
MD5:	BBAB8A98AF25AE27237FB5D9FB6EBD98
SHA1:	8FDC71106E925C494F81B047F4BC894AA5A37E3E
SHA-256:	70E2542A02656DDD596AAE7509622D4E525D6812BA8BD917B9598879DDF27859
SHA-512:	92619B9DCE95D01E2E2C83AC6F71B678E8A3A415170541F14766CB7910388806212B41F0EAED5DD7B66871B655D31F638BAB88EDF5610CC7090530552EDED337
Malicious:	false
Preview:	..........................................8...........d...8............... ...h...............0.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................`...............................................................................................................................................................................................................................................................................................................................................P...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................\|.......................

C:\Windows\INF\c_fscontentscreener.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xde0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	2.921997885373493
Encrypted:	false
SSDEEP:	48:GVfR8PPspxzVGWgz5r5CijBLUcPiyiY3IG9wj9L+wp7fSg8fMT:6R8s/zVGWgzrjBLU2X3JWj9L+wp7G4
MD5:	87F795D4E647D6BA714D61F1F7993AFB
SHA1:	E9E3326FE22094E3B386F42D06623DC69717D0ED
SHA-256:	768EEFDAE8BE8E52865CA3565791E31B9FAF6DE01BD010EAAEED780398380540
SHA-512:	E2A8E1A26A01B001735F81DD1FDB32E3CB4E3810F8C18038FA7934FA846CA10C38A8D513C31FFB5A4907D27D1985728B7DE8D192C3C5065DA2297F88F9332E59
Malicious:	false
Preview:	..........................................P...........d...X.......0.......@...h...............P.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................p...........................................................................................................................................................................................................................................................................................................................................................................................................(...................................................................................................................................................................\|...........................................................................................................................................................................................................................................................................

C:\Windows\INF\c_fscontinuousbackup.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xde0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	2.914368217731672
Encrypted:	false
SSDEEP:	48:cVfR8G4ogrxZgQmJW5OHRQeTmMpd2IDb2ORbIqwQeup7f5FSSnLGCDNpzdr:AR8GCrxZgH7R3TNSuRNU3up750Shfr
MD5:	DF6D27BA2EA915F4F9C57D4D294B2B1B
SHA1:	D36B2AE81EB862CF66F9918677F38052FD4E4BF6
SHA-256:	7E4D73674B3742069A0FD0203936763B7C655977135D28E601C49AF1BB2668D4
SHA-512:	6B18DAEA1660CFB13EDF45190C253243981753402CF37253B036D438807D0B700878334E2D6E37D7C9116F034248DE0F52FF3036CE7A8A9CA46E4A74505B8A44
Malicious:	false
Preview:	..........................................P...........d...X.......0.......@...h...............P.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................x...............................................................................................................................................................................................................................................................................................................................................\...........................................................0...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_fscopyprotection.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xde0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	2.916871707263143
Encrypted:	false
SSDEEP:	48:4VfR83VhRjs9NW+/g5C/60j8izaG6rIT3k0Qwp7fSg8fMT:kR8lHjs9NW46M8lBM05wp7G4
MD5:	1B13F244122AD5F1E251E20F79D81C8A
SHA1:	22662FCC09CDBA5C78D66351FA7C0115857D5D8A
SHA-256:	35D2D9AEF3AB2700A19851B62EA77FE25CEC2D04F5B14156D5D9214F7C0AFCFB
SHA-512:	E7FFF604C007BB4DA1AA9721A66682D0A06E9900AE3ED5615DED46C241D60FDD0C75BD3639413A4012F916BFEABE7B2312832D01CF3F1979D0933F74227047BA
Malicious:	false
Preview:	..........................................P...........d...X.......0.......@...h...............P.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................p...............................................................................................................................................................................................................................................\|...............................................................................................X...........................................................(...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_fsencryption.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xdd0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4668
Entropy (8bit):	2.884340130735275
Encrypted:	false
SSDEEP:	48:yfV8d00HkbJcTc5e5cdwmNIJsrc5p7f/3V:cq9HYctuPWK2p7/F
MD5:	7E33917A9D1E0CD9A82D572C55F1D403
SHA1:	EFDC2E00AE871888A2D1954B812D7F0C17871F4D
SHA-256:	C1881FAA82285BB831F540A0E0B6BCAA4FCF012D97C6DEF8937C723FC382710A
SHA-512:	F6CA9E8DCEB2FBCB77794D3014BFB0DC0434B3CC71DA0D23812C4625BE2C31EA39D9868687CF6287C7D0DAA7EEE79EAD9771CA0649FEAE92972964B4FA9BD8C1
Malicious:	false
Preview:	..........................................<...........d...@...............(...h...............8.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................\.......................................................................\|.......................................................................................................................................................................................................................................................................L...............t.......................................\|...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_fshsm.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xda8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4612
Entropy (8bit):	2.8756702354101034
Encrypted:	false
SSDEEP:	48:c41+mYPAdkkef5KSLSL5XIQcy4Yp7fqrL:jY5PASkoLQR/+Yp7S
MD5:	AC5CB43E255B48A7A0609620AD0281A4
SHA1:	398D73E1189B7B8CC0BC35F84F3E613DD2EFBF17
SHA-256:	7F43313849F3EDF32B35A74A6FB90ED85096DB8F39DFB303D172C5416EB92751
SHA-512:	8993530C9D17FB6AB5C327836A6275D68423E7FF799AE6205873AA950592DAA9CC79AB7C0FE0A0801E24A925F4C0E559C6B7B17F1CF91385D71B4A59BA9D6C5E
Malicious:	false
Preview:	...............................L......................d.......................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......p...................x.......@.......................................................................p.......................................................................................................................................................................................................................................................................@...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_fsinfrastructure.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xdd8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4684
Entropy (8bit):	2.9046434355923103
Encrypted:	false
SSDEEP:	48:9Vo9McTTeT/Tqs5m6rOzy18IDf75sp7fS/0D:bJceKPMmp7h
MD5:	9D88E903F597B445E1D9754C1EAC2625
SHA1:	21BF8B692F8945F165A6CDF0C0C52DD6D0C48E4D
SHA-256:	D6FF48EFBFD0C6AF2D5BC6ABC130CB21FF4F378A21E042DC515BB0EA430F434C
SHA-512:	F2E205405283735E4AF061F73DC08E4C3A5AF2AB3F661242920EA6451BD155C99FFD2332EF82DE4FABA63A951F5B60187543576F26406EFED027BD387BECC07B
Malicious:	false
Preview:	...............................L..........D...........d...P.......(.......8...h...............H.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................l...........................................................................................................\|...................................................................................................................................................................................................................................T...........................................................$...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_fsopenfilebackup.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xdd8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4684
Entropy (8bit):	2.922560309679966
Encrypted:	false
SSDEEP:	48:9t4y3Nw1FPcVrv1LG5C2darlFoqPY3IDbsFRbw9DarSop7fSg8fMf:Hn9SPcVrv1cdCw3usFN+Drop7Gs
MD5:	1F48BE3C0D64A2D1DD0A7BF25166B09C
SHA1:	1180EA473061B4D88D01B91E5D709D3ACC2B9841
SHA-256:	8594740024188A75B8A9D3FE64829FFD51A02EB751270C92E7D8522F22078A8A
SHA-512:	991E90AF334A069C95B4A13CF0B014A4B91596973F058577DA4BAB113D3D3E9D6991FC5CBF61EF3670D0D79115E4FFBAC98A98AA541082F7F62DD1AB423FD955
Malicious:	false
Preview:	...............................L..........H...........d...P.......(.......8...h...............H.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................p.......................................................................................................................................\|.......................................................................................................................................................................................................X...........................................................(...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_fsphysicalquotamgmt.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe00 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4740
Entropy (8bit):	2.919925272688472
Encrypted:	false
SSDEEP:	48:3Q82im1E+gSWWWntc5+NdwXijW4JWISyAaGwpijYp7fkapR:3Q8q1ASWxnfKXYWbdyAqpYYp77R
MD5:	7644FF2DA132C5A183FCB3287453B92A
SHA1:	15225CC2A67AE39123486B73C854F8E395D1B662
SHA-256:	830730654EBEA32572DF80A5CA346F20CC473A55E8259BA48E7EB4FA1512FABB
SHA-512:	6F8D948822945DBDBE83AD987477EA210BA2BF6786000E721F02C7DAE0428AA22C8E92D323C275022016495DF6BFE59B7CDFB01A75CE0A25EF90C909F32A0D70
Malicious:	false
Preview:	...............................L..........l....... ...d...........`.......p...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................................................................................................................................................................................................................................................................................................................................................................l...........................................................L...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_fsquotamgmt.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xdd8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4684
Entropy (8bit):	2.896945326469394
Encrypted:	false
SSDEEP:	48:14y3Rkp9czVxM7W5C7uYcKfRzQpddrbISyA68MWop7fSg8fMf:1nBkroVxMhD4HdyA3xop7Gs
MD5:	C01385E867A7699942394ADC947270B5
SHA1:	D40D7676B2073967668C4877B271923D685FD992
SHA-256:	B5410F105D594408532BA47265487E4B22DBF42C3922D6CE4F84AE4EAE4EBBCF
SHA-512:	D3E8CCA4C1B065725AD61C23E05DC706AA156B1AED7B95E520148C6613F061D86474D6A1DAE30CF0454689B6F33D8C42641EDB3F65ABE5FF9630A6DA65CFEE97
Malicious:	false
Preview:	...............................L..........H...........d...P.......(.......8...h...............H.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................p...............................................................................................................................................................................................................................................................................................................................................X...........................................................(.......................................................................................................................\|.......................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_fsreplication.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xdc8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4660
Entropy (8bit):	2.8875359314173985
Encrypted:	false
SSDEEP:	48:Dj/VZ/8hIGsDjW56paVUADrbIDbXRbsDiOp7fl4G51LF:D7V2IRj6RTuXNsOOp79
MD5:	065BA15447DDE038D2553FACF8F24ACC
SHA1:	14B8AA1E01EA9975EFC6E3051C52E10DC6FF23DB
SHA-256:	DF71828AE01DF6E76332B7F5F89D830B59B15493552520D519638924AF602308
SHA-512:	ACBB810A2D75F0C30CCA1FFA3599580A632FFAE506916D319630C60FF9C5DCF53A9EDE73AF876702720FF05D6E26F5D782D228F1B0C0D95117F8426C0EE5A488
Malicious:	false
Preview:	........................xS......L..........8...........d...8............... ...h...............0.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................`.......................................................................................................x.......................................................................................................................................................................................................................................P...................................................................................................................................................................................................................................................................................................................................................................................\|.......................................................................................................................

C:\Windows\INF\c_fssecurityenhancer.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xde8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4700
Entropy (8bit):	2.909392522751043
Encrypted:	false
SSDEEP:	48:13G4Hoc9B1k+W5Od0Mpd2IcM0Yp7f5FSSnLGCDNpzdDD:BGKr9B1kOnSjPYp750Shf3
MD5:	224E0970A364FEC3DF9A25D488F595AF
SHA1:	1CB6C524175F41F7D157FC7BFC099D939F0EA6DD
SHA-256:	F1F006C5AD7697952E727172C8F202FB226ACD6966A25EE322D77AEACDADE681
SHA-512:	319CCEC8E2A7FB7EC6BA148DD5AF48B632613C47B268F381B7D77920290B174AB79EDA624738CC9014A72A6BEAAF2FE29DA67284148D8AA945A9E7FFD9BFDA0D
Malicious:	false
Preview:	........................xS......L..........X...........d...`.......8.......H...h...............X.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................x...............................................................................................................................................................................................................................................................................................................................................\...........................................................0...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_fssystem.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xdc8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4668
Entropy (8bit):	2.8770223953374146
Encrypted:	false
SSDEEP:	48:tTI8cAVcbJgUWNqU526FyaesMpCddA3IsZByaJp7fHXB:tTPcAVQLWNd5ksojP5Jp7HR
MD5:	80F3E3FDBED755BF97AD7C0C92A411C3
SHA1:	4F48F4BCFC6C10E71529DF34BBCFD2DB9E88C35E
SHA-256:	4AA7FE4140443BF9D646D7A15A568B437E960EBE678EFFA34F3A610872869BE8
SHA-512:	B063FADAEFBD7E968D1A37584D22EF8174C0FCE90D1620EE9986A37C3526EE7546DF2D75D9D2DE03F7BAD7985AA3993A75C28C6F8604B4A8C3C47AAE055D6324
Malicious:	false
Preview:	........................xS......L..........4...........d...@...............(...h...............8.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................\.......................................................................t.......................................................................................................................................................................................................................................................................D...................................................................................................................................................................................................................................................................................................................................................................................................................\|.......................................................................................

C:\Windows\INF\c_fssystemrecovery.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xde0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4692
Entropy (8bit):	2.9169165922388363
Encrypted:	false
SSDEEP:	48:O8BP5thBjVrYs5CwZAvcO/EdG2Ijv6Avawp7fSg8fMT:O8Jf3jVrD+vcgy8Tvawp7G4
MD5:	E784B3D20A1BF5D68D3A0F5DB75C3CBD
SHA1:	132AD91E5D851D3311610D7BF5C6153F4E6717D1
SHA-256:	30E263324BAAC49FD6F29FC831ED1F8C50B2D988D0210CAF46ADA5D7C6F2EE2C
SHA-512:	22F1D932A601196A21A7AC0E6974A9F04FF1834C8795FE36294DD47AA25E30B6E0F8A083A0D09DBA6AA397B828F75A9E668A10B6CBCB0445765E2D37333F3A76
Malicious:	false
Preview:	........................xS......L..........P...........d...X.......0.......@...h...............P.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................p.......................................................................................................................................................................................................................................................................................................................\|.......................X...........................................................(...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_fsundelete.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xdc8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4652
Entropy (8bit):	2.889460449812872
Encrypted:	false
SSDEEP:	48:E/hgATcm0Fs5S8TyyeZ+LeRXIRC5yyeZOp7fuAyKDyj7a:E/hXV0aTPeEL0O4PeQp7upKDyj7a
MD5:	62842D278277B909D7296474359BEFE6
SHA1:	1F3C1B0EA291DA31D31254A4B53B0E61B103F26F
SHA-256:	D3D8993387C8C4FDC6CE48C21A5172088CC3C02CB37309B664887F68AD8A7819
SHA-512:	9ABFED409B3B011896F7495DEDA54C47E3FAC7C9F91AFCADB096F7B0ED6AA9CF77385D47B3EEC28D82BD2FD09DB52ED40CAB6E675BB77C62D157747F89205289
Malicious:	false
Preview:	........................xS......L..........4...........d...0...................h...............(.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................T.......................................................................x.......................................................................................................................................................................................................................................................................H.......................................l...................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_fsvirtualization.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xdd8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4684
Entropy (8bit):	2.898416037469911
Encrypted:	false
SSDEEP:	48:9roZhJTTdWLS55mAml2awJ2dY3IS1AD7dl2Pp7fS/0D:pgJdWLcmjwJ/3d1Afdup7h
MD5:	EEA64AF734106B76AC2278B331A31841
SHA1:	462B3953B003BEBB951B36D1FBECECD490F37F45
SHA-256:	CD0FC997693C0E8930EF23C06F3DCD809908AE79574423E0ECA8CD627A39604F
SHA-512:	4E399764410CD56BA2E263AA6BEB809159E777026C0F88EC4274221FC1D8E878D114E397CAA63AEDA3DEB2B8DF9A254EBA6A3D4B9DE35FFF35D00A6F7E15888E
Malicious:	false
Preview:	........................xS......L..........D...........d...P.......(.......8...h...............H.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................l...........................................................................................................................\|...................................................................................................................................................................................................................T...........................................................$...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_hdc.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1308 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6836
Entropy (8bit):	3.3291410814228533
Encrypted:	false
SSDEEP:	96:PKeTuqyf2ZWWDaQoeYn03e8uzN4e0MR/Awp2YhTrpsc1UVRcvjGPTKB:ioVZOQa2CpTkg
MD5:	A9F945F543792623864726E4A768D3B4
SHA1:	0627A911D380FFA6B73F0E08B07ACE4CE2001C75
SHA-256:	29423AD091072CFC3216EDDB50C47A97B5C100530BBF74458A5FA066D332E319
SHA-512:	AB193FDCA9AD3F561D7BD99638F623536AC71795AA8E71FBAD1469CA37F01CBDD11AEE9151C0D94E40E2EE41F2DFF09D057E2ECE594BF3E6AB2402DADCB8CA1F
Malicious:	false
Preview:	........................h.......L..........x....................... ...D...h...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......h...........................8.......................................................................h.......<...........................................................................................................................................................................................................................................`...................8...................................................................(...........................................................................................................................................................................\|...........................................................................................................................................................................................p...............................................................

C:\Windows\INF\c_hidclass.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe38 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4636
Entropy (8bit):	2.9547564423456025
Encrypted:	false
SSDEEP:	48:OsvTnPf6wA/tv5ffMQ8IAtc6QxVHVCoDbLxbJ3MLapwJ4pJ:OsvTnPiP/oLftcGOLtJSxqJ
MD5:	7074DD722C08C381E42B898A58F0545A
SHA1:	D71DED5C43EDC2870AA866130CE3F5A370B970D8
SHA-256:	603DD28B7590D76200B5D3FA117F5CA8C4528A3792BFF13ECC4C263F817D3A4A
SHA-512:	A855F33C18B8A3071EB7F5447A46386277BBDE162B1A09D5723B6BE5F20F528F47E8775074037B711432E1726FE30797AF2F1CBFDFEDB6C19D7197DE9E472911
Malicious:	false
Preview:	....................8...h.......L..................8...d...........X.......8...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......(.......................................................................................................................................................................................................................................................................................................................X...........0...........................................................................t...........................................................................................................................................................................................................................\|...........................................................................................................................................................................................................................................

C:\Windows\INF\c_holographic.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1390 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6228
Entropy (8bit):	3.3709564515390116
Encrypted:	false
SSDEEP:	96:S3QHwQZUC8Deflu6G1vicIWa2L5+8XXZhS2z:8G9fcs0ai3XXZp
MD5:	152AB5E3A033D84527070122B2E8D63F
SHA1:	C9B29C5D493E84877C00446DE5F418DA749A33F3
SHA-256:	3DF0988B395A71E46CD2F93391810D404820C64B93D9FAC48BF2C5AD14D1ECE7
SHA-512:	368A1B15EC6AB7CF807D2233A13D235C8105F1C7FCC71889D7CF2DBF60A4063346AEEF5DDF8338C5CA42FFE65BC5CD7B4B7EB6DD86D26CEF6DAD986EDB48946D
Malicious:	false
Preview:	..........................F............................d...............(...(...h...............P.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......L...................................................................................................<...........................................................................8...............................................................................\|...x...................................................\|...............................................................................................................................................................................................................................................................................................L...............................................................................................................................................................................................................................................................

C:\Windows\INF\c_image.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1800 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9220
Entropy (8bit):	3.5025172783089342
Encrypted:	false
SSDEEP:	96:zHMea2IjjcOf43fkvTqakxTufwylcieE7+6MoYRaffarVoTiG5qnT65OCuGSa/Bg:zqf4cLqTFuftnMgkiVuE/BVOL
MD5:	9C3E1484A2D14966790CE1D3684FC697
SHA1:	AD144D01738CE6AE67257D65ECA5B503D9D29702
SHA-256:	FA29ADF4AB871CAEED882DF9A4F8A51C0D72F50A2118AF14386D90DFF5E65645
SHA-512:	5CBCD12757D9DCBB7351D5D26EBFC6DC8D03415BF79CEF455462BA643A3330A348FEE235F9ABA23204A1A0E5B82055EAE787E4F3060BA6A62C141ED9691509CE
Malicious:	false
Preview:	........................../................p....................... ........ ..h................$......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......L.......................X...........................................................................H...........x...................................................................l...............@...........................................................................................................d.......\|............................................................... ...............................<.......................p...................................................................................................................................................................................................................l...................................................................................................................................................................................................................

C:\Windows\INF\c_infrared.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x11f8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6148
Entropy (8bit):	3.2795546843910706
Encrypted:	false
SSDEEP:	96:NMxx10DVMVd0P0FrIu05NJqdI3KzO+d9l3ZH++:N7kkY105F3KB9dZP
MD5:	5DF4A1CE0ED7CB0C34A73457539D1BA2
SHA1:	C2892B7E1F969E69E56E296EE6EC3F05FC3F5D12
SHA-256:	155671849BBB6EC1F3E5BE45AA30DC6A5EDB088D256826EB27CF171B19825D4B
SHA-512:	702AFC2F4D5476182C45BDC9350A7E84D3E8BF328BBA0D516EDC02A4759809C127323C0AF2E85128B27BF562628845DCF8182F5CEDE44347194A07ADB82F4249
Malicious:	false
Preview:	........................h.......L..........d...................8...........`...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................................................................0...............................................................................L...................................................................................................................................l...................................................................................H.......................................................................................................................................................................................$...............L...................................0...............................................................................................................................................................................................................................

C:\Windows\INF\c_keyboard.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe90 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4796
Entropy (8bit):	2.988970146106582
Encrypted:	false
SSDEEP:	48:ETX9pz/1lL8Vti4E5qIA17IDmMurnZIDbpRbWl2Ep7p4Qg9:Ehpz/1l4V2S8AupNWQEp949
MD5:	A9E223B3E5EE4485A7E2379E0D1DF7E3
SHA1:	63AE560044041DA5502D5131997DFCB6F1CDE298
SHA-256:	12D1832028789CBC9D09570F28F37D3228A17F319B69751F943C6EC80384FFEB
SHA-512:	A7ADDD0C57491C0B8EE9DEE3AA71A4E49CFC3D892678E6D4B3EC849257368B169B403647BE43BE4013CA49FBF970DC43FE71625BE2119F1C29D61FA463759D2B
Malicious:	false
Preview:	........................h.......L......................d.......................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................l.......................................................................................................................................................................................................................................x.......................................................................................................`...........................................................$...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_legacydriver.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xde8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4564
Entropy (8bit):	2.892966543792023
Encrypted:	false
SSDEEP:	48:rzSTw8+wos+5f3sKIKhEuY3IDb+CRbe8R18BkFR:HS8w21m53u+CN54kFR
MD5:	3EB9EBE4652DAF976E7F55F0C4E871A8
SHA1:	FF9608DA24ADE3D1CF66BB9390D80A307D695350
SHA-256:	E04DCB17F4EBECA8D7C12E7855FC27DF93A8ACDFF0907E94237710F3340E7835
SHA-512:	3E727BA452A567AAA9F788E0B04FD6AFDE6DC4EF2C9A02A8B699122EE18B2EE908B7EA0591AECF0D1A62AC40BA9FBC806EA43B19E3282C5EF97F6E4FB2114429
Malicious:	false
Preview:	........................h.......L..........X...........d...X...................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......0...........................................\|...........................................................................................................................................................................................................................................................................`.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................8.......................................................

C:\Windows\INF\c_linedisplay.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xc38 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	3988
Entropy (8bit):	2.6154837301773535
Encrypted:	false
SSDEEP:	24:dHTr+lxLCc2Xl20L5Ac6pAB30g91mReLGDrGMewaB7pwHA+dIT2Mf:dTrMLCPXl5D0x6g/hXCyMf
MD5:	B8B51A4AEE4346F0BAD7617032D760E6
SHA1:	67E30DC2F09354F530D45F523B8768DD5D0196E1
SHA-256:	863FE3A754B60B10D5DA815350609DB08F7C886701592F9578E15AC1ED1742E0
SHA-512:	F1157E4986AC16F2C32A8CA89291A44BFC889075FE2A1836AB15F5EFDF121069852A807014636928E162B7C6E705BFEC9802D8F42D31B44845A56E50900E9841
Malicious:	false
Preview:	....................8...Z.{......n.................H...d...........@...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......P...................................................................................................................................................................................................................................\|...................................................................................`...........\|...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_magneticstripereader.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xc20 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	3948
Entropy (8bit):	2.6059319582519924
Encrypted:	false
SSDEEP:	24:+l3+6g4jAdKic6gL5Ec66SFS/bLhLI8vLsvrAEQ2ew4FS/5pwH9ITcD00H:+l3T3jAdK665XHMihk8TszAE3W3CF+
MD5:	A1679832EC0DF8D720436E888B85ED8E
SHA1:	B859A62478F19727AE70835CD46A25CCEC201454
SHA-256:	141CD6B266D7524E5BE1A8656C83971769CCF0ADF65C4BC4829B67E5BDFDF074
SHA-512:	92FAA72B41CE37753502D3C7641FAB575C08DB9E094BEDE5DB1EFE6A355C90D1392E36F0D9F7F54F8B671CF1B8EC678B7B2C7C61748405D84214982609952526
Malicious:	false
Preview:	.................... ...Z.{......n................. ...d.......................h...............h.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......<...................................................................................................4...................................................................................................................................................................................................................l...............................................................................................................................................................................................................................................D...........................................p...................................................................................................................................................................................................................................................................

C:\Windows\INF\c_mcx.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xda0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4532
Entropy (8bit):	2.8734381447283908
Encrypted:	false
SSDEEP:	48:N5twxkRWOL8h560EJ4ebarbIX0llX6JxYp7h:N5ukRWObJ4IKryJxYp1
MD5:	2030B305BC7F08224DB22F23DBD3B8A1
SHA1:	DBBD8EBC90CBF12562A85E6F83F4F5284530AA71
SHA-256:	4C0C5A7B8FC617327893DFCE8646C8508B7F4720678A8D5691A65EFFF451B210
SHA-512:	F92609A82040EE870A1F91CE4993EF5CCA96FBF2AB938668D83C8197BF0B40B663229B4949DB293E2BF30C4D6F980CDB878DDC43FDBE429BE89278889B0FA272
Malicious:	false
Preview:	........................h.......L......................d... ...................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................t...............................................................................................................................................................................................................................................................................................................................................P...........................................................,...................................................................................................................................................................................................................\|...........................................................................................................................................................................................................................

C:\Windows\INF\c_media.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2108 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-GB
Category:	dropped
Size (bytes):	13156
Entropy (8bit):	3.6404286718865406
Encrypted:	false
SSDEEP:	96:cJOzh59kdSkEHc5Xb3T8aBVPfylP0zYkJ12aBIN6aCU+lVwyvVATCG5qylmqB9cT:7MB5XP86yl0Ewa2blJSZmXx7p
MD5:	38F12CB00007D784D5DC86D98396D7DD
SHA1:	1C6AE3553D077D54D95AA0C36043E7B0D7D111E4
SHA-256:	8362062F9FE600EB2C48CF112588F76D6851B549CBAE8C19B2F5FED685CDE92A
SHA-512:	540D3C05E4224CF38C7C26F697AF7FDB019719004307D4E3E3991206E0F1089083154B91043B5F97B6AAE36720DC46FC2C8D611DF090F3DF2EAA427348DA7DA7
Malicious:	false
Preview:	.....................!..h.......L..........x ......."......."..,... '......@-..h...............`3......C.:.\.W.i.n.d.o.w.s.....e.n.-.G.B...................................................................................................................................L...h...............X.......................................................................L...........................................D...........................................8.......0.......................................................................................................................D....................... ...............................................................L...................................................d.......................................................................T.......\|.......................t...................t...............................................................................................................................................................

C:\Windows\INF\c_mediumchanger.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xee0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4884
Entropy (8bit):	3.0331234388926918
Encrypted:	false
SSDEEP:	96:hAyN/W3QE5WlMa5HpQrav6OgtXpQplPVB:JRiE5HaUPT
MD5:	22A867E1D9E4C1624345232449498D37
SHA1:	E76CD9800DEA3A9077B751D1638362F327941F95
SHA-256:	111C7D059E3A8976836954BD186B703D4E926DE3FF8F1EB97A6075B065956577
SHA-512:	DB09BD41B6B841DB61CA7FC1248F7DD5FA33742752966080D868231FB27C00F1BD6D81279ED7FE26AAE25E4F9BBB304D812655805F7666A0CA582CF22FB73ACC
Malicious:	false
Preview:	........................h.......L..........L...........d...P....... ...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......\|...........................L.......................................................................h...............................................................................................H.......................................................................................................................................................................8...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_memory.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xdb8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4460
Entropy (8bit):	2.8689238927473673
Encrypted:	false
SSDEEP:	48:+mjLtlIuFRLS5fAlalzrIIjddOIDbrRbt+a2AnhTl:BjLNHdlgr3j2urN4gh
MD5:	5F27873A05AF0AA14ACA4C5A209A058B
SHA1:	271C3C19737B8A96A9E10D40CC955C7F26B411C1
SHA-256:	2E2EC08293DD4E199083E3E402DB47848CE0DC872C2E5AD806BACE215F6E5392
SHA-512:	BDC00C06D2CDC0BD575FD04871BCF0F347605CFA513092763F019C701D003EE57638B29A1D63E12CB5758BDCAD6630979F16B6841BCD6A2FA16E4E2CF85EC516
Malicious:	false
Preview:	.........................F......L..........(...........d... ...................h...............h.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......$...................................................................................................................h...............................................................................L...................................................................................................................T.......................................................................................................................................................................................................................................................................................................................,.......................................................................................................................................................................................................T...............................

C:\Windows\INF\c_modem.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xde8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4500
Entropy (8bit):	2.885132393963848
Encrypted:	false
SSDEEP:	48:qIw3E67KUpO75fVyAwIVajo9xiAc8YMv9:738086GCJ
MD5:	179B218DB22448FA0965057CDB9BDEE9
SHA1:	62831667BF5B449AEAE80F0F96ACB28BEBCF15FC
SHA-256:	EF0A009381B880135747CB8014161051774772448F61D6955753FEA85448FBF7
SHA-512:	C43DBA6066BF5922E3C55C3EF86926748D3B52FD26D760A2B9107DE11000A93713D287A6D8EBC411A11DF5682F8AF8573C816B6807C8741DF70FCDDFC5A819DD
Malicious:	false
Preview:	.........................F......L..........T...........d...H...................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S....... ...................................................................................,.......................................................................................................................................l...........................................................................................P...................................................................................................................................................................................................(...........................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_monitor.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1318 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-GB
Category:	dropped
Size (bytes):	6884
Entropy (8bit):	3.362329319920909
Encrypted:	false
SSDEEP:	96:262X44AX7cFOM9VD3t0MGUVTCFGaTQ1wOgtiw+6fz3VfANNWuyfJ:9VoD3CxUV5aU4+0qNWus
MD5:	7EB81073EC56B47E050EBAF87BD4C9A3
SHA1:	4C2DC25B6B81FA4B97C0C7A3BF183E8BD259406F
SHA-256:	CC23D886705408DC073003B5C227E738E4DF59E8E47E95734A3F5394BEABFD91
SHA-512:	7CC852CCB63EA63418E121D361A9ACF8416058909D3A814F1D38FBA0526BBC1816A0EAFF9396443C05848FEC7787C4FC28079394F79683CD441D9FD293BCE667
Malicious:	false
Preview:	.........................F......L..................................p...4.......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.G.B.......d...................l.......4.......................................................................\...........................................................................4...........`...............................................................................................................................................................................,...............................................................................................................................$...............................................................................t...........................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_mouse.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xec8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4900
Entropy (8bit):	2.9958774077129315
Encrypted:	false
SSDEEP:	48:vEnJRkOnIqV+ljtiC5qez3MI9QdMBayY3IDbYRbpyK6RYRp7B9mlgkN:vEnJRkOIqs9fz3MCIV3uYNpcRYRpl9CN
MD5:	89C31CA6BDFD981CF61E5B6ABC60A2E0
SHA1:	F635C41898281FF1105C425A5C51A08B76480E8B
SHA-256:	EE2137BB548E944B7375A362BA34CF51D4A316A3D11282C4E224C0DD8D8ACCCE
SHA-512:	DE011DB867CFDE320993D5319E393D0534C202ADCAFD7D40274F51FB3C1A7EE9C8B5F5AC8628B7361C2EFCD9AEEF0E5F4406713632EE9AD4FBF5735CBF8151F7
Malicious:	false
Preview:	.........................F......L..........4...........d...(...................h............... .......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................d...............................................................................................................................................................................................................................................................................................................................................`...................................................................................................................................................................................................................t.......................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_mtd.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xd68 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4268
Entropy (8bit):	2.805048899281571
Encrypted:	false
SSDEEP:	48:6JtQUWg1OUj75fAtpKIvidacoDbDxbQak4sV:6jmcgidJODtSV
MD5:	ABE21128825BDC02DA2E5ED277CDA024
SHA1:	6F6080662FFF34A49749ABF92D4BCC0DC4D44345
SHA-256:	4EFF1F455F37B62B24F09AB7F2202D9EBAAEF3C02BD526EDF5D40B52D433B872
SHA-512:	F88E1702125D932CB4280171B36335CD0CB0B4F32C979489C5F418CE217C3BD053CDF4C2F712F6735844E4FA9778151B8F8E9903E3FC3929A1FC68D9FD22C42C
Malicious:	false
Preview:	....................h....F......L..................`...d...........X...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......................h.......................................................................................................................................................................................................................................................................................................L.......................................................................................................h...............................................................................................................................................................................................................................................................................................................................................................................................$.......................................................

C:\Windows\INF\c_multifunction.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xda8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4396
Entropy (8bit):	2.848876693634018
Encrypted:	false
SSDEEP:	48:wYUKIk8vSW5fARfI8sqIDbyRbZTMnD18cDt:wuIYRfDxuyN9MptZ
MD5:	15A1470BE7D51F9DD993EC9E0B02EDE0
SHA1:	82510D8B1BDC25A5A00037614F612B08FC94E126
SHA-256:	35A5BCE8FE4E152D4DE34AC9AD13FEBF19FDA5236C594C9B2822A25CE5C5F5BE
SHA-512:	EB1A99F03333128299A786F5179034BC54888AF14A1BE5A082A6CFC58398DD5DE954E5CC9CB0A5E0C66D015B6495614FBF88129AA29CEBE0E09F3C0E8118FAC7
Malicious:	false
Preview:	.........................F......L......................d...................p...h...............(.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......0...................\|...........................................................................................T.......................................................................................................................................................................................................`...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................8...............................................

C:\Windows\INF\c_multiportserial.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xdb0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4412
Entropy (8bit):	2.854144315443904
Encrypted:	false
SSDEEP:	48:gvVcWli5RI+5fyjq2cFoB7koDbxxbH/Pqknib:gtNYfOjq3eAOxtXqkg
MD5:	A23049F4A01F23D433018197B5C5EE20
SHA1:	8A928C2C37B4665862A921BB2404E1753D1A4EC9
SHA-256:	0F294402DB786A863EEB4EC5285CAD6F9B9F07C324F638F2AC10545FA6C40E86
SHA-512:	650DB17872F83BDED165BD6F6B8BFCFABA50CCCFDF0F221E345788975FBE68C117822DEA005DDC8FD5999B445552FD2D32571C4DF7E60AE73F045652B3A4B611
Malicious:	false
Preview:	.........................F......L.......... ...........d...(...................h...............8.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......4...............................................................................................................................,.......................................................................................................................................................................................d...........................................................................................................................................................................,...............................................................................................................................................................................................................................................................................................................................<...................................................

C:\Windows\INF\c_net.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1550 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-GB
Category:	dropped
Size (bytes):	7412
Entropy (8bit):	3.4401368597495345
Encrypted:	false
SSDEEP:	96:uJdaioQpdr058wt+hGzo8TO3tNVU3AsmF+dxNIt7LjZC9Kcb:uv2z+f8yyOFe4Cl
MD5:	B3BA4C98AEA04092418DC4B66C7A1DCB
SHA1:	D687D16148C0153E544B78778D4C447A13882B40
SHA-256:	0D5B96D1A30047D01C8C6F634A527423215837BEC9B2A3588DB04437EE765AAB
SHA-512:	EEE9E9B22272823EE93B691F026C2B642FE8F89FB588AC3297309D4DB9E221247A134B81A4FA78B5CA0C6B3827AF7C2F585358FDB38DF4F841899CEC5EE351F3
Malicious:	false
Preview:	....................P...../........................H.......8...................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.G.B...................................<.......................8...............................................l...........................................................................<...........................................................................................................................................................................................<...............................T.......$...................................................................................................................................................................D...........0...................................................<...............................................................................................................................................................................................................................

C:\Windows\INF\c_netclient.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe18 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4604
Entropy (8bit):	2.8983722639880494
Encrypted:	false
SSDEEP:	48:tfbWglag1RhS5fn0C/cdIxTsaLTsLtOOXQZoDb1xbD7OLIWiFMd:FbWdsM0hUQWO1tmLCmd
MD5:	AAD925663B8BC7A745102BEA2279BCDF
SHA1:	C2F310BE923B6E656212A65295FF891336F2EC13
SHA-256:	468943B7298F03F969B90D6A1FAE182AA596718CC56D0E0ADB95FC509221C20A
SHA-512:	1F9392194975DD6DF3FAB9D8F02A7DBC69D918A576C4AB32B74656826E32D1463C99809F453DD703E79C25125AC07EB4D6B0A69E6741906BBDD229F4E2934927
Malicious:	false
Preview:	.........................\............................d...........8...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......(...........................t.......................................................................................................................................................................d...................................................................................0...............................X...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_netdriver.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xd88 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4484
Entropy (8bit):	2.867252032758547
Encrypted:	false
SSDEEP:	48:AutN0dmIo5mPBVPdYWoDboXxboJ7zEp7l4GZ:Azdj5LOoXtoFEpV
MD5:	3B43993660B0B4B3EC548BEC3215E769
SHA1:	ABD135165C693B3331B00266DA6CE4B21B48DECE
SHA-256:	E65BB787FF6AB68635A1E28B789A2535720184AE3D3128320CBD0006499211CC
SHA-512:	8091648182E1848DF54E65461FC8F2A4B539F6CE798B381BEE1F24EC64B4BF5BA6316327C9E8355D54E80FE0E22C2396C943DB9DFC0FB35058E499715812A030
Malicious:	false
Preview:	.........................F......L......................d.......................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................`.......................................................................................................................................................................\|.......................................................................................................................................................................T...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_netservice.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe18 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4612
Entropy (8bit):	2.926881056092699
Encrypted:	false
SSDEEP:	48:69fcgUZm0RIOk0SXjJ5fddIxTsbLTsSOOwjBoDboXxboJ7slEPd:CcgUVTBkdVfiOoXtocEPd
MD5:	827B63760237511FA35B3147AD00FA0C
SHA1:	D876F0D580D9EF16F8510F9FF6EEEBEF7C549481
SHA-256:	E39C54E28ACEA2DCB296E117F78D221402C3DBC0CFF97AD1F3F1A5355065956F
SHA-512:	C23A6DC7AD7A19909981A92603798747A734FA5E153E6ED75CC8F087AEC2DD039B2ED2A9FF294B25880B9D2C4120E13AE9941705373CE8731244A02E55488B71
Malicious:	false
Preview:	..........................x........................ ...d...........@....... ...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......,...............................x...................................................................................................................................................................h................................... ...............,...................................4...........................\...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_nettrans.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xeb8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4820
Entropy (8bit):	3.0072974204321974
Encrypted:	false
SSDEEP:	48:3flw7vuV4Zz6tcI2W5f+ZdIxTs/9LTs/e6QxP9AOOA7rboDbkxbI7M71NzFxt:P2vuVo6tBszrrywOktrzt
MD5:	121F0143671A78BA34A48F0F7CC6CB7C
SHA1:	023A3CBF83408A40B1FAC9C1F5C31B70FC79CDE5
SHA-256:	FF96BC5078F85A602280E41D1D3D2358516ED892C552998B947AA78E22834006
SHA-512:	A98FD1C60A64F5AA18E5254435EA0F15D2F96CF0FC0457922B3F86355E0CDA374CD9D543DB0752ACFA5DFF4844962ABADDDD4D91A03B3ECA210910BA7726C5A8
Malicious:	false
Preview:	..........................x................$...........d... ...................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......(...................................t...............................................................................................................................................................................................................................................0...................................X...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_pcmcia.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xd98 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4372
Entropy (8bit):	2.851246218461591
Encrypted:	false
SSDEEP:	48:+yOl1zvpyhVS5fMgIQoWIDbGRbUgvPnGoSy:t3SvBuGNUoPV
MD5:	33D3C700D53CA78E6C38AD41BC9E5961
SHA1:	B55F6217ADDE05E4A885B85B83864CC0ADB37353
SHA-256:	4CB9D992DA0794D2FA32A663E5E39B479C5700318EF2644286C59F1D542A3D91
SHA-512:	61C3A6BB09A924F3020802D8E24E9C9DEEDCB11EC7E10A9A6344E71371F1B799A464C11818DE0CC4EC2FFA5FFC831A62A14AE72733FC0FF94B80859EDA9225E2
Malicious:	false
Preview:	.........................F......L......................d...................X...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......$...........................................p...........................................................................................................................................................................................................................................................................T.......................................................................................p...............................................,.......................................................................................................................................................................................................................................................................................................................................................,...............................................................

C:\Windows\INF\c_pnpprinters.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xdd8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4500
Entropy (8bit):	2.889532021489689
Encrypted:	false
SSDEEP:	48:rI+uJMAakYTir5ffzGo1erboDb6xbwIRSAYfB:MRJEVTezGqGO6twnfB
MD5:	5A6BCDDF8FA42CBEBC92092CFDCCECAC
SHA1:	C356734571B8E0A6817B81C8FA5F83191B2336C2
SHA-256:	E79D721E0D7FC0E343B038AD8FFED550F83B45902F12EC04528BC89962C224F7
SHA-512:	111FC56FF35AB80EB59F1B44FF1E23F200FC821CE63E2976F625AD79B2D4C040FCF460863EE1296D962059BAE4C81CAD6D8CA223E39B8BE3E9130291D3265CA4
Malicious:	false
Preview:	.........................F......L..........D...........d...H...................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......,...........................................................................................................................................P...........................................................................................................................................................................\.......................................................................4.......................................x...........................................................................................................................................................................$.......................................................................................................................................................................................................................,...........................................

C:\Windows\INF\c_ports.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xdf0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4508
Entropy (8bit):	2.889578265151549
Encrypted:	false
SSDEEP:	48:6oOU9l6fW82S5fHXUQIo9OdKLjooDbqOxb8gkuS8el:vOjO8ZP99OdKLkONt8TD
MD5:	76832AF8E8D6F219D2F2A53C419FAA11
SHA1:	FA341CBC06D3BC4FBA8A9F523D94EA67C238E2A4
SHA-256:	7058B316A7D32D6E066ED48813F3A0CB0C419DDA3AD9FD4FE6DB5C037B769949
SHA-512:	924FC5980A3999DDFE05D686173FAD7E8F04533CD229861F8C7F432F72CBE3F7570077A819F745ED818D4E99124FC69BF15B4F0AC2ED1FAC289E8F9DBF6973F6
Malicious:	false
Preview:	.........................F......L..........`...........d...P...................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S....... ...............................................l...................................................................x...............................................................................D.......................................,...........................................................................P...............................................................................................................................................................................................................................................................................................(...............................................................................................................................................................................................................................................................

C:\Windows\INF\c_printer.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe58 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4668
Entropy (8bit):	2.9371793697101616
Encrypted:	false
SSDEEP:	48:I4ERbxyYw8O0i+ir5fQDoI9yJVo9OaJ5hjGDJpd:I/b8Pl+VD30HaBjKPd
MD5:	37D9DA7416832EE8A82B51F59E9360C1
SHA1:	E05F1FCA7C8297ABF36114B4D6B7F79CF64A2129
SHA-256:	1AEE4EE9D0F8A2CB1520FE9D12F28D276F96A566793211FF34517F076B244B58
SHA-512:	852C887E8925D92B6AF3FE1AFC1782D50E6744B762C630C91671BE48719B0C557A628570112B8AFE019DCEB3A723E0BFBF5B84AA8BB99DF379966EE18D617AAD
Malicious:	false
Preview:	....................X....F......L..................X...d...........x.......X...h...............8.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................p...................................................................................................................................................................................................................................................\...............T...........................................................................,.......................................................................................................................................\...........................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_processor.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xfa0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-GB
Category:	dropped
Size (bytes):	5356
Entropy (8bit):	3.069255886621116
Encrypted:	false
SSDEEP:	96:3ERG+gmJWAQeS0jrOqtTJqbylc8Vze8SWtpJO1:UXJJQzeJqulc8ReBWlc
MD5:	311F130D8F98B8C09F0A53462ABAFBBD
SHA1:	1A22F6F24F4AF6429E1FA3CA8B7A1CFD799C9170
SHA-256:	FF36E7FB78CC765D1CC4E8111DC8412F45BDDD6F7440C51ACC7143E8DBD8360F
SHA-512:	19BF9D08CE00A460971B14DE55C69142A6A3751916122EC3E4AE419800A25E5ED9FDF80FD15637971FE1E75F1C02EFFD7F2CFDDE21724BB63727D851AC0823F0
Malicious:	false
Preview:	.........................F......L..........................0.......8...T.......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.G.B.......t...................\|.......D.......................................................................h...............................................................................................................................................................................................................................................................\|.......8...............................D...................................T.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_proximity.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1018 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-GB
Category:	dropped
Size (bytes):	5340
Entropy (8bit):	3.171366185143694
Encrypted:	false
SSDEEP:	48:cig1oogUjc5OCGLEddmow2Czk6QVfVHVMLNQTJqYJwm9C4l2Q:cn1oKWGLE+/2CzkcLNeJqYJf1
MD5:	6058D8FFD81E0643189491F58CEDBD5A
SHA1:	01F2340918BF4DA6AA6EC2FD5AB3A6F9E60D2DD1
SHA-256:	946E096AAE47A20076274E09EB9858637494D6DD720AFB9B604D688F0AFE2A21
SHA-512:	60A1F69FCF9B60442DB8F8733D9E9BAAEF701878E95060EEC01EDB243741E52170E985DA6CDF06BA8A8CCECC87D87A6C6245B55A403CE47464520D24E970D7C1
Malicious:	false
Preview:	........................u;......L..............................................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.G.B.......................................................................................................................................................................................<............................................................................................................................................................................................................................... .......................H...............................................................................................................................................................................................................................................................................x...............................................................................................................................................................

C:\Windows\INF\c_receiptprinter.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xc10 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	3940
Entropy (8bit):	2.6148911007874656
Encrypted:	false
SSDEEP:	24:lf+usng8CTrSiEaL5cc6nSPMztV8vLsmvrAxPeCMzdpwHyITSYmH:lf0ngLTrr5fpPMzX8TsmzAB9MzMNe
MD5:	8F6ED014A474ECF8F781F5D603C3DEC8
SHA1:	6B49D407D93DC7F6D888AE2B8D0E0EE36CF44D3B
SHA-256:	AE705E094BD832650E74AABC386F4FBF6B3018A8FE0C1B3634FC9E7F4B4C6C58
SHA-512:	92B41D9D3AC9BD13244FB8DD6AEB8BD51A308D01E11F81C8AD4C96BD8193994B5CBD47E711F39DE31886D04D81629361ED808991431787957006DD8D0F0BB661
Malicious:	false
Preview:	........................Z.{......n.....................d.......................h...............`.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......,.......................................................................................................................................................................................................................................................................................................................\.......................................................,.......................................................................................................................................................................................................................`...............................................................................x...............................................................................................................................................................................................

C:\Windows\INF\c_sbp2.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xd90 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4356
Entropy (8bit):	2.846103285341237
Encrypted:	false
SSDEEP:	24:Pl14N+uoVltsI/Qe1cWIL5cc62ojNu4I0x4KLDq4I0yb+4KybDjeepBOoG68UB8f:c4PtsAxS5fpojTInwBIDbhRbDjAn68Se
MD5:	4B46F9A0F64D79C5EAE84A57B84CE77C
SHA1:	4FE056AAF8007CF8AE324CE93657DABD7F2556A9
SHA-256:	5F890C2D4852F66F3F723D4A18D8D6D20B55EE80F9C45049B0A0231EB151BC95
SHA-512:	E490F5B86F3610B54BE7574BE11918D0ECA9635D708FCF8935DF7F222623EF5FEEFEEB9B4DFB2740FEF72D50A2A7C633B5E41DE6DD9F653E714C40AFF5AEC488
Malicious:	false
Preview:	........................u;.....l.......................d...................H...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S....... .......................................................................................................................................................................................................................................................................................................................P...........................................................................................l...........l...................................................................................................................................................................................................................................................................................................................................................................................................................(...................................

C:\Windows\INF\c_scmdisk.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x11b8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6244
Entropy (8bit):	3.251245235032522
Encrypted:	false
SSDEEP:	96:u/QVX7+8BhzMWuHSsivuY9Vu0XNU3dsPI/v87mW3aD:u/GwqdzRyvX8N4
MD5:	3F04B425B0793468416BBDA50F0E97A7
SHA1:	99B4BF7B78745417D2219F4022BDF819BAFCDC80
SHA-256:	A267C5440FE49CA37C9524FF9924E91FCC2D8D7F6D674340969C415FBEB6E5F9
SHA-512:	1D23C13403D0253C564C0411D9FEE3617ED350A6921A04CB6FB634AE328AF3AD4F614549C825F73796F571C2DC264B13A3F8EE0848DE6D4D21A5CFA403354BAC
Malicious:	false
Preview:	........................u;.....l...........(...............H...h...............h...............`.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......H...................P...............................................................................@...........................................................................<.......................................................................................................................................x...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_scmvolume.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xdb8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4580
Entropy (8bit):	2.8740878722079137
Encrypted:	false
SSDEEP:	48:KpfPlcFUOy7F5O9A6J2iYTBIDb+CRb0nKV2p7sXQ:Kxl8y2A6wiYtu+CN0ns2pQg
MD5:	E5780D85A6FC956D13A055993ADF526F
SHA1:	F81E1A47061BAA7530DF6EDB456538320C8A51CF
SHA-256:	32904521D94E747301597C082D08739453BF4119687513B477649AB6C5F01C80
SHA-512:	B75BD9A843213020F8AD40DAD13ACCE32CF85675F0F1FB40B91D4D9C512B006887610792FE6F197FCF1B8DFC9F42F86669DAE837CB37277C069F499C41CA9ADE
Malicious:	false
Preview:	........................u;.....l...........$...........d... ...................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................h....................................................................................................... .......................................................................................................................................................................................................................................\........................................................... ...t...........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_scsiadapter.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xee0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4940
Entropy (8bit):	3.021579915826753
Encrypted:	false
SSDEEP:	96:fZArBATV5Ge8aEpf7jAXuZNYTpl8VmeSGIZ1X8N:farCjEGf80js
MD5:	6983D093A48BF55E1B96425BD05D8418
SHA1:	089E7AA1EB92F716410232F11CFF11622FE3468E
SHA-256:	1AC6A48EAD76CEB19DBE2B53DB24C48A6184FE21D412B8232BC13A7F6F5FBAA0
SHA-512:	4C9D61636281FDC9EF7648D4CDC11639E7C29DAF78645019088C6B103B172473693A9F6DF14C9C0E86933FE07289DB53B62C5F417569641B0CEC718C668AC901
Malicious:	false
Preview:	........................u;.....l...........P...........d...P.......(.......8...h...............H.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......x...........................H.......................................................................h.......L.......................................................................................4.......................................................................................................................................................................8.......................................................................................................................................................................................................................................................x...................................................................................................................................................................................................................................................

C:\Windows\INF\c_sdhost.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xd98 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4372
Entropy (8bit):	2.85604966826127
Encrypted:	false
SSDEEP:	48:+jg2vF+vZyh2ir5flkzDICTOBIDbuRbN6gdkZPnGoSy:Ygy21zD9UuuNN6JZPV
MD5:	F456FA2B92ABA70AF3AA7043683EA9DD
SHA1:	01F1E850C2DC36C031F863754AA1110A913A22B1
SHA-256:	E337BD792D2DC79F6BA530C44604E14225BDF79C7A26ECD0D3455399A318F7B2
SHA-512:	8A7D17A319F0165AD09892EDB571050925C29F72C8B23F5053B2E260FB9AE554942BAD93CBE95F3713A3F6747C841C37E8423F6CF723FD3A23D3714D54EA5C66
Malicious:	false
Preview:	........................u;.....l.......................d...................X...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......$.......................................................................................................................................................................................................................................................................................................................T...............................................................................................................................p.......................................................................................................................................................................,.......................................................................................................................................p.......................................................,.......................................................

C:\Windows\INF\c_securitydevices.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xda8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4404
Entropy (8bit):	2.8628500413679645
Encrypted:	false
SSDEEP:	48:OdkKVi5MS5fN9NKITaR3XoDbDxbblg91niy:OnIHzKs8ODtbq/p
MD5:	D84EB6DEFDCB197EF65480056B4B014F
SHA1:	13DC5D00042B2BC8C318CC3247800EA114229EBF
SHA-256:	32E0E1C4E561DCA96FD431FF8ED1FEF6AC85CB8790BDCDE2D5A6C7FEF9E1AB13
SHA-512:	DE5D26762FA0E60A0112C3336A78FA27B3579F6639CEAD5C5A54BE7CCE8ABD7F342693AA6405092DCCB6672D8D750F194E3F8A4E57021959D7906C82037EB187
Malicious:	false
Preview:	........................u;.....l.......................d... ...............x...h...............0.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......4.......................................................................................................................................,...............................................................................................................................................................................d.......................................................................................,...........................................................................................................................................................................................................................................................................................................................................................................................................<...........................................................

C:\Windows\INF\c_sensor.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x24d0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-GB
Category:	dropped
Size (bytes):	12644
Entropy (8bit):	3.7153860696872583
Encrypted:	false
SSDEEP:	192:ype0WTi/Fl9SEaOqPb0e7Vr8MOjSWhAk7cgL:UvW+L9ib0e7Vr8MM2k7ZL
MD5:	501754E03E8874B264C509F1266F796B
SHA1:	77106811208A9B487424FA3F15B0CC02344943BD
SHA-256:	05D15BC819DFD8E341382B31F48739ADADFAD63D77112F9AFFA9235ACB56C3BB
SHA-512:	074F7908334CC7336F567367D5E2FF25DC1B6E6700AD2884717ED8713A2AE00AF421127DE2C3E97A0CA3D1E8317AECE982CD3B8881732AF785DCEDAF79D446F8
Malicious:	false
Preview:	.....................$.....................@$.......%.......'.......*..L.......h...............`1......C.:.\.W.i.n.d.o.w.s.....e.n.-.G.B.......H...............................................4...................................................@...................................(.......................................................L........................................................................................................................"............... ......L...................................................................................H.......................,.......................................................................................................................................................................................P...................................................................\...........<.......................................\|...........................................................P...............................................

C:\Windows\INF\c_smartcard.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xd70 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4284
Entropy (8bit):	2.83759400291525
Encrypted:	false
SSDEEP:	24:Zj+MPs7Ulq1ie1PC8L5cc6Yobth3ykP4I0t4KfDo4o0E4qNeBCbtEpPrinHlQ:Zjvk78q1wW5f98tJoILEjoSksOtuoFQ
MD5:	51220E043045AACF87C5C2517A4CB01E
SHA1:	2A24935560E194A527715A453EAA830F49D40493
SHA-256:	CDCD0CE9B9FE99A783805C11D5F57B191C2A19860C82BE282679982405F59684
SHA-512:	BE237F1A77967636621590D83A357574924BD794EF716867C1360BE0353918619A10C72E6ACA4464C42304E01F1D79F47E8DBF534F873571567E9DAA7250CC6B
Malicious:	false
Preview:	....................p...u;.....l...................p...d...........h...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......(.......................................................................................................................................................................................................................................................................................................................X............................... ...................................................................................................................................................................................................................................t...................................................................t...................................................................................................................................................................0...................................................

C:\Windows\INF\c_smartcardfilter.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xdf0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4580
Entropy (8bit):	2.9014617141504013
Encrypted:	false
SSDEEP:	48:LBJCoFP0ir5fOC4iIgnPmY3oDbHxbQswO8pk:LWombifPB3OHtIk
MD5:	63A1AD5C956480515B99188222596DBE
SHA1:	6159156E28856C08F083BBB4A0548E91082DA6DF
SHA-256:	EEB24D15637C1937892E2CE8B05B49AF966F921A4BD0D064BD7584BBAAC65B7D
SHA-512:	BB055F6766102DD0644037853DD78CC270A821426DA247873F9DFF94C49B7FB799B751056323D9481180399B4EA78105EBE8EBEBE007039B4B2CFD50F546C7DA
Malicious:	false
Preview:	........................u;.....l...........\...........d...h....... ...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......4.......................................................................................................................................................................................................................................................................................................................d.......,.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................<...............................................

C:\Windows\INF\c_smartcardreader.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe90 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4764
Entropy (8bit):	2.9700052729904787
Encrypted:	false
SSDEEP:	48:5YjAO0iaoeP/q465q64nUhIbnMReaoDbbxbcsMk4pp7qFSSGY/quijR:ijAO0iaoePEEAObt0k0pe0SsjR
MD5:	C36B22599E80A6482FA2F13D509168CD
SHA1:	BD8272732BD0DEB86ABAC171A614FF2172151C97
SHA-256:	F5E6FAA71BB4A25453E56F01E614EE022293694193273A70E111AA52048BEBC7
SHA-512:	5FF821924435AFCCCD6D1371FB38A7D8CE8DE495CE7C54627DA663953D03613BBACF59B5CF9B69964615658B7B0F03F0C2B27A6637EA85F668C4A73EB9E6B1C6
Malicious:	false
Preview:	........................u;.....l.......................d.......................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................x...............................................................................................<...............................................................................................................................................................................................................................................`...........................................................0...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_smrdisk.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x11d0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6268
Entropy (8bit):	3.261345867636698
Encrypted:	false
SSDEEP:	48:FawpqYcdSi3ApUJOWX2nZoK2pE5WfEAYXEw6IcIDbBRbFo3MDDzEVENR4icD71Gu:TpqYcYiw6JOWX29AY09uBNF/EU4J7AC
MD5:	0B889ADA36CA50D494DC5ADA1E2EA5C4
SHA1:	A75B0F6673B959DF92857C14E53980C9D13A61C1
SHA-256:	DB3C445991130139272F467618686DB276013F5650BA6506C6A72A505E72F721
SHA-512:	A4DF10CA61559580BC48ECF9F7BE7CBDAFA6A50FBD70F332F57FD5538C5E52757C92ADFDA4A59C02CEAC18F146FA59AC38D812453EF28F5E796E40F8E3BC5D2D
Malicious:	false
Preview:	........................u;.....l...........<...............`...h...............h...............x.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......\...................d.......,.......................................................................T...........................................................................P............................... ...........................................................................................................................................................$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_smrvolume.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xdc0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4588
Entropy (8bit):	2.880136937952563
Encrypted:	false
SSDEEP:	48:2hiez6bhh5g5ykyQYSWIDb9RbbqyoyEp7SBTK:2hlKhhKyQYLu9Nb/oyEpWe
MD5:	85AD05CA42E7DF02437F7F716E8FF768
SHA1:	F1FA28A44E7D1A7D4D08660874AA56093C2DA0E0
SHA-256:	34D9D223DE960EBA671EDC3E69D86241639AD68ED74D3187564E29D550B10D9F
SHA-512:	A2D2F2FE80DFE83B330846A200A62D833CAA4C6C90C1578B7F5DAA5BD72D928E8668281701B9B2087AF842F575AE0A6F6CA012225EF716738BD8D88EA1FE7A9C
Malicious:	false
Preview:	........................u;.....l...........0...........d...(...................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................t...................................................................................................,...........................................................................................................................................................................................................................................h...........................................................,...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_sslaccel.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xd78 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4436
Entropy (8bit):	2.849052266644368
Encrypted:	false
SSDEEP:	48:GTFSZt4CNMY5eVHlf1CqoDb+0xb+KuHlqp79G1hX:GA4zlfNOltIlqpc
MD5:	C5D9A0199AB9F49F08346FA996C02999
SHA1:	39DECC4F5F8E0AF3AA6143D1992DC75EA1789F7C
SHA-256:	1F365E863487E4C40903B7E7E47FAE3A01D653B36737C042788DA727970AF590
SHA-512:	444099A5413F25BE4D99FB576C4609FC5FDFBD306B9DF904B876BFACB030D40C0E8E8F79F27539AC6478F2ECD682D746058492D56CDB7428EBAFF019311BBEAE
Malicious:	false
Preview:	....................x...u;.....l.......................d.......................h...............P.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................l.......................................................................\|.......................................................................................................................................................................................................................................................................L...........................................................$.......................................................................................................................................................................................................\|.......................................................................................................................................................................................................................................

C:\Windows\INF\c_swcomponent.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x14b0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	7220
Entropy (8bit):	3.3973864649782253
Encrypted:	false
SSDEEP:	96:btYjoGtHp7Cd1hxdJ9uVNdEXfkXRvJg2tIWEFiA3RF:bCHHm1hx7UJHPK8A37
MD5:	162BD35684B8B2B782168D91C2A02B73
SHA1:	1C8F4BFFB485E07E6568491710C7541CC4AE41CB
SHA-256:	AE9410EB13761A0CF680201C50DFEC58826FFED84929CCE2A357847D4B19C6F3
SHA-512:	DCAA1CD16C715A69A3C88B592664F1A22ED44B920EEEC418D7CBB15A6A85419D81FEF539933688BD464E614632932A2EE31BD6B1CCB1C6ED539B020A25D209B3
Malicious:	false
Preview:	........................u;.....l.......................,...........p.......P...h...............0.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................0.......................................................................h.......................0...............................................................................................................................................................................................................................................8...............................T.......................................................................................................................D.......................................(.......................................................................................d...........................................................................\.......................................................................................................................................

C:\Windows\INF\c_system.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe28 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4572
Entropy (8bit):	2.9346067475857174
Encrypted:	false
SSDEEP:	48:+Xdy/KF6fKFy5+Gr5f6IZmfRIDb2RbJ6QxVHQCp0AooqtH:qy/5Sg+7mWRu2NJCntH
MD5:	33A9EA423BD978C14FBB7BD343356FE3
SHA1:	59B397A1499A68583D721DBAE43A1E0F8EA8D486
SHA-256:	3254D0A065FE64A62F7D039623CB5E67721916D581010D69F6FABC349228E806
SHA-512:	BDECB1576826C65D78D6ECA5674FABA664B02C23D19BDC2F4C9EB2A5B9905D9056DAF48225E49ABAFB012D9D69BD05603D16A9ED8247714ABC753E41426865F6
Malicious:	false
Preview:	....................(...u;.....l...................(...d...........8...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......$...................................................................................................................................................................................................x...........................p.......................................................................................T...................................................................................................................p...................................................................................................................................................................................................................................................,...................................................................................................................................................,...................................

C:\Windows\INF\c_tapedrive.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1388 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6972
Entropy (8bit):	3.364740361127424
Encrypted:	false
SSDEEP:	96:nkovoUR+CW+A0bo40a9/QJe1fZchSc1KQV2YD0pscxB70FUp:VvMYjXERUtR
MD5:	91A5AEA0C954A63231639D2C5087A57C
SHA1:	10A6E0C11BA93FDE1F181BB3DD510B30E1F1A597
SHA-256:	DB0C0729D0E0B14F05ED9C8077F4BBFD18444F378AB7119C6E46DC8D66966A7A
SHA-512:	6067749381D357D1BC259555C91A6FA6A5E73ED3D1C8FB909F60D43FE883A1AD2C9BDCFFD98B6A3526921E6804D448070BF414BA0C0AF99345DC6FDC7AFC2D1D
Malicious:	false
Preview:	........................u;.....l.......................................D.......h...............8.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......t...........................D.......................................................................h...........................................................................................8...........................................................................................................L...............................................................8...........@...............................................................................................................................................................................................................................l...........................................0.......................................................................................................................................................................\|...x.......................................

C:\Windows\INF\c_ucm.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xd80 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4468
Entropy (8bit):	2.8313177492572703
Encrypted:	false
SSDEEP:	48:2lKGWM/AbWwef56/FvkXkQR+O3RoDbHUxbtmzvkX/WDp7q63:RHbWwnvkU8+4OHUtt8vkvspj
MD5:	FCF3AAE5DEE688A734CE30775500999C
SHA1:	6181D110419FEF9FA0111430E9019639231ED3BB
SHA-256:	ACFC3B4804E836E93EE0D5A0C9B00B54F9D92158D3D51B0DF9F9AF43DF8F0AC4
SHA-512:	60EA6D969982B120E1EFDDC54A187FBA9CFBF70F9AF00BCF1EDA99BFEA990D7313F154E298CF0551C06FC6E36496496B3B95C6764E5F76EA25C6C51764DA5EF1
Malicious:	false
Preview:	........................u;.....l...................x...d.......................h...............p.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................P...............................................................................................................................................................................................................................................................................................................................................P...................................`...........................................................................................................................................................................................................................................................................................................\|...........................................................................................................................................................

C:\Windows\INF\c_unknown.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe30 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4580
Entropy (8bit):	2.9452453892650134
Encrypted:	false
SSDEEP:	48:JrWaZPWZctz9Dzr5fn1CIg86QxVHZBIDbSRbrDE/AgKzpZ:JyaZ++Dif8xuSNEKNZ
MD5:	D713ED42DE4FF9F5F697F2EA8BD5A211
SHA1:	C7FEA388289FDD4A5E2D2AFBD0A52C439462343E
SHA-256:	4DDE08A079628AD10A08695C7F3337AE4CE523075501955C6C8DC322CAFAD151
SHA-512:	48326A6FE8C7E78630E2331DD569A5806FD70C9B417738A70EED0114BDD8BD39FB8A419F258266F8979192C03229C574F12B43563F34EFB708943BF8B0DA755C
Malicious:	false
Preview:	....................0...u;.....l...................0...d...........@...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......$...................................................................................................................................................................................................................................p...................................................................................T...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................,...............................

C:\Windows\INF\c_usb.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xde8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4548
Entropy (8bit):	2.88141506187769
Encrypted:	false
SSDEEP:	48:M3DsxfKJ2jS5fSJ0GHYKKIUdGnfRoDb5xbws1ikwd:M4xS+JS5ORO5tLE
MD5:	4D9DF3E222973F646631D94B1F092520
SHA1:	F7BF4188CBEC3F223984E92EC7789F6E5A27AED8
SHA-256:	A1C769112FD9172543AE170A71B147B278D4187377F104CD509A5E8ED11833F6
SHA-512:	406AE6227771575063F5DAE947D1BB9D1946AA3D3EE30C1744C746F71DFF90AFFB4699959861EB445FDAD6910E59CA19109F4BA287FF7180712DBA023A3909FB
Malicious:	false
Preview:	........................u;.....l...........T...........d...H...................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................................................................@...............................................................................................................................................................................................................L.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................$.......................................

C:\Windows\INF\c_usbdevice.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1058 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5540
Entropy (8bit):	3.160912768197917
Encrypted:	false
SSDEEP:	96:y78dmgVyWhV75aa3l/d0OitLppsJ3BtpCM3J:+2mewyOHSBD3J
MD5:	0B183BDDC73D219CE5FC3ABF4117CBB3
SHA1:	FB5AD0FCB1D066F0FB70DAD18AF4E5C49A6D0A6E
SHA-256:	8F4AF362E10863BA372276DBFE329ECC800B7EB4E3D8E4ABF7885CAAA98AFE43
SHA-512:	D897A0F99591EE2635F4EF219EB7C38FAA5649A0B434027A266C75F3F75521C20E4370007962E2088ABC4F05285C452DC6A85882A65307866754B1F34C7F2FBC
Malicious:	false
Preview:	....................X...u;.....l...................X...................T...H...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......t...........................D.......................................................................h...............................................................................................T...........................................................................................................................................................t...........8.......................................................................................................................................................................................................................................l............................................... ...........................................................................................................................................................................................\|.......................

C:\Windows\INF\c_usbfn.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xdd0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4508
Entropy (8bit):	2.8950988759559966
Encrypted:	false
SSDEEP:	48:+UUhdk207zr5fVa3Kv25ISCOoDbAOxb6kwrha3Yv/dA4i:+UwT07QaGtTOjt1wG4/Ni
MD5:	DD28A4D5FAF22083B00BA2DC06A0F139
SHA1:	1B74D7839906C48A29273D2128B4D5AC34446377
SHA-256:	6A937FB472E7965DE9A81D51311468DF9D4318BF48445C0B76E705C377398BB6
SHA-512:	27DA660AB9704C4E6AAEC6CF902B5A8F7FBA4FB30FF9D78E31562922787784F1306294DC9AE1985C56A4C0897B1C0757450CC3649337215CD7AA5B2F585896DA
Malicious:	false
Preview:	........................u;.....l...........@...........d...P...................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......@...........................................................................................................................................8...........................................................................................................................................................................p.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H.......................................................

C:\Windows\INF\c_volsnap.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe58 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4844
Entropy (8bit):	2.9605613982100287
Encrypted:	false
SSDEEP:	48:9YAgBOyfahs/wn5fy2N4Vd/IJKmrbIDbyRbeiSWjKLcQG:y1BOyChmj12KOuyNeiTjz
MD5:	C0DBEB2AE75236EA6B76EEDF9868090E
SHA1:	85C828B1AF48577119639BF6B25B645EFF845C82
SHA-256:	7DDF3ECEA2183E53978300E138BCF1237A3ABEB9CF5CFC36C9599613F2FD4E6E
SHA-512:	1921AF75F5D0C1EA980D2F96935D71F1B8927C4214B2E8395142166F3103075DA318D7BE052C18BF791DEB37A7E99A5FE71D956529D60955A4CC4580397EBF0E
Malicious:	false
Preview:	....................X...u;.....l...................h...d.......................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......4...................................................................,...............................................................x...................................................................................................................................................................................d...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................<...........................................................

C:\Windows\INF\c_volume.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xd98 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4548
Entropy (8bit):	2.8322752593612517
Encrypted:	false
SSDEEP:	48:+jACyGz7ElZsysr5KYMRl8lRYFZIDbERbuKVMRGGLp7tVCCHr6mv7C:YARGzpySYbuENuDLpxV3r6mvG
MD5:	02446EF7B088E842A2F8CC8942BDBEB9
SHA1:	DCCA81AA72350A24C389B38DDDAA1076FF1DC608
SHA-256:	4DBDE6D109AF414B1DBDA4D689258E39E29F786424B66D7902806E1F50DD3902
SHA-512:	CF96916F5BFD1168527138EB25696408C17337F066FFBAE87C850B7D971EB14AD8103F2DFF6A119871AF19D705AB4080813F288B3BA61974453072B338DD2C79
Malicious:	false
Preview:	........................u;.....l.......................d.......................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......x...........................H.......................................................................p...............................................................\|.......................................................................................................................................................................................................@...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\c_wceusbs.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xd98 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4372
Entropy (8bit):	2.8501043453245294
Encrypted:	false
SSDEEP:	48:PzircliDc5fXkrDD1hIN9ddY3oP+krHnW:Pzy2yy9A3wZW
MD5:	415C9EFE38B1FFCE81CCBAD3607DCB6F
SHA1:	332AA2224A8EEE533FAC9E862DB196EE70FCCFDF
SHA-256:	530B7189998F7F283D8D232DBEAC1F7C53DEB9716407F384985EC06E7DC22C54
SHA-512:	3958293FA40A91ADC764B3B807EA1DE7AF08D6783BA60D3AD9A2979E6DC5A7D0999F9E9B3983C59C4C4EB5389A2E16AD018DCAD850DE46C3E712061D3635CEA0
Malicious:	false
Preview:	........................!......l.......................d...................X...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......$.......................H...............................................................................................................................................................................................................................................................................................T...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................,...................................

C:\Windows\INF\c_wpd.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe08 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4580
Entropy (8bit):	2.9021537464155207
Encrypted:	false
SSDEEP:	48:Y4j35xCXe/GdBzr5faSuJOIxfGkZiOvRoCRwAeg1j:3jpd/8B5Oug5RNoU
MD5:	25D587F1C4388B837612F1A6A1E0C151
SHA1:	0F2195B8EE486E238D315AF6432624CD0523EF29
SHA-256:	246EF6C852A362579D659916B0CE404EAAAEC75B55E8F78CB92BCE614791D63F
SHA-512:	0ED3FD19879E0BCE9B7176D4499605899F14211AC267472EC55ED9C43F66E007998A546475B09015937C83A30DAE8E35C01898E953C5334AA3F7FE685A6A64E4
Malicious:	false
Preview:	..........................F......q.........x...........d...h....... ...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................................................................................................................................................................................................................................................................................L...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\cht4nulx64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xd150 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	72364
Entropy (8bit):	4.082700055905205
Encrypted:	false
SSDEEP:	768:6jqudvw3C76uiU9F1CSuTo9SCXAwASFK22l5FrgjY:WxGC+uJluTES8bAuK22lDrgjY
MD5:	61BB26D3707818064DE19B2AADEC9534
SHA1:	36A06C120DC540BF7435B878F8B0C3697E193F27
SHA-256:	6A383FBBB6E455C137484CFF4F82FED1164364F5AAEF44104AD86BD73AF3BB65
SHA-512:	C512ED9C476D60719EC4B7DB9BB33080F174D54339D7F14C11B77084E9A765A621BF4E1DD6DC8326DA466E6BDBDF780B08E5FF8F0F768FD9F0D6FC6335FF6D7F
Malicious:	false
Preview:	....................P..............................P...........$.......D...`...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S............g...<..LY.............4....i..............................t................:...6..........@....A...\|....... ..............\|...............................P................=.............0<......p>.............,_...x.. B...........................................................................o..p......................LO...........g..l9...................A..H...........,............X......\|M......\g......tT......................\|Q..............xS.......................l......X.......................................6...................C.......................m.......D...L...F...Z.....................4P...............J..0..........................N..\b...A..............................................e..........................................................................r......8....y...s......Ld..8.......{.....................

C:\Windows\INF\cht4sx64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2570 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	18324
Entropy (8bit):	3.7038256845297672
Encrypted:	false
SSDEEP:	384:deYDfQfLnES9BoKLls9Oxjq9Myc6qPuHJeQX:ss4fLnEaoKL/A9R6OJx
MD5:	85103F9788167B93ECCE0DC19CBD10A2
SHA1:	DAC6295F3F964702AE8E7EBC8470A427149055D7
SHA-256:	75E57123229F9D6F5DD011D19FBB53CFC82D0AAF4EF33B493267E5E331DC3680
SHA-512:	E5FB0ACAC812BFBC22287392F08330A7AF4EA6D8B87A031166B5630047D1064AE9A1D40C3EC203DC736D5F61F3E9FAFDA9EDF41F9493503D12A961D314050C1F
Malicious:	false
Preview:	....................p%......................$......x&..X....(.......0..T...8<..h................G......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S............................#..............................p.......................`....................... .......................................l....#..................L...........P...............................`.......\|....#..0........#..............$...........................L...............................................................4....................$..p.......,$..............,...............0...........................\|...................................................................................8................................................................!..t.......................d...0.......................p.......L...............................................x.......h....!..8...............................................................................h.......P................$..\$..............................T.......

C:\Windows\INF\dc1-controller.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2a30 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-GB
Category:	dropped
Size (bytes):	14524
Entropy (8bit):	3.799819540818035
Encrypted:	false
SSDEEP:	192:dEZPZUZSrMiOvCr0q79RQucObyGPrUoSKMSOYC60r7dRj/ZWGc6dTE5yhF8Ar/CA:dOyNhWUVD8m
MD5:	50EBC5637010659A792F3EBE101C4DB2
SHA1:	9F16732FA63AA2877CCE57A7F01DECE8F417A09E
SHA-256:	25ED71D4C9E8A502A075F41BDF05C4714451E38F6382CDD4DE7C7FD2D18ABB67
SHA-512:	2C38278E14A038555C792159252C6386183C92C48CA7DE0A2CB06EA185AD2F63F9EE1C69ABFE1E9A49BC8907BA0D9F8BE36E83B8E71DDC42C115410C5DEFAE80
Malicious:	false
Preview:	................$...0*....../......0........)......X+......(-.......0.......4..h................8......C.:.\.W.i.n.d.o.w.s.....e.n.-.G.B....................................................#..........................d.......................................................@!..................................4(...)......X ...!..h...............l#..."...............................................................................!..............................................................................t.......('...................(...'..........................................................8....................................................................................................%........................... ..@.......................4&..\$..........("...............................&..............................................................................."...............................'...%...................................(...(......................................

C:\Windows\INF\dc21x4vm.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3328 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	22988
Entropy (8bit):	3.830580251967989
Encrypted:	false
SSDEEP:	384:uY9KWbrwFh35HiNhSeF9Ar8xijOSUZJVRI86Mhm65rxa+iDv7G3:x9KWIF52YyqSyMtwDv7G3
MD5:	51F735635347623C4AB5A1A53D14370D
SHA1:	867E87E57FAD56D72A7309B7C87720B179D18855
SHA-256:	ABA6B30A7031D461AEE8057DBCEDA694F5E941D6EF4C882567A8519017D3B81D
SHA-512:	B72BE81DD871DD51538C74FCF2D26A31F4F8F7D6211DEE8244B309901E199CF83980A02FFC58E98F682022D07455BFC7AF65D258EFBC6FC17BA91F7D3503602D
Malicious:	false
Preview:	....................(3...MD....}............2...... 4.......5......h?..0....L..h................Y......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......<................-..........x...........................................8-......................x...........L...............\...............$'...1.......'...,...........+...........1..D...p"..8....... ........#...........2......0-..........d .......,... ..h............"......<............$.......#......t.......p................#......T0.......&...........'......x........2..0...........L%..d%..L'..\|%..p%..X)......p(...............'.. (...........$..............D&....... ......T,...........$......L#.........................................................,...........%.......#..<$...-..T$...............#...........%......0$..T...........................<...........,+...&...........................0..............................<....................-..(0..................................`$..............L............... ...........................

C:\Windows\INF\digitalmediadevice.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x14f8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	7652
Entropy (8bit):	3.40181044517252
Encrypted:	false
SSDEEP:	96:ZvrBaJIfj457iG4S6SErUzYaijCAfSOgGyOpt05:87i1SHsaimAUGtva
MD5:	E5422F4F08D279145DC7035569962220
SHA1:	E51B46CF762CF7883FF1AA4E47F315A02F81C893
SHA-256:	93CEE74BA5776FC74B2C67CDFAD269716300203469A337784C2F9B2A84592EC1
SHA-512:	B28CF67C203A6F30B1BDCDACDD4844F592349C5A7AE6E5A4B9613E771DACEC7551138689F04250420FF859F3768018EC6215FE3768D236E0C8D587410B838853
Malicious:	false
Preview:	...............................T..........h...........@...P.......@...L.......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................0.......,...............D...................0.......................X...........................................................................................................................................................................................................l...........(...........................................................H...............................................................................................................................................p...........................................................................................................@.......................................................................................................................................................................................................................................

C:\Windows\INF\displayoverride.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x15c8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	7924
Entropy (8bit):	3.512231003397492
Encrypted:	false
SSDEEP:	96:Sk5W02MgOCuePC3d38nBOUGUdKRGt8GU75aVQk+Lv4hJ5yxId+mA:a8VtQwUGUwEBEJd8yyS
MD5:	46A0C45A4388687B571724BABE295F27
SHA1:	B034900157B4413E67D4E166FDAA4DC0B7B24D3D
SHA-256:	E3FB5878374C0C1678BE7273EEE74A90888E0D30140EFB9ED9BD25E3D4A251C8
SHA-512:	ADAE0715AF413DE83A2DAA9A292EC7D8DF1832F4F06047DF1C744B64E94846088F966337E5B8A14CEE57DD14A266D79684A5017B06A5B0FBD108117B9162282E
Malicious:	false
Preview:	........................<.(.....#..........8...................@.......l.......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S....................................................... ...................................................................................................................................x.......................................................................................................................................................................................h...........................................................t...............................X...........................................................0...........................................................................................................................................................................................................................................................................................T...........................................<.......l...

C:\Windows\INF\e2xw10x64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4ad0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	55036
Entropy (8bit):	3.8795710336979896
Encrypted:	false
SSDEEP:	1536:Q0rIw3HDdFN9UL5voz5zb/JgVf9aWkGqw17wv3v83mEO2lt8YF2lt88F2lt88N2K:Q0rIiHDdFN9UL5voz5zb/JgVfQWLqMNR
MD5:	5EE0BD6B3208D84CB7EA1A9FD167F8BF
SHA1:	C7934A416A067ECC0084ED6C22A05AFF428D1295
SHA-256:	CB331FF7AB8128AE6753AB3CAA437F384E5410054170CC7732DA541C19CE002F
SHA-512:	A8B84538B8E3302B4FC421D093DA6C85AB6A676022787DD25F62C59760E02F764DD7A7FA70E59F6EEB94401A726911FD0E88224CA5E612F48C9ED1AA1CF06AFA
Malicious:	false
Preview:	.....................J...b.................<J..1....K.......O..x!...q...2......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......8+.......H......L#......@...............\;.......0......,F...C...5.......'...........:...7...9..........X....7..................\|(..........d.......0?...?......@@.......8.......C..\............&...+...(.......6...$...)...0......\|?...@...#...@...... /.......C...0..............($...'...E...........................7..........................(D..............4...p........+...I..`............8...1..HA......L'.......:...........$...B.......B...F...(..........`D..........(2...$..........H...............8...t.......,:..(...............................`6.......................................................,..\................2..<,..............<........3..$+..."..X'..T4...4..L....................'...............:...........................,....... .......!..P"...........8..........d...DD.......:...3.. E.......I..8I...........4......xC...A...3..,.......

C:\Windows\INF\eaphost.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1178 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5996
Entropy (8bit):	3.215615336434147
Encrypted:	false
SSDEEP:	96:KPHPZ8ZtnyjM/g6ESj2ATWICFecEKS1KG6j:TxyjM9/j2ATWIgecEXI
MD5:	6145425EEFBAE1A33A301C05A23F5005
SHA1:	E6911503DD100B063B0F0BE155F5A89C24F4743D
SHA-256:	B14E26B38AF0DC27EFF6956784F2E029BF350F287CF3C34C64BB7355BD3662FF
SHA-512:	7759601E771A5B1E4DDA1DC5B28044F1B4C2FB71925DFE7DEAA8880276D9D4F23752240F41E406450984524BE547637E5EEC8657FFECBD024DE3305ABD9D11AC
Malicious:	false
Preview:	....................x...<.(.....#..................x...........8.......T.......h...............h.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................D...................................................\|...................<...........................................................................................................@.......................................................................................................t...............................................................................................................X...........................................................................................X.......................................l...................................................................................................................L.......................................................................................................................................................................................

C:\Windows\INF\ehstorpwddrv.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x23c8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	11732
Entropy (8bit):	3.70440622131281
Encrypted:	false
SSDEEP:	96:PedDnCm72p6Qy5NR/d2N1JvgxlHp0aqNAXLmVKme1T1T0DH2kT2A23Zu0TgLAspD:P2XddgAlHpr/UAs2CI+X1
MD5:	A29AB78927DFD22BFB61E8FB45475429
SHA1:	81935B2685BD758A1C7562821261D343EF8BF028
SHA-256:	C029F00DB4ABD27409DD52A2EACD5DF6A1150E29223DC9E0F8D30AB49ACA30DA
SHA-512:	946C1E34B236CBBB29B9BD4E0A06232695466AB30A4749B974C0137E19B004051CB25A65F7DDD9A078A91440C1A3E151E53B5BAB583DB0CF2718080F05EF504E
Malicious:	false
Preview:	.....................#..%.../...HR..........8#.......$..\|...P&......p(...... +..h................-......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........\|.......................\|...............................t...............................D.......0...........................................................................@...............@...........d...........................................................................................................................@...........................................................H.......`.......x...................<...................................................................`...........................................................................................................................4............................"..........................x.......................................................................................p.......X........ ..................................@...\|.......................................

C:\Windows\INF\fidohid.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1098 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5524
Entropy (8bit):	3.1911113698314013
Encrypted:	false
SSDEEP:	96:X6jHaYi0S5y6/nyoS6SxvoHPTdJf7Vg4Mgaz:Kt6/nyo3UvQ/ggw
MD5:	90B89085068922ADE1B2EE9C2620F883
SHA1:	9C991454D31AA9FD9511D6B52B72D5ACF5D13A24
SHA-256:	FDD933E9661A4E90F1B857CCD4A1EC30AA04370902E6889E02ACF66AFDBB7F85
SHA-512:	934F2DCF56B7AA98FC286E3191D197F929D62A9854213336321DC3CF837BA104385C0BDD2148352C611F121D4202905A07AB40C25E7CE38499F24DFEDB5F14C2
Malicious:	false
Preview:	........................Z.{.....3q.........................`.......`.......x...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......D...........................H...........................................8...........................l...........................................................................................................................................................................................................................................................@...........<...............................4...................................................................................................................................................................................................................................................................................................................................................L.......................................................................................................................

C:\Windows\INF\fusionv2.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1b78 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9444
Entropy (8bit):	3.6273962277311322
Encrypted:	false
SSDEEP:	96:yzOTH4TPnD9cZN3/LGeokJ1+STc2BP6+2UyX1SB0ef57ljbvADwjLU5ckUfyN2KA:8nD9cTvLG+Bi+2PEncVBEKNq
MD5:	0C92496D161C5232337B2FDAB56B2F6F
SHA1:	ACD1D70D2C7A9EE2AE7D533C56EB8B21AB863574
SHA-256:	3F44CAC870F4A96B06BB059AF308B8F9681009AFB0EC05E9FA0B740BC777D925
SHA-512:	73CC0978EC72942EC07E5E7930D1C9E822D97827E21A839A98EB3E6A55FCB6927046485D64F577897E428B62BC7ED4F5611DB36B4BEF76CC05D26D83E8E73B63
Malicious:	false
Preview:	....................x...........L......................h.......(... ..`...."..h................$......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................X................................................................................................................... ...........................................................................................................................................................................................................................................................`...........................@...............(...........................................................................................................................................................................................................................................................<...............................@.......H...T...`...........................................................X...............\.......................................

C:\Windows\INF\gameport.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x26b0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	13716
Entropy (8bit):	3.726528398209522
Encrypted:	false
SSDEEP:	192:l2P80NFQx+SOKzZoMQHr1buwGVQqWrU8mYAucIjGgapZEcvyG4:ly80wd0PGVakuGSXG4
MD5:	D624421D746E2404048D6D8DBBBDF642
SHA1:	1C6998A0F64D1C5A67AA316DDF09E9E31FEE38EE
SHA-256:	C53E37960CE91EA41BA88E7B8021B4CFFADA96044832F152BAEC5FFCDE40A86A
SHA-512:	DD23DFFB94669E7ACFF4EFD6F3BF3A9A535FF15CD795619E369867AF0E7174588B156CBB0D215A357883F61DF23A45F47B0E5F506C449FE34AA62AA790AB4E40
Malicious:	false
Preview:	.....................&..<.(.....#.......... &.......'..T....).......,..\...01..h................5......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................<...................................................`...................................,............................%..........................(...D...................d%..................................\|........... ...........8.... .......%.......$..............T....!..............................`.......d.......................................................................................................................................l$..................................................@...D...t.......................................................X%.......................%........................... ......................................................................................................................................@............................................$..................................D...............

C:\Windows\INF\halextintclpiodma.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1780 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	8148
Entropy (8bit):	3.549155621081003
Encrypted:	false
SSDEEP:	96:F2DOSnioKGePCTcSFk/FlGRm6x10fQ/ScWcNcnIt/7ZjPFbue:WNR7FLN8E/FjPT
MD5:	B29214278F59B64DC0C40BC80CA6D481
SHA1:	526347D2F2E98D69EAD0432DA14D320FE612448B
SHA-256:	B060DFE93D191CA516F1DCB1EE58005CF643CD7319139CC74BB46D4E1B651DE8
SHA-512:	381A033352207FCCDB6A4FEC096F8B29C282ECA1FDC190CB0D6BD519E9ADCF3741B4CB26EAB1A23A180DA335B8BF1EB1320555AFC7B37FC8763DC432834DD84D
Malicious:	false
Preview:	.........................!.............................\|... ...................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......\...........................h...........4...........................................................................................(...............................................\|............... ...\...............................................................................................................................0...................(...............\...........................................................t...........................................................\|...............................x...............................................................................................................................................................h.......................................................................................................................................l...............@...........................

C:\Windows\INF\halextpl080.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1358 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6540
Entropy (8bit):	3.374765465305265
Encrypted:	false
SSDEEP:	96:vzMUC+ZKEL3CT4cCDbygKRk6V13ftEucO5IF4f4y+Ky:LUTuDmffeu4FB
MD5:	BDAAF83AB36EB54CB1E3E328E35B8EB8
SHA1:	50FC1D34C8731BF36AAB590D708E2CFE0D830F0B
SHA-256:	AB7F86290E81634504A7331BB69E04D8B64384BB99EBD40F0071AFC3541DB267
SHA-512:	22D85A082AD6D1B2ECB3A30B475EE7738AD7749C4CD6DF9DD0A98AFA0DDC46A9BC6CA3600C121AA76E9846AA665343ED5F8B3AB99E8A2400EAF41052EC09E696
Malicious:	false
Preview:	....................X....!.........................x...........D.......`...(...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................`...................................................................................................\...................................................\|...................<...................................................................................................................................................................T...............................................................................................................T.......................................X.......................................................................................................................................L...............................................................................................................................................................d...............8...........................

C:\Windows\INF\hdaudss.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3d28 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	57108
Entropy (8bit):	3.6347380190573984
Encrypted:	false
SSDEEP:	768:t8LlYxy5cRfQTqaAgjoiNM7m8NwCaIaw4dTQzzege:aIy5cRfQTqMM7m2U
MD5:	FDEB55C33DF79BEED4BA950ACBAF3895
SHA1:	806C9B87F7AEC853F383D60B296289A38EBCCEAF
SHA-256:	27C6E261443540F0B444E5CB92671BDDA806D50B59CCA2ED57A315B0FE147B70
SHA-512:	CE007C7F1C2B05ED51F23383D8F0F7CC0A3E305257CD7A9EB05CE571FADD13E54ABFF581AE9F66AD9DD4E2297BDC458BE239644CDE60174962CAC1B4BE237EA7
Malicious:	false
Preview:	....................(=.........HR...........<..L... >.......D......._...?..x...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........... ;......X...........................................................P............"..............H.......................................x%..........................\...l7..................`...@2...........8......................................................................................L<..................$................/..........,...............0........................... ...,...#..4...p&...#.......(... ..$....,..p4..`...l.......h........&.......:...................&..............................................`...X...........`;......d....4..............83...,... ..........2......\....#...$..p$......$ ..\| ..................................................X.......................................t+...............................8....................... ...!...&...&...&.......'...'..h".......$......................................

C:\Windows\INF\heat.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xfc8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	5100
Entropy (8bit):	3.1001281175372455
Encrypted:	false
SSDEEP:	48:xDdEj9VIauP0u5E5egLIJZwzELc6x/7q+6ExQ+h4F9MLbuGqrCqq9:xDdarIau8JIJKwcQq+n4CbuGTqq9
MD5:	E7137C8F8EB246DDDE85CD3C98E49FDA
SHA1:	5C5AF134FE159FF729C0EEF8A6192425CC6D6827
SHA-256:	D630287E18FD6D8A9FC6D08ABC1B74007EED7679EF99B07A9304FA687D2C7B63
SHA-512:	89A5E2C94D629D1B7E534948B1ADFA12D4A51361047D9B849F82AE6856D746EC7B9258608AEF1CA9409A3FE7FEB5EC5EB1C3B5E735DDD72949EE0B29672C6E07
Malicious:	false
Preview:	........................Z.{................H...............h.......(...........h.......................C.:.\.W.i.n.d.o.w.s.................................................8.......................................................\|.......................................................................................................................................................................................................................................................................L...................................................................8...................................................................................$...................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\hidbthle.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x24b8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	12812
Entropy (8bit):	3.7372034375223326
Encrypted:	false
SSDEEP:	192:yGyNF2Vy2nxUcTivNr2ez+TWspWsm3NX7+ycROizFieaZTFx5zMIS:ysVTOcTivNrz9X7iz4eaZTU
MD5:	76BD08A478B087A677EA2218378A8C24
SHA1:	6BCA205BD8E62BCCBD775F7F25877C37E377D066
SHA-256:	3535A81104831057CE5452CD42BBD58A18A1E6525640895FA369D8EB013A0E81
SHA-512:	9348ECE65BD7D8B2318316007C452C07A8DA7AE1E70EA4F04C9EC2E077156774EC5EB48B387F607FB67D47FBAD32040E68BAB0EE0F2EDF8129AFDAB056DE5507
Malicious:	false
Preview:	.....................$...c./....4..........($.......%.......'.......*......X...h................2......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......h...........................................................................8...........................................................................................4........#......................................................................................................................................................................................\|...............................p...................................................................................................................................................................................................L.................... ..........................................L...............h...................................\|.......................................................0.......................................................T...........\|...................."......

C:\Windows\INF\hidcfu.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1610 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	7556
Entropy (8bit):	3.41550432733829
Encrypted:	false
SSDEEP:	96:+QzbZXBEF28PpsMp129hZgZDNHPbLiaaIGY0c9fUUerWaNPP9Tjq:+SgstZg/iRlZNPg
MD5:	0286380B983EC26D570E4DD0CFA2876F
SHA1:	5A84649CF5256FE5F099BEE636E27FBD97C0FC5A
SHA-256:	B3B74D77CED714C419D293C4AD89A7DDD1ABD7B1B92AF2262C01FEFE2597A8D8
SHA-512:	6073B99358F2C8BD39B77B47D6501DBA20E78D59BD2B03B6257330C9278A82DFBF6A23DAAD344038376D4147C3F437271E1EC6E8A4809AD926000F8A9129C4DC
Malicious:	false
Preview:	................H.......3 ......L..................X...@...........0...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................................................................................H.......................................L.......................................................................$...........................................................................................................T...................................................\|.......................................................................................................0...\...........................................................................................................................................................t.......................p...................................................4...................t.......<...........................................................................................................................

C:\Windows\INF\hidirkbd.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1be0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	10004
Entropy (8bit):	3.6348980594678335
Encrypted:	false
SSDEEP:	192:zZMr6BOGt2lGr1cG2HwUgfjMvgKGVO8OVjjl1d1WcG87iejTJf/Bb:Gr6Bft2kr1twwUrGVO80jjXd1W9kTFN
MD5:	C0D2790438DA01BC987FBC6DBFF963CA
SHA1:	0D024A9414DE7717435562786DA10D76E8D24C42
SHA-256:	BEC49D4E9215581A29CB98BB82428FE010621111BEC13AE02AA4036882EDC7F4
SHA-512:	F9EFED39CE709B8B20DAD55DB298D534E191DE159A27D392AF09F1D90A4AD181698041C6551BEE7D9F10444984BBA5C7F3F3BDE225CFB2BA580E98D08C1599CB
Malicious:	false
Preview:	...............................HR..........P...........,............ .......$..h................'......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S....... ....................................................................... ...............................................0.......................$.......\|...................d...D.......................d...........L...................................................................................................0...................................................................................4.......................d...P...........................................................................................................................................P...................................................................................................................................................................................................................................................................................................

C:\Windows\INF\hidscanner.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x19b0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	8564
Entropy (8bit):	3.53576953235557
Encrypted:	false
SSDEEP:	96:CnBNkv06iy106omrRtR1KnH777arr40JAzrsoRa9RuRG1/8ewdS092cCg32nNchp:6s1Mb7YrNAzrsoRxe7+2nNs
MD5:	E84591079665104A3B5F56DA54ECA8E1
SHA1:	07408D65F26825D6A46D408B4B0BCB5AAFEE74FA
SHA-256:	8E029105057BA96929E8435973D7E82CCDDC9ABDD14DF4B3DA3ED20CAB5F873B
SHA-512:	84B94E2DE3791BA5645AC089178F5979EAB3837E98160874C9FA681F9F236B7854C2D43A50FFB6C1173CBA88A080CA98EB7AD19B23BE2216C28C878628A4A8DB
Malicious:	false
Preview:	........................Z.{......n.....................,.......................h...............p!......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................................................................................p.......4...............................................................................................................................................................................................................................................................\|...............T.......X.......(...............................T............................................................................................................................................................................................................... ...................................<...................................................................<...........................................8...............................................................................

C:\Windows\INF\hidserv.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3c00 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	19396
Entropy (8bit):	3.8653139599988515
Encrypted:	false
SSDEEP:	192:vnHUQIauFWulQDWVuT/uftuOuu3q9E020EvG5Cl5QuafYQ71LOASanW+eDYeVKmz:vnHUQM18KsekfNv0n6J4xh
MD5:	9B3A7939101F2A9D5530023DB2FF5E32
SHA1:	159FEC6D962BC119B628701366217AF2D70B21D3
SHA-256:	E179960A69D886F501FE14806DDB97DB01B1B744E8CCA707F6D9FE92F46DE8C0
SHA-512:	64EB64D800EEABA47CF0EC93C5FBC70B9C8CD29AD467C4E85943EB369B20F686A30B82733FFF1A5F3AD6A397C96523AB617BAFD7B0CF99CA8B9952C34D07DFC3
Malicious:	false
Preview:	.....................<.....................p;.......=..@...@>..,...pB.......G..h................K......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........:..................................................................................................4............................:..........h2......h................ ..T;..........................$:...................................................................,.......0......83.......................7......p....)..."...5......T4..................(8...................5......@ .......6......................D...................................................\| ..........<&.......'......<!..............$/............................................... .......1..................................,...................l.......................................................................................H...........D9......................d...<................+......................................................................D0...........1......

C:\Windows\INF\hpsamd.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4c10 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	27732
Entropy (8bit):	3.9870494833993435
Encrypted:	false
SSDEEP:	384:4fOt3jZJInwm5131yirZ5/vyFnvXc/0Gs:4Wt3jZJInwy/vq0/0Gs
MD5:	80A5A313E97D717E83B8900713CEFBB2
SHA1:	67B01D650AF8C925F19DB72DB279B4C81DFCEECF
SHA-256:	D10A74F286CF961811F63760C51404396979DFE28A9BF5BEE6F7211A3F889AFD
SHA-512:	1511A789394D02C815C5AE4DF09601C6D0AF885FFECB8E4CCFAFCEAD9D4B3B0BB837C7D83C6A9668D0AC8C2A7C5074C8ADEECB049A3EFF74D87D9E145DD979E8
Malicious:	false
Preview:	................ ....L.....................\|K......0M.......O.......W..H....b..h...............Pl......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......pE...............?..`H...............................F........... .......I...*.......................................'..p....&..x@...$..........`F...3.. 4.......H......."..D....................H...................F.......F...........G..........<...x...........................<...x........................................?......................DG...................I......(!..................\|?...!......................\|"..TD..............D.......................................l#..D,...........................@..."...................).../..,7..................0........3...;............................... ...............................................................A.......................I......xE...............................B...A..........................................................\|................=..<=..l=...=...=...=..,>..\>...>...>..

C:\Windows\INF\idtsec.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1cb0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9596
Entropy (8bit):	3.599331387927056
Encrypted:	false
SSDEEP:	96:+N8AmLc6iRzY5PlENANw4HPyZQJs1YQXTtMAKCL63OPBFlPk5Sg00yrKM7Kf/NUw:9RlENAiGyU3aTCAKCLXVkGwNUzdnLi
MD5:	E3BE23FFCD01255A8EADB0D84D7047F7
SHA1:	581F1231DC32C241640A4C1DCAA771217EB00F57
SHA-256:	2C5BA6DFA16C781240AB93A2ABE75F61DE1F99A2E6E22CCE22D55F649555346E
SHA-512:	8D78E9AF78E5D8253CD664FD8504717E6B22B601F282594B2C5763726D2C7410080C8421030ADB59C6126AE223FB0250D940D5D5BB357E4C6CC552A8F83065F3
Malicious:	false
Preview:	........................Z.{......n......... ...........,............!..4...@#..h...............x%......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................................................................h...........................................................................................d.......................................................................................................................................................................................p.......................................l...........................................................................\|...........................................................................................0...................................................................................................................4...................H.......<.......t...................................P.......................................L...........t...........................

C:\Windows\INF\image.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3130 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	22292
Entropy (8bit):	3.8878315517098634
Encrypted:	false
SSDEEP:	192:21VBZaGbf+VLlGFU6/aNA8dmOJYzQw5A/oC9Jr/PYB8QEe2o6c5bMhPo9tLZjtPZ:GXbK16mFPJYPSo4PYvf554duJVlZ
MD5:	EA93DD5CFC9BACD5E320E88AB79CE7FB
SHA1:	28AFD0F157E6E430726F50DA2D4D05E557FEC652
SHA-256:	1DBAD2563C86D1CA618D6D3E8E5278B24F7455040AD31B82A4B0F65B06E5C1BE
SHA-512:	87264D579BD1C43FAB7ACE4783408F43937A5ACBDCA5201307C391E62C57A83C3E102E2F1A914211C5F66C1590A71DC5C2BCFD7EC9F9CD97D3D92D16B760C5D6
Malicious:	false
Preview:	....................01.........HR...........0..2...(2.......6.......>.......J..h................W......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............X"..............D....0..........................."...,..........L........................... ...@...............`&..$................%... ...........................................$......`...8.......\...\|)...............!......@#......./......$#..................................@*......................h........#.......................................................(......X.......T... (..8...\|+...#..T....................................................#...........................&..................H'..t...................."...,...............................!..80......................................./...(..........................................................x.......................................................L ..X........)......./..........................................0...............L...........t..../......................

C:\Windows\INF\ipmidrv.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1468 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	7052
Entropy (8bit):	3.4156425471199956
Encrypted:	false
SSDEEP:	96:thjexiZhdAvwk1oHG+6X440Bb3yp638v9bV1Kn:yx2AvfjX+y/9bny
MD5:	57ADE80F62C9405EE51CD1EE30A767E4
SHA1:	20EBB56A378E12E11C35499581DF3DD2666650A7
SHA-256:	7C96980E06967A99F2A6514A21A84C10E3BC1F2015A410715061D6474B297762
SHA-512:	2B0D0FC9C7E64682E8FC81B641BFAD384A01D373A88160EE1157243A5B4FEA4D1B2D612BDE9FBF75DCA505EA67B21E15132F25BA99599687882A9750385F8556
Malicious:	false
Preview:	....................h...l.../.....b.....................@.......t...8...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S....................................................................................................................................... ...............\|.......................................................\... ...............................................................................................................................................................................................x...........................`...........................................................................................x...........(...................................................................................$................................................................................................................................... .......................................................................\.......................................

C:\Windows\INF\ipoib6x.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x7b50 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	57668
Entropy (8bit):	4.021522397879563
Encrypted:	false
SSDEEP:	1536:yrbJkSZKDumwplkdT93AQtZHSHHFw4uM4Pq:yrbJkSZKDumLdT93AQtZHSHHFw4uM4Pq
MD5:	1FA26DB6CBE7B2F9984ADF8252F8AB57
SHA1:	9F8AAC3D749F7F0BE336BF4A4CF67188C4DE0157
SHA-256:	A9286874D1859DC64DB55D7E9C013C99A80A42B5E75377E1D4EE9C29A27BB42F
SHA-512:	ABE4CD062AA0790A41B72817BCB6C463BDC1D036F84AC08CDB519997ED06A62FF0D5262605B3E0BEDC4D52026FE1D58CAD4C55A588B497C5569490F6F8548ACD
Malicious:	false
Preview:	....................P{..w..................z......`\|.......~..4...P...t$.....h...............@.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S................Z..hn.......f...7...f...................m..Xv...u...............j......D....?..4[...a...B...6...Q.......................5.......A...a..Tw...8...7...\..x9...]......d........x...`..Pm...9...7..l...<S..,0......\4...=...........v......Pj..P5.......p...............m.......R...........3..\Z...S...N..............d...\|.......0....F...y...l..$O.. R...0.......1...6.......F...k......@8...V..ta..................pV...3...]...R...q...0......x3..$o...................[...c..<...(...<...h`...h......$i..........`....m..........po...............;..h=..........$....V..,6...9...........`...n...........0.......l..tz...z..hg..$s...h...s..........."......Lz..................t...............<2.......$......4`...w.......a..............(l...........t..@b.......w..4....S...........B...........T...r...Y......d[...................v..0....Y.......[..T...Xn.......b..

C:\Windows\INF\ks.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x15998 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	129356
Entropy (8bit):	4.1755477776072665
Encrypted:	false
SSDEEP:	3072:JPOfe5a6nK9dIZILzUAIJPGs/G8zrRwhE:JtRwq
MD5:	0D9A32D3AE17F74FE05306685B5254EF
SHA1:	DF07B3F3CC80F7C494A6F96984EA45684B64B64D
SHA-256:	9EBF618CAA4376D36F7E2E8ADCA732C6714DF9C60D10E221339F029401BF60E4
SHA-512:	F0B7611D4B1A0CE87A212F35BD9A057B2D59643F8DA74D368F4A0956B57EE88977CF55C39199A829E8C078667B9289B1645228C94BCB2E1CC85FE18355AB7371
Malicious:	false
Preview:	.....................Y..<.(....yl...........Y.......Z..,....[...).......9..x...h...............H.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......l.......(........i...@...@..`A...B...9...:...:..P;...;..8z...............l..\<..(%...z..LD...)..`s.. F...P...Q..TR...R...S..HT...T...U.......V......\|....z.......k..<...............Hu..`"...........K......`...,g...<...=...=..<>...>..l?...3...4...4..h5...6...6...........^..........X....j..........$M..\|W.......X..pY...Z..........`o..`l...H......H...........$\|..x... ...t...............8t...s...............O..$....4..........C...W..P....M...t......j..."...q.........,....6..t....I...D...d..(]...!...d..Xe..8...............lk..dc...g..hn..X3...+..0............c..........l3...........X..dW..4W...X.......T..\|i.......e...........G..$S......d...H.......a..P]..........t...4_...........................v......x....F..$...0...P...x...........L........F.........p....Y......t.......D....-..L ..."...#..\)..\&..,D..$b...b...+...k...]...^..d_..`h..8....\.....

C:\Windows\INF\kscaptur.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x6fb0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	40588
Entropy (8bit):	4.005782085385755
Encrypted:	false
SSDEEP:	384:KRb4DGESc2eFBAomn27AE1z9liWv9Qtl/jAbLMrrJgwGRQbZsLWsvtde2znD0P91:qc2eFD9BlV98l/sbLNwsLWs1dxXPs
MD5:	8A8706040837DC8817CE39F3904426AF
SHA1:	6965FD2CF5552C6AD0398817D4AD9C39922D107E
SHA-256:	05DD93E917FABDD8BBD08323CF2BA20ADC45B0FC3DE6AE1EC099C9DCBDBBA75B
SHA-512:	42B9EA01D11DCA8A94A02B5C28B961CE854E8610D6B4F8C8E9C243EBA004EF43D7821E4182D345338433B93FA44A01021025E6C86E0DF23A0E18A8BC73197206
Malicious:	false
Preview:	.....................o..<.(....yl...........o.......p.......q..d....}.........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......l7..@"...!..43..d...D........6...........'..........<........1......\|D..HD......0....................4...........b..............................`...........$.......d...\"...!...C...<......0........K..........lA.......4......4Q...............(...O.......-..D....................................:.......V..x.......T....^...;..............................tG..l*...0..\|4...I...............L.......Z..tZ..x)...\..8Z...[...^..db..........T2......DR.......:...Z...[..@Y...Z...]...................%......0+......pH...........6.......h..........................@....6.......'......p:.......b...Z...b...Z...`..Lb..._..."..._..@b.......Z..d!...J...L......hN..xO.......P...Q...................9...:...0.......................a...l..........$&...............".......<... ..........,........#......hZ..`...x!...b..pb...................1..07..........\|=...$...........,..

C:\Windows\INF\lltdio.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xef0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4932
Entropy (8bit):	3.009352660786356
Encrypted:	false
SSDEEP:	48:42j6fsvge8q0kpQ/G5fzeAc6lQkvGeNRoN1H7+X6gG7l:5j6+0kpQSeAc6lbjTC1SX6gAl
MD5:	3B77D12AB88A9B006153455DDC8287FE
SHA1:	393F4AEAAEB4A1AA54F7408A318030054867CF30
SHA-256:	4D7B95D8C9BB040C237B289289A052B3A22013ED53898AD1B3738FB3295660E9
SHA-512:	4EF13EED5A97FBAE41B166FF45BEA6ABED094BA565E575E8B0EEA2010E185B08932BFD93EACDD7AA6DA06CCB73F35CA0BA8012423CD8196141A1808DC24B4C65
Malicious:	false
Preview:	................................b.........\.......................P.......H...h...............@.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................t...............................................................................\...........................X...........................................................................................................................................................................................................................................,...........................................................0...........................................................................................................................................................................................................h...................................................................................................................................................................................................................................

C:\Windows\INF\lsi_sas2i.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4140 "signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	25348
Entropy (8bit):	3.99667482223727
Encrypted:	false
SSDEEP:	384:gjj6CXxuGDyn7vW45RZDGiHwczptb1pm/41JRGD2z:zCXxuUyn7vW45RZDGiHwcz1pJ62z
MD5:	70F6AF0FE044CAAA552A1937ABFB92C1
SHA1:	7B668F0E7420AF393340BBB0622D542A362A4451
SHA-256:	17C46D6BBA3CA3C2842F10B465E149D02F83A5ED090D855465D41D7991829CC8
SHA-512:	DE0FDFC3B12C6852BA9E0422D3A92299C3968DB524D39FA61F7A4DEB5A47D2DAFAD152BC8C2223774235921BCDCB26050D9AAF682729C1918A5DF7CE7EEF1FF2
Malicious:	false
Preview:	....................@A..........R...........@.. ...8B.......D.......M......XX..h................c......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........<..................h9..................L?...........7...................5......................`)..D.......................l....5..\4..........\8...............;..4"...3.......=..................x...............<>.......@...........>...............<...............................4..................................X;...........................7.......................>..8...4$...........9.......................9......@...$4..................................................................................D#...................7...........................(......................................p.... ..(!..X!..T....!...!..."..."..................p#...........=.......8......@5...........8...............?...............................:...9..........................................................H...."...................3..............................

C:\Windows\INF\lsi_sas3i.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4e50 "signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	32244
Entropy (8bit):	4.04748102411961
Encrypted:	false
SSDEEP:	768:eX35/U8ULKzkx5ihS2uzkbwg7lavavfvAnssFaY:oZULKzkx5ihS2uzkx7lag3AnsssY
MD5:	227B676BA5115465B9021A68C14B369D
SHA1:	28F3332BF91C0D7F007E60BE3D72265E9B5C024F
SHA-256:	0E4E44C97DFBE187EB734A7E522A8FB596733AA74FE82956DAA74CD5C2DDE16B
SHA-512:	453DD40F9694A42F4B451BF6AFF43588939A6AAF784881EAF4474CA30A03546710ECC5FEAB0F185924F1DF684DF7F5247E8F3CE310026AAE0EFF7A37AB66319A
Malicious:	false
Preview:	....................PN..........R...........M.....hO..H....R......P_..P....n..h................}......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........I...........;.......F..................`L...........9...................@......................h...l...........................l ...?..........DB...........-.......H...?......0J..............`E..................PK.......M...........K...............I..............................`@......................................lH...#..................<D..................<....K..`...h............4.......................F...........?..............8...............................................l...........................D............D...........E.......................0.......>...............................!..<!..\|...8<...!...!..t#...#..........x7...=...........J..........$F...@......X..tB...............L.......................,.......G...G..............................`$...$...4...$..('.. %..P%..p....%..X'...............'..............................

C:\Windows\INF\lsi_sss.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1b40 "signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9764
Entropy (8bit):	3.5814901305866336
Encrypted:	false
SSDEEP:	192:nCFACq/UYK5MNHeuk5aaeXOC+e4LKQayeYqkF2Ld5:nUqc3meuha9CoKQHewF2x5
MD5:	CBB9374AE38E824C8EFE118F31880BA0
SHA1:	1B1F2AAB91AF695B216C8F5E65B9330A801E48A2
SHA-256:	978ABE909C3E181AD73727ABB638734E00E291672824BB0570FE6063CAA7F87E
SHA-512:	299A1B56C9DBFBD4E87DC8181CA1746DAD4708F660F6856C91041246E33355FE8EA0886FC3306D4C519A5F59538D3C8AB2AC408A57941E72C803019A0C8654CB
Malicious:	false
Preview:	....................@...........R..................8...........\|...` ......@#..h............... &......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................0...........t...............................................T...........................................P...........................................................P....... ...................x...................................................................................................................................$.......D................................................................... ...................................................................................................................................................(.......................d...........................................................................................h...........................................<...................................................X.......................................................

C:\Windows\INF\mbtr8897w81x64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x12a0 "DriverVer", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6284
Entropy (8bit):	3.3634458618124587
Encrypted:	false
SSDEEP:	192:s+OZ6t6BymHyDAAfHgcJSZ4H4aInGLmFwK:sBZ2AAAA/gcSVaInGyP
MD5:	F00F7E06E123536153779BF316FA1ACE
SHA1:	1B0330B5D95779784AA2B4C23B7B94DC2C900F6C
SHA-256:	A6300ED2CF16B2D3E6F7FB8D1D11C62DFE1226CBC93723BDF1ABFF85E2EDA73A
SHA-512:	35FBDBCC8A6EF59BCC8C65A09069A859FDF06C639FD461098D7E8BCCA2AFF00A8FE4B03E8BEB9ADA746380BB94EC08AED208A4DB482A7F72CE0797E9B5D8A64D
Malicious:	false
Preview:	.........................].......v.........................X...P.......l.......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................................................................................@...........................................................................................................................................................................................................................................................................(.......................................L...........................\|...................................................................................................................................D...............................................................................................x...........................................................................................T...........\...................................................................

C:\Windows\INF\mchgr.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x17518 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	134164
Entropy (8bit):	4.151922878266859
Encrypted:	false
SSDEEP:	1536:1osJyYqhzzOD7j45DcucHr2DEByTJRtYTisewR0gDfqeZFjrOV:q3zT50CJRt8ewHw
MD5:	2D04947B742C0015BD8A64178B49DD17
SHA1:	CB825ADF0A120E055BAEEAAE812D2D32A1340DD8
SHA-256:	E421A0E8FCF793E94FAAADB97CA65D8C536F893B0EE3A076C1EFE158B8A63E17
SHA-512:	E8D37646317258F7E6468822A247E2B3959E4C7B2CA6588025E5A7E23F81FAE3A1146D8116B5DC1EC9C1F7179549D8C66F5468B59FA62EA0774463E8FC89AE64
Malicious:	false
Preview:	................$....u..........R...........t......@v.. ...`....)..p..../..@...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......H_..\|....`..\|........?...$.......@..H...t.......t................R..........r..x\|...}...B...R...S..dT...X.. i.......Z..$K...V......H[.......r.......<.......\...?..`>..DA......@q...........p..............<m................p....7..........D........I......x....#......<...........h...........$...DW......\X......p.......l........m..@...0.......................e..(/.......s......T...@....... ...(....U..d........W.......X..\|...<f..H"......tm...........1..$&...$.............h........p......D........8......H8......\t.......S...j..t..............`......<....c...d..........t...(e.......j.......................r......."..`...$... o...T......r..........@.....................H.......t....e..D.... .......!..........................t9.......Q.................Hc..........0*...A...B...C.......K...l...L..d6...p..\p...M..............D6.......N..l....6..

C:\Windows\INF\mdm3com.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe460 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	135276
Entropy (8bit):	3.7478555548303816
Encrypted:	false
SSDEEP:	768:eCWGG8vVC27rPVAtWJqZdzpNlUX6XqnXf0n:eCWGG8NC27DV8WYZdziXBU
MD5:	6FBF3794C222665C1265E36C9CC12206
SHA1:	443A1C967DCBCC8E7F72BF1AEF15AF85205A9342
SHA-256:	76191DF94DCFF5E1726B4B12A63BAF90AA34623591695986BB30BD5CDC4B1C91
SHA-512:	F2F2F5AE70A3F9779F046FCB5D64F3ED4C581B7362145E65DD92E37C500C7C5C24E1C19699470EEB7FAB476E18D72325D895D23C24DA762FCE54CC0CF0DB3531
Malicious:	false
Preview:	....................`.........................%...X.......@....!......4...0...h...............h.......C.:.\.W.i.n.d.o.w.s......n..H.......t...(...8v..8............%..p=..({..H.......?..........................................4........"..........`..<m.........................."...#..........@........'......<%...............D..@(..d................l.. i..(.......`N......@....a..p...H........'... ....... ..............L...t)..............!...l.............. ...."......................@...`&...............!.......7......L...(...D0...8......X.......<...t..X>...... ... ...............)......H...............l.......................L... ...............T...p#......\#..........\|...l........2...#......T....(..........L............~...w......r..,...d(..4(.......(..................`...........................l$...............0...................C...3...........>......H'.......v..(....... &...\|..p............u...m... ...........r...y......, ...%..........q...).....0*...'...............o..

C:\Windows\INF\mdm5674a.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x53d8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	64196
Entropy (8bit):	3.353246139436135
Encrypted:	false
SSDEEP:	384:ML8dpyzf2CLUPiWo9K8oTEzsFzfUo4RH7p9Q9PPVYhq:ML8dpyzfpUPzTAsxfUvRN9Q9PPWhq
MD5:	609A9E5FF94F756F028C3A5B3AF80418
SHA1:	67385FA563FCFA318FB6DC4FED2BDDD614A0B994
SHA-256:	413EFEA79618079C1DBF19809690596C9E563FD791DDEAE2F891CDFF76FD44C6
SHA-512:	1DCB7ACA7B5B84D2F18B07303BAF9676BB60639C78FF1570E12D44567F89F1AF2DF71584F7498ACC103B3DCD2AEA7547B2A81A28155F8F69F3433BA1BFEA79DE
Malicious:	false
Preview:	.....................S..*..................XS.......T.......U..\|...0g...I......h.......................C.:.\.W.i.n.d.o.w.s.....<................Q..........X.......0...............................................p...................................................................................H...........................`.......l.......,...........D...........H...............................................................................0............R......................<....R......d...4...................d...h.......$...........................\"......$...................................................................................................X.......D.......................D...l...T............G......(...<.......\|...............dQ......l.......(............................................................K...N...P...O...L...O.../...3...5...8..l6..,4.......4...7..L5...7..d....Q..............h.......8....5..tK..$6...3..............4....2......................................

C:\Windows\INF\mdmadc.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2540 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	19932
Entropy (8bit):	3.4731851222706194
Encrypted:	false
SSDEEP:	192:4hwyic5bdVoF3fPB7om+pzshgiJqzXZRpPHunqIX8N33NcQ2isJMJMkJDawM+4ZF:C5bd6h1oTYhfJqzXZRpuH33YegreN
MD5:	22C03D5AE858887BEBB2A432D0E23550
SHA1:	BFAA7B748CC9E8EF3F544A4702ABD0A20705F8CC
SHA-256:	84295A1BB61842BD7F048F58E89212AE8E4DE4F55BA3C44A771B63AC9552977F
SHA-512:	94ECC423CAB7D766CA49CF156F9C55BF203711D1CA4878F7C9130C07D335622A938DB3A2EEE866E75448DB173CA95FA10AEFF5607C46962FA277EE118517068E
Malicious:	false
Preview:	....................@%..*...................$......8&.......'..(...(,.......=..h................M......C.:.\.W.i.n.d.o.w.s.....................d"..................d...............................................p...................L...............................................`.......................d................................................$......................................................................................................\|#..........d...........................h...............@...........<...............`.......t...<...................0...t.......................................................p.......................................L........................#..$...D$..........0....... ...\|...,...................\.......,...\...............................................X...4...................................................................................."..................................X.......0.......0...............................................

C:\Windows\INF\mdmagm64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x9108 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	89292
Entropy (8bit):	3.608312730561313
Encrypted:	false
SSDEEP:	768:MQ7HuqWp2W46y6iq7IPR5ZUEghshz2HWW:97HrWoW46Biq7IPR5ZNghsF2HWW
MD5:	47FAF6CC224F71BF39F06B70CCB3CB78
SHA1:	34FD21EFB52B7D28619B192647599F7125E47C6D
SHA-256:	775017EA1FFA29C77385D008A7C3B6218C25CCA723D1F9012DD9B7BB7F83BDB8
SHA-512:	8B0735340594DE887699C71852D200A5D28FFF4BE57C69EDA815A55FC5A4D2703746FE5AAB8528ED8833EDE91DC60112AE23B4A39313B2577EF0F7EA675210BB
Malicious:	false
Preview:	..................................................................X...8Y......h................\......C.:.\.W.i.n.d.o.w.s................................d...........................H+...........4..........P...........h6...........%..,..........................................`...p...........4...L....!..................\... ..................8...............,............;...f...y.......\|...!..T....q..\|....u..........M.......~..\|O..4...............z..........@".......s..L!.................h................i..<7.......... x...3..`G...9...S..........$[..lb...S...L...!...............!......................................h%...............2.......)..X)..0............................................^...p.. ....[..(I..X...Xv...z...`...R...^......,...l....................................'.......0...(..4"..."......................+..p...,4..t4.......7...7..@....5... ......`9...9..............xk..Lm...U......y..................\|...(...............D...t...............4.......p*.......%..

C:\Windows\INF\mdmags64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x171d8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	179244
Entropy (8bit):	4.036519571426458
Encrypted:	false
SSDEEP:	3072:9RF9Th5PecRrkEb3rG5GJaup26Y0TipY0eHEQ6uNe/u8ZDUdqjDqZ05Fd8HhsE8M:3F71kEb3rG5GJaup26Y0TipY0eHEQ6u1
MD5:	D09C97F2890361DFFA6AB43F748C753F
SHA1:	04E0C6A26B5ECCC5B1A058B4C0EFE9D7655226D6
SHA-256:	E522523BAC43A83A065C458BF888D6E0CE5149CBEE1798FC59C113D7E101BA0A
SHA-512:	D329E29EAF40785999E5F96357D80F3E581F3CFEDE84430450A71BEA1BAF593F8E01837F88F648F36A34A4CBAD7F2A34111B5B4CD91712DCD2A016BAB3461064
Malicious:	false
Preview:	.....................q.....................Tq.......r......hv...4..H...l....3..h...............(.......C.:.\.W.i.n.d.o.w.s......c.../.. ....k..Lf...c...+.......]...i...+..T....4..H/..XQ..8?..85...!..P%...S...5...E...[.......4..\...\....U...[......p"...k..\|h...$......D...........................<i......(....\..,g.......d.....<...............$e......T...........x.......$....l......d....&...S..t....V...0..0,...K...&..<c...!..h....T...j..\d...b...`..0h..@Q..4e..........lX...I.......b..Da..tn...%..H...@....l..<....g..X...D...X...pN..4...........$*...g...1..h1...8..4j... ..8...xi...e......P....................k...........m..............0.......D....U..x...........lc......`...................x1...........5..,G...L..\1.......U...L..PP...6..P(..._..D...........D...x.......................@l..........P...0.......p................... ...h....U......tj..............`...L...8.......$...l................A..,n...+..DY..DP..8c...............e...e......L...............................................

C:\Windows\INF\mdmairte.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1950 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	10700
Entropy (8bit):	3.491213503646895
Encrypted:	false
SSDEEP:	192:UGBofKY+KB+asw4ZmUI2XV1XxHtXekZlO/oVU:RBofKY+KB+Xw40UI2F1XxHtXekW/oC
MD5:	024403842499A79AA8D39709D7468BFB
SHA1:	5F11F9A53332E450B2ADCC8F15B921C4662F1F9E
SHA-256:	3ECDDDE228C3D773DFB56E8871779195BC97D919D2F0579CA56CE493546937CA
SHA-512:	7032659367EC9D8B3B9D979A4A74CDF5141904FF152C9AD4D42B4CE313DE25B00AD541870CE05A16D555B04919D288270B7DCEEBADD0F8D87CDCD0365720AA2A
Malicious:	false
Preview:	....................P...@.........................H...............(........#..h................)......C.:.\.W.i.n.d.o.w.s.................T...@.......P...........H...............(...................\...........................4.......P...............................................................................................................................................................................l...............p...........h...................................4...D...............L...........................(...............@................................... ...................................................................................................................................P.......8.......4...................................t.......@...........................................$...................................................................................\|...p...............................................................................d...................

C:\Windows\INF\mdmaiwa.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x38e0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	32956
Entropy (8bit):	3.571422023044325
Encrypted:	false
SSDEEP:	384:tbo7HUtvSN5xtSy+t5appI5/Pi7ERcK7mxlnNBBVX:tc7HUtvSN5xtSy+tQLI5/PRANLVX
MD5:	25A2D5F44A2D23B0385675CAA0A5CD3F
SHA1:	7DBF0D9908B832A60954F57247788AF9F21CA986
SHA-256:	A7724093C26B2439E72ADCA49F3495FE1141A92907FBBD9017153856AE9A22AB
SHA-512:	A8FF12E543C394A614EB202CAF1B1FE24E46EAF706D9824FDF4DB4387752335652F4ADA6001505FE8E9FD4B77CA27A5C720B7A4E62B971200CD2F478B1F71A18
Malicious:	false
Preview:	.....................8..@.................`8.......9..,....;..\|....C...... b..h.......................C.:.\.W.i.n.d.o.w.s.............................h...,.......................................................l...............\................................................................... .......d...................................@.......................\...............................................P...................................................P...X.......................,...................t...............8...l...h............ ......L........ ..............................................................\|...\|...............................@...x... ...........................T.......`...........$...................P ..............(... ...X.......................................H... ...................................................H#.......!...#.......#......x&...&.......%..L%.......'..4(......................`...........................................................

C:\Windows\INF\mdmaiwa3.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2b80 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	25500
Entropy (8bit):	3.500155163890227
Encrypted:	false
SSDEEP:	384:imQvYWdteuURk1bHo92ZWGBbHyFpeQ0y6:QvYWd4eZDBbHyFpC
MD5:	CCAF719F347FA043E96A854B980979E0
SHA1:	B53760B3FD4C67340159377071D9013C9BB45942
SHA-256:	040ED9C29811046599E9A2AD06E6FC9ACA503B7521ADA1313F848ED8619033C5
SHA-512:	066FBB1E191F7674FE33A251A5AE062ED2851B1F045E58F45BBEB97C51C46701849726A4EFE4562C1DC73112F28153E2576034F4CCD4F7E69A8AD1C45970C521
Malicious:	false
Preview:	.....................+..@..................+......x,.......-..D....4..h...0L..h................c......C.:.\.W.i.n.d.o.w.s.....L...............P&..........(.......`...............................................d...............T...D...................................................<...................p.......T...........p...............x...........8........................................%..@...............................(...............X...............T........%......h...............$...d.......................d...p%..p...H(...'..4...x...P...\...........0 .......&..T....................................)...............)......\|.................... .......................!...........!..........."......h...................h...........\|%..................$...X........)......D*..............................................................d"...........$...........#...........$.......................'..h....'......h'.. ...............d%..0...,.......4.......................................

C:\Windows\INF\mdmaiwa4.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xf7c0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	146108
Entropy (8bit):	3.6701070634057222
Encrypted:	false
SSDEEP:	3072:ProcAeOYx2GVMC+S201FgYn1Ho82cQvnN/hiRd4sMU6/UR38V9UwiGzXX:TfX1Ho82//hTsMU6/UR38V9UwiGzXX
MD5:	1B3159DEDCEB63EB232DC675EFE14C89
SHA1:	1831FE869CA60F112CCABA22F893E41389DA704C
SHA-256:	4094344EDD0A05021BF44258A5598A7041169DEACE7DF7D810D59B7FA1F33228
SHA-512:	58BEE06C97F94185C9DAC39F5BECD408EB20AFFCFFD080822E2A423CC5695EB40B90A94C0F8714E81705C4EDE88BAFAEC6085CEC167C12720F33E9A4FD42DF75
Malicious:	false
Preview:	........................@.................<..."...........`...(#..............h................:......C.:.\.W.i.n.d.o.w.s.........x........"..........$8...B.......:..lL.......O..l...._..(... ...L...D....+..8-.....................$1.../..........................................T'..L/..............4,...6..H....4......PT..8!...&...5.......4..X...8....7..\............$..................@....%...6..8....... ...0........9.......4.......9..D+...........q.......!...,..,&.......8..........,a.......8...{..............H;...G...%...4...(..\|'..l...@!.. ........%......lt...........7...........1...6...........................%..............H...................P.......(4..................l8..............<4..L2..d4...5..........!..p!.....@........%...!.. 5...5...5.. 6..T6..($..........................\...\... ...$7...7...<......H...x+..l...D...d'..............<.......\|......................h.......x...T....'..l.......4............E...!.......%.......9...0.. ...L...D...........x4..............2..

C:\Windows\INF\mdmaiwa5.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3f28 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	36732
Entropy (8bit):	3.543232583709642
Encrypted:	false
SSDEEP:	384:Squ7HhOqzq2NTthrI/EtPaOSmiE1BVXE5FdihIEw9AmfUyubaP4:S77HhOqzVNTthkyaOT1rhILfUyqj
MD5:	9A3265C1D457B0042A26D1B45B1BD649
SHA1:	2929A9170A7BD58BB35D2DEFF4D765EC4576F2D6
SHA-256:	06B7023EC0137191AB9CC839A3BB1755C641DF41B55625CC73114FBDB0080813
SHA-512:	A9DD3D49299FEF05A0472436531ED859A38DC0C59FEE809D2B1F51B1CCB1DE9A7E9FDA97BD34A4694AFC3F8ABF355D348F87BFEBDF7A334AD806A70E7D72D27D
Malicious:	false
Preview:	....................(?..@..................>...... @..@...`A......8K.. "..Xm..h...............x.......C.:.\.W.i.n.d.o.w.s.....x................,......H...........................................................T...............D...........................................................................L............... ............ ......8.......................T...............................................d................ ..........................\-..................,...................................\...X5......4"..0....6...!..D%......`/..\|...t...(4..x...T/..(&...................!..................................................t...................t...d.......................................,...4 ......D3...... 7...2...2...0...3..t4......( ..\ ... ..l...................................X...........h...........................................................................P...(....,.......1..<6...........2..........................\...d.......................@....-..............

C:\Windows\INF\mdmaiwat.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1aa8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	13012
Entropy (8bit):	3.392150183263852
Encrypted:	false
SSDEEP:	192:FyoVhAk9ER+hUbMYOsB5r6oHiZENhtXgBdpK1O6FVB77:FyoVSkeR+GfOG5OoHiZ/w3h
MD5:	57C78CABB685D43BEF02EE38FE902268
SHA1:	232EDF73964985F6A3D92E43FB8B363B1E3D0154
SHA-256:	B1CB03446627E02633E22B3E8BC7C77F848A113E09860D9AA1290D5501DA0B0A
SHA-512:	10DCF8D20E467E5C2154574E5231D6409DB467D5E77295772554F378324B11744F73BB81A59180A3F159DFF7E2037C0B82A0C5AD03441D4C7EC0F1264E9F7E1A
Malicious:	false
Preview:	........................@.................(...................x... ..X...x)..h................2......C.:.\.W.i.n.d.o.w.s.........................................................................................(...........................................(...........................4...........T...t...........\|...................4...............h...............................................................................P...........L...x.......................................................\...................L...............@.......<.......h...........................................................................................................................................................0...........(...4...<...D...........\|...................................,...............................................................................................................................................,.......................................................D...................

C:\Windows\INF\mdmar1.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x29d0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	20796
Entropy (8bit):	3.7035585937437525
Encrypted:	false
SSDEEP:	384:ma7PU2Zf7kLMxUvAqPYezxY+/LXK2cc0a2c2JQez:mao2ZoLMxU4qPYezxY+/0c2JQez
MD5:	D001EFFAA8C8DF3572E3081151458F04
SHA1:	99FDC14CFFD220976174FEE03D53CC5449929034
SHA-256:	E9EC59B0AB9840210819F9FF5225DE72100FC4D35E8E2B81ED4BDD1950C3D559
SHA-512:	AABA4E544E2456E58F222E487DA6312FAD3D552922BB89ECA4743D06C71BB4F8B10F2A7EB493768329DC0B0970B70BD505E90F73B414B6862EA59032AFBADFDC
Malicious:	false
Preview:	.....................)..@.................P).......*......X,......X3......HB..h...............8Q......C.:.\.W.i.n.d.o.w.s.................................\|........ ......................................l...D.......0................$...........................'..................................D.......p!..........................P...........H)......\|...........................0.......4.......\|...........p$..D...4%..........X............................'..0.................... ..........x...................\....$..0...X........&.......%...................................!.......&.......!..................(.......p.......................\|...............................................................8...................L'..........................t...,!..d!..T............%..........L....... .......0&...!...!............................................... ..........$...\|...............H................%..........."..................L...................................L...................

C:\Windows\INF\mdmarch.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x6660 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	58924
Entropy (8bit):	3.6086874148419215
Encrypted:	false
SSDEEP:	384:pwG3Fc1BlmI9rAT+QWxxejZb5zWin1eQ1c7dJ4L5WvEQwwDJP:pwhqICT+diWin1eocAL8cQHDJP
MD5:	143660BBC9D8B30748C18A941BCFDBE3
SHA1:	A67F9289C3D83DA0BA425B88044F97AB7149A66B
SHA-256:	302BDB3D7A7F603B6ABAA59D557F0B2D04A8E6C0D5DE04953451A5F23469CD19
SHA-512:	3DC66DD82F55CCDB0D77EFFCEE52A06E5C95FDF97FE69F823DB3027F04AA958ECB1D0E573BBDF8BDFA077C87C2548DE8B005F00DCAC3699272D04CEEECA51476
Malicious:	false
Preview:	....................`f..@..................e......Xg......`h..d....v...7..x...h...............(.......C.:.\.W.i.n.d.o.w.s.................."...+..@T...+...&...O.......0..dY...0.......D...........^..............p...............`.......p...........L............"...+......T+...%..<........0...R..`0...................X...6......xC..t...,;.......L...........c...........B..........4\......x.......................................`...05......x5...........`..T:......8L..h.......tc..D........A..0...x....[..........4........*...%.......A..."...[......,L......\.......tV..,...........................................................................(....................................................&...........A..p....%...+...5...G..$5...M..PQ......dW..........t.......0...L.......................x...............$........!...........$..........T............L...........V..........8B...........[......$.......,$..<...H.......$).......)..H3..............d...................H.......H...................

C:\Windows\INF\mdmarn.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2ad8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	21732
Entropy (8bit):	3.6880287842851773
Encrypted:	false
SSDEEP:	384:KqU6KXHmAQIMUTCYNbzbhF78+BJegm847Z3sRZ49w+AmlkXFVXct2C7A87+P8Lf3:K6KXHmAQIMUTCKbzbhF78+BJegm847ZR
MD5:	939B3AC2111585D84F1089F0FD6A5DAA
SHA1:	AC7A2980D06C2483D9A5BB1959305911F9E0CD21
SHA-256:	7ED5683CB1B80BA644CC330AEB0B8BB7260671FE041213ED9C2BDD82DD877567
SHA-512:	8DC364CB79B175C34FE46DFAEE1AF205216023D62F57DE5F78266821A34329A6EF14096DFD13DE7C46B2BF3901958B79CFA4FCCF14C3973CD1D014BCA0D5E865
Malicious:	false
Preview:	.......................@.................T.......+..X...(...T....4..,....D..h................T......C.:.\.W.i.n.d.o.w.s.....(....................(............... ......,).......(......................<...............................0........................%......................h........... ........"......................8...........<.......8....................'..D(...............&..0....!......................x.......................................,.......X...........L"..............................................4....&......,%..H.......p...............................P%......."...........%..........0.......................`.......................<.......x...........p...............P...........(....!..........8...x...........H*..............\|"..@"......@........$...#..0#......T&..........l%..."..."..............................................X!..........t!...................................%..L ..................D.......T........ ..............................................

C:\Windows\INF\mdmati.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x9ff0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	110932
Entropy (8bit):	3.6129578918790974
Encrypted:	false
SSDEEP:	1536:Y57Ht4XUSwTadzuYOEizXxC1+98OXVneiY:i7Ht4XUSwTWzuZETd9
MD5:	89AD25E77C23C9D99F7B9F2468989DFE
SHA1:	7DAAC693E24EA346137DBDA702B24054CE7375D1
SHA-256:	5AE23CE3A145BEE82E29E5E334DE15AEE3E8D84C11CFB30B8BAC0A59F334715A
SHA-512:	9E18851E0A72C3C723A0394558F86086182C6A925260616575DE86C2B2C3858B078D7583353142842F5C18C99E1408C8E128798F357B77C1995541E5D55A78A7
Malicious:	false
Preview:	.......................@.................p...................!......,v.. ;..h...............P.......C.:.\.W.i.n.d.o.w.s..........R............................`....... n..............................`..........`...........4...........................................\....-......4...4E..........49..........d.......(....h......$...l..............0...(...............xs...........m..........P.............................8...........,...<....... ..............P.......x...x...........\|............,...u.......=..H....&......X....#...K..............x...t....+..........d.......x....P... ..D...............4S..........................................@\|..l*.........t........\|..l...\...L...PX..(....X..D#..T"...J.......-..........4...l....j..8................................9...........G..........0]......X ..4 ..D...<......@... ...............,.............0....... ...P...........tx.......Y...w..t.......T............I..4........M..............PV...........k..\|q......,...P,.............

C:\Windows\INF\mdmatm2k.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x35a8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	25228
Entropy (8bit):	3.8209341283695837
Encrypted:	false
SSDEEP:	768:Bcv+2GtWVCh83S5nVX4HQaEzI1j1m3/FCJ9H:Bcv+2oWV68UnVXKQaEzI1jIPFA
MD5:	98FE6BACB9C1A16706788C1D5AC88748
SHA1:	46525DD9AA930962F59CA29DCF1196D492FFB90A
SHA-256:	80645FD817827A9F74BEDA52D136279D950479600A90E50EC37B9A6B1CF634B8
SHA-512:	A781541662B9DC009322C15A7B858500E0AAC47BAFB72DE04D0CD9B5B5F2098C2181D40F7C86241216EE53EE2F85D3D604A3A72C44349D031D96B3DD7D3865E2
Malicious:	false
Preview:	.....................5..@.................(5..'....6.......9......xA.......R..h................b......C.:.\.W.i.n.d.o.w.s......"..............................d .................................................. ....................(...%..............t...h3..........................%..p............3..P&.......+..........."...)...)......0+......`...........8..............................................................................D....%...............#......`)..........x2..............L+..............t%..\|$..H%..$$..(+..@"...,...+..P2...1...2...-...$.......... /...............................4...................!......T$.......)......................`........../..................L0..t..........,..@-......0$..l/...3..........H$...........................)......@,.............................. ,..................................."..............................................\|+..p+...........+...+......./...................$..$2.......'.......................*..................

C:\Windows\INF\mdmaus.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3048 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	29772
Entropy (8bit):	3.6388431839113933
Encrypted:	false
SSDEEP:	384:4vCairbIxIlD4NTtKsa/Xp/nSvd3wGJkXE6BxLaekSEvbP4XdKHYiiameEGNQTp:Cg4Epsa/Xp/Svd3bClcbP4tKHDvE9
MD5:	771B6E8ED340408152BD161254F3AB7C
SHA1:	E56EE8B39E49B8F5346C28C86A5E9D190506008A
SHA-256:	FB803AD411664C3DC0040416B99F60BA918E992BD4A33992269B7FA67B4C2451
SHA-512:	E37307E0C43365A62C68A26DB4276519AF561DE4A18497C68906AADF76B30B26AD80A872EBC3FE7E1E8027B6ECAAFDAD16D076CB7BE6A588D1366F7F13B3844C
Malicious:	false
Preview:	....................H0..@................../......@1.......3..$...8?.......Y..h...............Ht......C.:.\.W.i.n.d.o.w.s.....d...............H..........h...$...............................@...............d-...... &..@&... ......P...H'..................(/.......................'..........$.......D............/..........L...d....%......h&...........................................%..........d.... ...... ...x.......$(...).......................$...#..l...................8...........0...,...........,...............X...........h)..........."...........+...+..,,......................l....+...%..................$........&... ..........\|........"..............l ..,%...............-...-..........0...8................!.......(...................!......h....... ...........................................................................#..................D!..t)...........+..h.......8,..\...P................................'..h,.......'...+..............................L.......h'..........

C:\Windows\INF\mdmboca.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x6e88 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	97612
Entropy (8bit):	3.4186837723293535
Encrypted:	false
SSDEEP:	768:q2P/xz48RyZjPMJiyX4+w85yd7hjI7yOT7UO46RQJvzwkKUY4zQPNNOQkdKQMOOu:DnxzrEdPSbo+w8AfI7H7eiu
MD5:	7F407AB8B7D706FF6E72535DCF979E59
SHA1:	6CB476AF46CCE60FB35EDA634A622496DB0470E9
SHA-256:	D34D87F97B32AD23FA992CB8D76007F383B15498B82A7FA3162954062787BD05
SHA-512:	F3926D87C4883A2732396FFB85B58499A642A12F1E3C1BA858BAFCF7EC250E9EC79078C427A27110BA126A0026E2206C84FC283118BF2EAAD37B8298C71CE1E5
Malicious:	false
Preview:	.....................n..@..................n.......o..T....p..0........w..(...h...............H}......C.:.\.W.i.n.d.o.w.s.....P...L....W...-..<h...C..Pc..dh...g...h...U.......Y..( ......xg...i.......H..<9..@j..\l...... I...........m..<....................L.. k......L...........$...t........................R.......j..<...t...X........h.......h.......b...9..............0N.......%..............p...dT..$d......lc...c.......J..........\|E...........Q...f..Df..X...............4c..............\$..l...................0^...T..........<&......l...\|...H_..........d!...]...N...i.. c..............0...Pi...h...V...........6..........`X...........C...........c..............\|....h...........A.. m..pm...H......D................]..4...._...m...b...a...S...]..0...............t...4...................................x8..........<....h..................`f..................xd...e......@....j...T..<:...........J......\^..XE......t_..\|b.......l...................................................$..tA..........

C:\Windows\INF\mdmbsb.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x37b0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	33788
Entropy (8bit):	3.5976764167770527
Encrypted:	false
SSDEEP:	768:wIbEU5+VXvV6jK7IS6A/qFeh9UWOCT6f7pC:PbEU5+VXvVmK7IS6A/qFeh9UWl6g
MD5:	2E7FDE64519B0F7285948706F70B3C24
SHA1:	6E3F79332CC481BF715952B781E7BA9913EA4DCD
SHA-256:	CD0F6FE9C76F2A73B152E9D878B6B47C2C5D560581208654CCC1A270CE42565C
SHA-512:	A476C2DDFDB9FF9A9AE1298DD87DDC72C06F3FD87B4D1F8DA26C39DBAC623AF0FC694018319AE353E33E8103019636952430E1DA31876D26A10597837FE9E79A
Malicious:	false
Preview:	.....................7..@.................07.......8..D....:..D...8E..`....d..h.......................C.:.\.W.i.n.d.o.w.s.....p............... 0...........................!..............................................................p........................3..................p.......,...............................(1..........................8...L............"..........D#..........T$...........#...........$..........8.......L...`...t...................t1..................................................4...h...t(...1......x4..,'...3...,...2.......,.......(...'..........D'..03..........D5.......&...........4............... .............................. ....5..............$...............4................'...1.......4..x,......L3...1......`.......0...`................3..........................p3.......................................................................4...........0......P/...........3...........2...................1......p...X ....................................... ..

C:\Windows\INF\mdmbug3.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1db0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	13812
Entropy (8bit):	3.5009160359842313
Encrypted:	false
SSDEEP:	192:JGlhHyz++/OlsIxvJaCHi7qLxXE7AaovLzTseAjpx:JGlhHw++/PIdJaCHiOvLvUpx
MD5:	BCF8C938C4DAAC14DB9DAB2F16715CC4
SHA1:	5022988DFB768343F152F6B6462103888E195431
SHA-256:	336C0CBFDB97AD38FEEF8C38A353F131EA69C88275CB165129247D7DE525A8A0
SHA-512:	39D21EDCD7333247045A70EEEE0821389DBE052C7348B03DD596B3232A89C94659277AD31F2AC73FEA670347079565722AA7DFA6D125D61ED8F65B1B1CCECD49
Malicious:	false
Preview:	........................@.................0...............p...l...."......h,..h................5......C.:.\.W.i.n.d.o.w.s.........................................................................................8...............(...................................................`...............h.......d.......................`...................x...8.......(...............................T...............................................\...........................0...........................................L...`... ...H...........................H...........................................................d.......................t...................................L...........................$...............$.......T...L...............l...........................p...........................................................................................................................@...................0.......\|...................<.......................................................

C:\Windows\INF\mdmbw561.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3c20 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	36236
Entropy (8bit):	3.5207536010038303
Encrypted:	false
SSDEEP:	384:ouoJz7Hh7Gqaui4649k4NlbsXEn8vE7w9qSRk+FTNWBgCeHTwNhO:oLz7Hh7GqE4hzNl8E+RXIBgCGTWhO
MD5:	03A47CE9C7D4FF17DBB8A1C6C612B8B6
SHA1:	495D7C7E6E056AA944430236122AAA0F861E4815
SHA-256:	DACB79CF2246B3E5BD5280A5EA7A379D37FF4146653AD8EFF29898A84D4707BE
SHA-512:	E333B5174A4A80282135AD33A6B5665F407ECBE35ACFF4F68A21833A930A78D85FC82AE24496A466CC7A322655ABADEDDE628A99019ECD2DC53D4F8D51875F10
Malicious:	false
Preview:	.................... <..@..................;.......=.......=.......G..."...j..h.......................C.:.\.W.i.n.d.o.w.s.....................0)..................................................................4...............$...................................`...............0...H...............H...........................X...................t...............................................................................................d.......................................................................1......\....... 3......l ......,..<....!..l....+...+..P!..$...............,..................................................T........................+..............................................x..../..4....3..8/.../..L-..40...1..T.......$...T.......@...........................................................`...........@...................................L............#......x)......T....2.........../..........L.......0....#..$...0.......................................;..

C:\Windows\INF\mdmc26a.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3330 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	30844
Entropy (8bit):	3.417856497196956
Encrypted:	false
SSDEEP:	384:cikH1mhIlWYEbdhBUXcTlVYMOniR2N4Ktxvr:QH1mhIlWYAnl/iQ2Nptxvr
MD5:	21D51FD3451B4B17B18AC7D96F30BE1D
SHA1:	C7CF2A50E34E157664315654AFED8C947BEC56EE
SHA-256:	91B0A60DCEA64428F589401A5CE37B64CCAC76A827CC7C038DCABD6F17D98908
SHA-512:	7C4D5902E2296EFCD482E31D8C64E0F8C7CBF5F90D9BA253D1F70612B67AD0236B28469EA7A58670AA50487506CDED166AFFCC464DFA29A503405C4B11515F4C
Malicious:	false
Preview:	....................03..@..................2......(4.......5.......<.......Z..h...............xx......C.:.\.W.i.n.d.o.w.s.....$...................................................................................T...............D...........................................d...........t........................... ...........P...............D...........,........................................................................................#...........#..........P#..........h.......................................H...t...(...<............&..H....................'..........T...........@(..............................($..........................................H...............................\...\...........\|...............H....(...............).......(..........D)...........)...................................................................................... ......l....!...........!..`...P...P!...........!...... .......................X......\...........................................

C:\Windows\INF\mdmcdp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1ce0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	17044
Entropy (8bit):	3.2929529315149373
Encrypted:	false
SSDEEP:	192:RvIAloZ0c+x7+Fs8C4MA2fNOO1kL4vnXdXqfoocW4oJVK:RvIWoZ0c+x7+u8C4MA25t8K
MD5:	EBCB775BC25CE1FC8FA26A92858EB21E
SHA1:	EE5D11815BA043404AD74F981EE9C13D083E9291
SHA-256:	9B65A1AE461A256644708C6A1BCE22817FF7794954129888F3CF19991DEFC8E3
SHA-512:	A9EAB65B930B6B3D51DBD3BB26E0804E2429066EF5FBE2A6A470A02207D4F1F74BBA940280E6684EF9ED6628D8B5700E88A64D68BC09A9C5FD00E47922624145
Malicious:	false
Preview:	........................@.................`....................... #.......2..h................B......C.:.\.W.i.n.d.o.w.s.............................................P...........................................................4.......t...........................................@...............x...............h........... ...................................................................................................................h...................................d...................................8...L.......@.......T...............$...d.......................P...........................................................$...................................,...................................`...........4...X... ...........h...........................................................................................................X...................................................................X...8...d.......................................P...................................

C:\Windows\INF\mdmcm28.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x8f18 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	139116
Entropy (8bit):	3.2686613325538403
Encrypted:	false
SSDEEP:	1536:pAruhvUnxmISZll7W0bG95Cg0YUbtXbwm7bIb+5cgsLl/2/t:GrAvUnxmISLl7W0bGPM
MD5:	2B4D00F9EC4ECEEFF7B9A3D1686384E5
SHA1:	7BDD51FBF2CC4AB9590DF79D5EB851D951ED03D5
SHA-256:	8010A6DA359BD874CCEE04E59BAB1D7AFBA3E195D9A2E0A82754D3636586F528
SHA-512:	A907B547208952CD988994025C1EDED25AB69F8AB32F31B7913299E197F24C21A000EE196AD18949C9FFC0C81F4C56F527940D25047F00D90DCC41804FE81DDB
Malicious:	false
Preview:	........................@.....................(....... ...0...T.........xn..h...............h.......C.:.\.W.i.n.d.o.w.s.........,K..LX...<...S...T...P...T..(T..t ..TT..HU...T..._..$[..`E..D`..h\...F...Z...Y..T....\..0\..\[..D...d`..x(...[...Z......T4.......................:...)...(..X9...........;..P-..H...H..............p...0+......l...........P...G.................................`H..@$....... ..............\...............8........<...6.......B...........!..l....P..P%..........0F...+..80..\G..8...<(......./.../..d..("..x7..T........Z.. ...D%...J..\!.......E..pP......T....P..x-..........T...........................Hb..................t........H...)......4'...........$...".......r...).......&..(&...K...\......0U..$\..\\...Z...$...S.....0...8-..D-...+...... ...\|...............x....................-..4................I..@M...)......0L..dz..4}...z...}...O...$...\|...~...\|......(,.....\|[..HT..DZ..hU..P\...w..(...\|}..<{...x..........x...\R......Dc..\|............*..............tb..

C:\Windows\INF\mdmcodex.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2de8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	36116
Entropy (8bit):	3.393517063096638
Encrypted:	false
SSDEEP:	768:umXuMl4r932gdEUqB9ENMWMF3sUVE6XS/:7+M+V2gdEUceNMxF3s81XS/
MD5:	EAC256670F26E48D82432AB355ADD5B4
SHA1:	4A59E781328723124620E2E877CB816085F16879
SHA-256:	97D22BE0A5AFED67E83225B7DA2A052C69C86EB2461153FB8635EEF0B8899DE5
SHA-512:	837EEC974C22C802CB86A7622CFFC445209BD5CA2A6DA04DC953B127004407EB4BC4FA5FBB9357EDE06388864093EC6041CFD7CFAD1C2A978B4F5CF5A96EDE1B
Malicious:	false
Preview:	.....................-..@.................d-..........,....0..H...X<...(..pd..h.......................C.:.\.W.i.n.d.o.w.s.................<+..t.......(+..................................................T...$...$....................$..H........................(..8(..............P.......`"..............4...........................................d...<....&...... +......................................................,...................H...........................p...............................................,...............\%...$..L$..............d.... ..............D.......p$......\...................................................D...........................<............................%..........X...h...,'..,...$...P...........8.......@...........@...t...`........#...!.......................$......\|...........................`...................+..t+.........................................T!..h...................................X...$#.......#..................................

C:\Windows\INF\mdmcom1.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5c00 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	61636
Entropy (8bit):	3.678365020372529
Encrypted:	false
SSDEEP:	1536:37HyBAwKvrUIUS5U/6eWJsXm7lt6tIupYIhKY:37HyBAwKvrUliU/6eWJsXm7lt6tIub
MD5:	4C5B2984CB2884ABACDDD802542E50E4
SHA1:	46025CBB149E6B2F635C6935402CD1951BBD7AD1
SHA-256:	7EC079E6481B74725D8FD896CBB9A5EE52E006C796B84578A64A1B5A34B64E01
SHA-512:	89AC7561898496AA71E7A20B38883682638D482C248E45270A86ED8A84DD4D04FAC1BA509E11F1E3E9E6B5B3B36BBDD9AB8B9A65561814B4EAA21F06287C1AF3
Malicious:	false
Preview:	.....................\..@..................[.......\..X...P_......8u...=.....h.......................C.:.\.W.i.n.d.o.w.s...... ...........(.. (.......#...)..d#...$.......................(...(..........@....4..D...........`(......./...........................2...2..................H...........,...........H4..X....,................... ..\|....(..<...."..@)......................................@...\+.. )...........%..............t.......L...\.......L'...3..\|................#..P...............<............J......h)..8....!..t...T1...0..l9.......L..T....7...,...,...,...+...".......9....... .........4...............t...........lK...............K...%.......K.......K..,...........'.../..X/.......1..$...............dP...:..\ ..\|/...P...M...:...Q...#..D ..........D...........80..p........................9......l....$..t)......<".......6...&..................P%..\&...........,......LK..$I..l............N..DS..........L5..d..............., ...........<......................................L=..

C:\Windows\INF\mdmcommu.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1e00 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	13012
Entropy (8bit):	3.6188329014850558
Encrypted:	false
SSDEEP:	384:edxsoqtGQlKX+w7gWkj/OIdafUbq9iXhQKXX9AO2+Zt:ixsoqtGQlKX+w7gWkCbU+9+N22t
MD5:	A9529F3FFAF045FA8CD2036B32E75483
SHA1:	F7D6E183863CB1F57D86E11DC0788239E6459477
SHA-256:	3A207E1BD99B34811DB42A1313EDBA743A196D46872F443FBD928185AC6101B2
SHA-512:	E876B6B6A18EA003BC5BC816B3AE370F19588811A1314151B3CCFCF1C2DB0EAC2CB041B59EC6C4163CAC78ACC07026601E1BE008CCDA668AE5D5C6881ADF51E6
Malicious:	false
Preview:	........................@.................................. .......#......P+..h................2......C.:.\.W.i.n.d.o.w.s.............4...............h...............................................................................................................................d...$...........................................H...................X............... .......................................................D...................<...@...............................L...........................................t...\...................................................8...................................................................D.......................0...P...........................(...........................h.......................P...P...H.......0...............................................................................................................................................................................,.......(...............................................

C:\Windows\INF\mdmcomp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1cd0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	17028
Entropy (8bit):	3.284968455980759
Encrypted:	false
SSDEEP:	192:fbH3O2mv0GU+Scf+5spSSMA2fNeOVkL4fnXdHqfooxgI+TNLK:zHjmvHU+S0+qpSSMA2tpK
MD5:	9B29A63B8B9DA0D79BC33C87676A4E13
SHA1:	A75A49EA61D2053279BB666A45A5B77227C6E9E5
SHA-256:	75E1D0306F0C2BB3876E81E5A028659E784048BE98238DAE97E7C7313A64E2CE
SHA-512:	ED82B808D6CCE519ED9D0C032FC9C2F39019B088DE3BEE056B00D0873FA7F36D554BE1875C5E679A93A1C0D647330EDB0AB2DD1410C1069B7EFB3D44C9270FFC
Malicious:	false
Preview:	........................@.................P........................#.......2..h................B......C.:.\.W.i.n.d.o.w.s.............................p...............@...t.......................................@...............0.......d...........................................0...............x...............X...........................\|.......................................................................................p...........d...................................T.......................................<.......0...t...D...................T...................x...@...................................................................................................................................P...........$...H...............X...........................................................................................................H...................................................................H...(...T.......................................@...............d...................

C:\Windows\INF\mdmcpq.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x126c0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	233308
Entropy (8bit):	3.5817023896994065
Encrypted:	false
SSDEEP:	3072:4l77xVKfPPCONFV9OQ2/hDXU9hd+LHX+u68:Dl2pDXU9hd+LHX+u5
MD5:	ED91749120146E6984A02ED1DC87ECB6
SHA1:	F154FF11B3E0EE85DA8A72A2725F5D115929BF45
SHA-256:	43D68B39296943BC0EECEBFA4DCC2562339D700B73EE84CB7BB1265D68E9F0F7
SHA-512:	3CFD8D9A8379EA9A864FB904CF250F5C9EB7827BA1E3976C9BFB72B9D103196A6A73582D59EB9B473BA0594B5C855E489892A86072614004D07B5E2147DFB641
Malicious:	false
Preview:	.....................&..@.................@&..G....'......H-...G..(u......@...h...............X.......C.:.\.W.i.n.d.o.w.s......$..............P....2...M..4".................X.......T...8............2.......1...(...0..,....0..l...,...xB..X...........h.......t...p...........`...L8......H....2......8...tF.......C..L....1......t@..dD.......C...........M..h.......C...............=.. .......H....>..p...@........N.....(........C......t+......8...D(.....X....7.......8...!...M...F..........<...................<B...?..d....$...C...S...8...7..,7...T.../.. \..@....\|...t..xL...M..............8.......,..........@.......X....................................&.......=.. ... ........".............. .........8g..XJ...J...s..ds..(t......T...t........s...=...7...~...~.. E.........0#...............+..........@....F...F...-......0/.. -..........t...x.......lX..h...............x>...&..4...\|....Z..p9...q..pw...s...t..@t..Xt..H...X...X...........P7.......=..XI...........5..........xC...)..\|....G...N..

C:\Windows\INF\mdmcpq2.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x69b0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	66380
Entropy (8bit):	3.4795468987913405
Encrypted:	false
SSDEEP:	384:FcDGjrK8nfFY8Z6zpgimCzvqfoFVrFbS2NiTX1+b8SqnnvfXy3m:FzjBfFY8zimCnVrkJgm
MD5:	E58452C36096AF130C4B8BB27CD1C5FF
SHA1:	DB33067E1BDC42F4225EFCF9126D81DEB608D709
SHA-256:	95611BB35AE679EE62955181EC16A93561C5DE793C25658B32B578B13B5FC7F6
SHA-512:	28A7C27ADD60F513BEA26BD504474E215B797A61F06A2157D702DB0A2E9E6BDF357196BD8922B0A5F78A23F1F8E4316D1B19B2A157F65434278F150681D712FA
Malicious:	false
Preview:	.....................i..@.................0i.......j.......k......(\|...C......h...............H.......C.:.\.W.i.n.d.o.w.s.....<................d......<...........................................................4...............$...................................................P...............L...........................`.......................t...X...................................................................................8...X................f..D...t;.......... ...p...............p............=..\...t....'..,&.......+..(%.../..h....,..t....1...6...........2..........T...............................................p.... ...........%..........p'.......G..<........I.......?..xH..pg.......g......, .. &.......(...3...)...K...-..........0...............d...`.......................................P....h..........\)..........41.......L..T-.......W..,2......4R.......L..(Y...4...X.......d..\|R...[...[..pY...........Z..........8\..........8...............................................

C:\Windows\INF\mdmcpv.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2430 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	17260
Entropy (8bit):	3.612070778401677
Encrypted:	false
SSDEEP:	384:tWt+2IhofJfO0egW/DzX0JX9AhqrDzq2+1AQUf68MBX0mYuC:tA+rofJfO0egW/IrDzqR1AQU6W
MD5:	770EF29209D27D11202B33E2755B9E98
SHA1:	7E82A4DCE74C0A67D906E6AAFEFE192CBEFEE033
SHA-256:	0246D487617316BCC23673DBADA275FBEB86EF0D2E9B49EA1A74D4A85E888A4F
SHA-512:	41C18FA5EB7FC034358C37AED7C64A73293E8686FACB1BAE95ECC6E259BAAE9B6452F9FDF4B1103E849200E3F91BAEE71F13A0192B43F41B461A828E10B70058
Malicious:	false
Preview:	....................0$..@..................#......(%......0&.......*..H... 7..h...............hC......C.:.\.W.i.n.d.o.w.s.................................4.......................................................p...............`.......h...........................................4...............$...................................................................................................................8...............................................................................0...................,...........d...............\|.......h...D........#..@.......l"..................@............................................................................... ...................................X.......X.......p...........................................@...D...........................................`...........................................D...............8...................D...8...........l...............................4.......\|...................\.......l...................

C:\Windows\INF\mdmcrtix.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2fe8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	29876
Entropy (8bit):	3.6481901162864796
Encrypted:	false
SSDEEP:	384:5fjx7Y2Y+UJgGTgWYzEeV1K6cCY9iXX4XKeR437R82DGQjWsfZ:5N7Y2Y+UJgGTgWYzEeGhCW4u2j
MD5:	ACACA8435885585D54BF0B7AA882D183
SHA1:	79413474AFCF13883B14FCE45F1562479880CD80
SHA-256:	2F5F017516C83EC45F1179D0F980F4D7550C869E90E7D9E8E58806C76D4F0CB3
SHA-512:	F63EC2C5DB6301BED7C1881D9B41C374F02B08D2F648A224C76FC19EA12099C5C1C534280CFF7057F8C6545D9DFF8A5D9CC603DD86FA6B06815B6D0E4456B010
Malicious:	false
Preview:	...................../..@.................h/.......0.......2......p?.......Z..h................t......C.:.\.W.i.n.d.o.w.s.....X..................(..............<+.......#...............*...+..,...D...t....'...-......d#......."..0/..............`(...........(.......................................................(......\|... ........#..<...\+..l...............................`.......H"......4 ...(......$(.......&...#..H)..............P...........@%......`.......X...........d ..............................H...............4...t....)..h).......)..........t(...(...(..H(..................$....+..........(...................h"..............l........&..........X........"..........d%..............l...........(...........\)..8............................... .... ..............................................h...D...t....+...................$...................&...)...........,..........\|,......................................\...............4,..................................d$..............

C:\Windows\INF\mdmcxhv6.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xba80 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	134604
Entropy (8bit):	3.877726621714099
Encrypted:	false
SSDEEP:	1536:VU7l4I7RnoGIG4JiFBcyCWzFBn8O62ZoH2Jej+4cteM128NOfiVVszUOfqzoJdb1:VU7l4I7RnOvJISGuqzC9
MD5:	F17ADFC03B66CF082F1B0AC640BEF4AB
SHA1:	CBFDE2C603F2233184A2278A49746981BD096E2F
SHA-256:	5A0CAE11038331D790B182E541F78E7B2506E8816E47C446375D9432300D57AE
SHA-512:	20127F04DA10DD70AE0E9F644C6CC1CCDEC9738B631B4480170A516FC03087FB6D92A44F167C4AE2B6DD97E352BCF2B8D0D19A8E586411BB2E3E83B433E03BE4
Malicious:	false
Preview:	........................@.....4Ne................x...@........+..........0...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......................pT..(\|..............0...P~......8................}................0%...\...]...... %..d...........l...T...lW...8..d<......t?...@..d$......p....B...E...H...G..,J...^...^.......R...X...Z..p....T......,...p%...W..4........V...`.......................a...U......k..,...p}..............\.......4......................8\|..xJ...\|...........2...x..........8....\.......W...}..x`..$l...`.......m..X...@'...`...O..,6.. ......\^........D_...e.......g...g...d...7.......#...i...j..$k...j.. f......(g...g..,'..........0h..,$........... ... ..........................L...8......H......0...<.......\|_..X...D...d..........,...\|V...#..L........[..........`...........\...4...............X...........T...L.......X.......\.......h....X......................xL..t..........$N..x....>...@..P.......d....B...^...\...F...I..x...H4..tN..\|R..H{...0..P...

C:\Windows\INF\mdmcxpv6.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xa288 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	123364
Entropy (8bit):	3.810033427446689
Encrypted:	false
SSDEEP:	1536:FkatcGXCw2KM8/xZzFHl2HKbm2YXbU3q25PsoNAqkkkihhcz:FkGcGXCw2KM8/xZxFjYI3q6kkk1
MD5:	C72F3498290C8F54BCB2764369B743A4
SHA1:	F858AF8A0A8491CCA1950474F86D59FF361A9667
SHA-256:	09737154574F1DDE8531ABBAECCF4911AC91DA151670B520A1E360513B5CF0B2
SHA-512:	926EB3ABDF0E5C302D2338DB7763802995A0CC966F8912CF1F2CB9C2AF4E27E507709EF7F04367DE04EA3AA0BCBE6864E90C878A798B9DA2294B1B460DAA52DD
Malicious:	false
Preview:	..............................4Ne.............~...........X....#......d...xY..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S............................W.......<...=..0................}...{...~...T..d<...................C..Ty......\...`\|...z..(x...@..P}......tI...N...z.......~...\|..h\..d5...6..\7..(8......D_...S...".....HW...[...T...]..X....\...U.......3......,...........@...h...............<Y..................D.......(.......\......0...(...........x....4...V...,...V..................`........^..(T...'...(..HX..pT..tf...j...\...r..............d...t0..0........n..\|T..\....S..x...........l_.......%..h...T....<.................................l-..H......../...\......T\...X...*.......%..H.......,\.............4................T......`....$.....(......h.......x\.. )...)...+...+.................. ...._..._..0................................................B.............................................p...4.......PM..X......8S...R..@....%..(U..x...............l(..t...

C:\Windows\INF\mdmdcm5.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x6d28 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	124772
Entropy (8bit):	3.1452878952227166
Encrypted:	false
SSDEEP:	768:NHRbv+EyQ+gFQwNiE7CwvEwe3oxTH/E6qCB46E8Im:NHt+EyfgFTQE+8EexTM6q7aIm
MD5:	FD25C8808751D10E6D61540809BE855F
SHA1:	0BB8E275A22F103DC3E38033A8DB148943492C33
SHA-256:	05C5581142E612EE91208FD16D0A668DA0FBA402BDC20E4A6AA1DC58BD456F2D
SHA-512:	117F1DAEE4F97B3A5E7627C6076098F0EEED1E40D58BFD4A3C62994453045B0732513BE4FA42F8C1F16B21E7BA7EDB689C5DFA2CA6CB66ED752247DEBE4F68C3
Malicious:	false
Preview:	....................(m.."\..................l...... n..T...xo...%..P.......X>..h...............`.......C.:.\.W.i.n.d.o.w.s.............................D........................................................k......./...6..@>...............\..8d...e...e...f...g......Hi.. j...j......P...@k..Xk..pk...k.......k......................................@........................................................l......4...h7...?...........U..`]...d...e...f...g..Xh.......j..8....k..(.......................................<...l... ...............T...H...................................................................................................T.......................@.......................\|............ ..H...p.......x...L-......X-..............................................................................H...$...............................T ..............."..,#... ..x....$.......%...%.......$...$......`&...&..l...................................T.......................\...................

C:\Windows\INF\mdmdcm6.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4700 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	48588
Entropy (8bit):	3.51141026893243
Encrypted:	false
SSDEEP:	384:N0YR+Zu8f7QMONktuit3Z4OUq1tV0QAc3Q5n+de9yAg8J7q1pOEPh567xHGgadM4:eYR+Zd/1eg87+pOEPhndJ
MD5:	5C26FCECA460BBFF045ADECD1647CCC0
SHA1:	1987D495FCA39BEF7DD4948444A74E77024403A2
SHA-256:	0366C2BD219DA39F2EF1266085692F34F8B4CBB786FDC37BEFB2C1CD148D3455
SHA-512:	D12BCBF9B2204260D5F9CCEED276EDD77491E0862E66451F4C9A2C09CFBDE06381B821AEF68476D3C8ECF1B60335A6B9FFAF1BAB9A8A6051FBF035E80197EA4B
Malicious:	false
Preview:	.....................G.."\..................F.......G..@...8I......HX...2......h......................C.:.\.W.i.n.d.o.w.s......3......d........................... ........................................0..D3..........................@........................,..0F......h...h%..\|....-..............@2......H-..........D.......................,2......T.......................................................................................@0......................./...5......................`...0...................\|3..(1..X4......x-......P...D....4..............8........"......................................................................$...........x6......,.......h....!..P7...........7......@....7.......6..t...$....D..`6...D..............<...............................t&..........................0+..x...T................1...............&...1.......2..p:...:..(8.......3...%...=......`...4<..\|<.......=..4>...................'...'.......(...........(..0...D)..t...d)......................

C:\Windows\INF\mdmdf56f.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x38d0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	33748
Entropy (8bit):	3.4784610168956784
Encrypted:	false
SSDEEP:	384:9YCxGHT0mMqSSFiXxy4TrkBuAYWR7NNvkiq0n+:aCxGHT0mMq/iX2Ek97+
MD5:	BF8BCFA475FDA2B15E0865FDD5B644E9
SHA1:	873A3A9A2D41881DDCDB45C0C746560588656434
SHA-256:	554DB818A21B9DF2695A295F435E7794EEB158C3F93AF06C5B0B9AC238B6329C
SHA-512:	F8B3C8D84060A55A37BFA4879B5051265226229034ECE0BB854D19856BEC034803A64BA17BDBC4848703D6E677424CD855E99ED7DFAFC6CF6FFDC63C19FAB347
Malicious:	false
Preview:	.....................8.."\.................P8.......9.......:.......C..( ...c..h......................C.:.\.W.i.n.d.o.w.s.....,................%......H...........................................................H...............8.......................................................4...........p.......h...................P...d...........<...........P7..........X...........................................x...$7..........................l...P............&..4................6.......................................-..x...,...4...........T...X....'..\........,.. -...'..8....6......................................................x7..............................T....7..............................h...........0........+......./...*..L+...(...+...,..h%..$...$...\.......l................................................$..........................................t............................%......H&.......)..............@+..........................................................l7..........T...

C:\Windows\INF\mdmdgitn.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2bc8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	27940
Entropy (8bit):	3.44911999312366
Encrypted:	false
SSDEEP:	384:uTV/HvVStkP2dB+b5iXFQ1aXKZDFIQHj/c2:uTV/HvVStkPV53Dnj/t
MD5:	C258D3D7C8C0D47523C518D2FD654D9D
SHA1:	0FE1F0A7A1401F4B7FEDE9809BC42E160285F481
SHA-256:	4FA7C82642FB2931444DDC90166E8D3156DFDCEEDA55019147209D312110C887
SHA-512:	35A8973FA73EFB081908DFF2CF4D43DB4A2EB775A9B552A44224F109572915ABFBEEBCE542C5A3B3A7446207104B3DDEA1315218150BE6D93A070A28B42EE1DD
Malicious:	false
Preview:	.....................+.."\.................D+.......,..,....-.......6..D....Q..h............... m......C.:.\.W.i.n.d.o.w.s.....................8...................,.......................@...........T...........@...............................................P...................\...............................................l...................................t....................................................................)......d...0............)..........<...........H...............................d.......\|...(...................................@'...........'..........@...................................................`......d...............*......P...H........................... ...................h............%...........%..............x...............................................\...(...............................l....................................................................(...$......\%..@)..........x................"..........................................

C:\Windows\INF\mdmdp2.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x25e0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	24564
Entropy (8bit):	3.3781232318366925
Encrypted:	false
SSDEEP:	192:w00IhCZpTWhmaE+IMWP/DoHkqivfB5KZKZyimaNHldYkyegCKQFTnMkJDawM+N0f:50IYnTCmaxIMWP/MHkqivfBkHcmH
MD5:	B9B0E4E434037C3C6C676AEE682CAD78
SHA1:	DE9D79A879395CB81045BEC0E213239C1D967277
SHA-256:	2C5FF557060627BF2EE6EAF4AC09E700D14FFAAFF640966A7418481D73AD902A
SHA-512:	B6749D49331AE2145D937517EF216EA13176511B63BFDA3E8CBB70C121D52C8E75E4A2F0EA555888A2056D785CB0AD19B98FB653FF635C7E9F00EC657D57A2E2
Malicious:	false
Preview:	.....................%.."\.................\%.......&.......'......@........G..h................_......C.:.\.W.i.n.d.o.w.s.............H...................H.......................................................................t...........................................................................P...................`....!..........4...........L...........................,...............T............... ...................,...........................................................D...P...............$.......\|.......,...h.......h...\...............8................................................................ ..........\ ......D...........\|.......8...0...t.......D...................L...........H...........T...P...`.......D.......\|!..................................................................................................l........................... ........................................................................... ...............................................

C:\Windows\INF\mdmdsi.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x12688 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	254300
Entropy (8bit):	3.537942119942084
Encrypted:	false
SSDEEP:	1536:yNleKGVY/sPwRYFsOlFCODopACcBJGEqHYH0E/:yNleKGVYUIRYFsECqRF
MD5:	5CD824B5B0D0D14C14B06E37B459781E
SHA1:	8C511588914A4EEF0C04EA3C8E31F4C989CFA39E
SHA-256:	DD8AD5AC5193E72A72C806FDF769833E55E45C8F4E42721886B550FDE7D5AB43
SHA-512:	87EBF06F30502DAAC725CC4021FC9AB026974300FA63B4C1058FAB94F0A116C160D5F0FAF1E4BEFD6BEB800806AE737D42F6414E5EE4A9D5592A7325B879E786
Malicious:	false
Preview:	.....................&.."\..................&..-....'.......+..`Q..h\|..x2.....h...............X.......C.:.\.W.i.n.d.o.w.s......[..Xt..........."......$....#...!..H"..h...........@%...........#..H....r..H...p...T.......(...(............,..h........%......X............)...)......8...@*..x................!..po.. ..........,....i..."..0#..D ..@F...........r......` ..xk...(..@...............$...d!..D...<$..h...@.......$.......t#...[......L...XV....... ... ..............8.......8...`....P....... ..\|L..........h,......\!...T..< ......hY...X..4............#...s.......k.......................#......................\|.......\|B......(...............<%.........h$......(%..L........7..L!......h....g......lh..x1.......3..l..../..h.......@\|...z..xH...\|...%..\|...h...."..h#..H................?...........P.....\|.......t...x7..$"......x...<U...-... ...Y.....8.......$.........4!................... ...h......d...............4\|...j....... ......X...<a..h ...d.......................!..............d..

C:\Windows\INF\mdmdyna.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x7370 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	94524
Entropy (8bit):	3.539712450002004
Encrypted:	false
SSDEEP:	384:1K0NK3u3UH7qJcyV11XyyFIZ0vEsn+IejWKJ3u/KYTfIyBCl2hVpa0vx/cJC:1KkK+3OqOyVd2sn4Je/FrIz2hVpHvJmC
MD5:	1C4359F2848FA408B224FBF36952B60D
SHA1:	7C3C25F5028997B5CABB66E5BDAF6C1E7C85DD5C
SHA-256:	A2CEB01E94535C4BCE853AF60981C73F312D27310FD47A9C2038D1332082B319
SHA-512:	CC687416D39E57B559897761FFD9A7142C6916AB0AE6918517AD405E5F5415A9FA4579CE245419D3F4E935C8B5A0D4A795C651CBC98DC59B80218BACF25092DB
Malicious:	false
Preview:	........(q..........ps.."\..................r..,...ht..p....w..........l..x...h...............8q......C.:.\.W.i.n.d.o.w.s.........8e...l...T...e..........e.......(...e......T...xe..X/......\|...t...d_..........H............^..........@+.......h.......J...r...,...1..........lS......p"...l......x...Xr..$....D..@.......<!..PB..0....&...l..d.......`...T"...c.......&..<...Pg.......................)..................................;......D....U...O...A...[..........0"......x..0)..........._......Xq..4`.......!...-...F..P........$...1...#... ..."......<V......$"..Lh..t7..d.../..,#...E... ......x...X.......P....B...".......B...k..................d8.......+..d........E...A......................8-..X=.......&...O...R...%..8q..(r.......p..@j......@&...%..`)...)..t'..............................4D......x....)...)..8C...........h...b..............................@,...N...(...,..h>...0..\%......................./....... ...............A... .......'...................................C..........

C:\Windows\INF\mdmeiger.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3de0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	44020
Entropy (8bit):	3.449424091123746
Encrypted:	false
SSDEEP:	384:qjmY7HdOb+P6qzkQuWW52VgrUZruxP9J+Jhyx7k8TX7tv:c7HdOb+SOgrUZruxPqhaTLR
MD5:	D4C570778C1C4949C92C267A848A191F
SHA1:	A0B96E1379C818F29ABBB930CAB8317DDF3335E0
SHA-256:	CB4E6BFEE6391F58F93246239726C95004979459D2AE1DB68319356041DB81EC
SHA-512:	0008FA6078204831E86A70A251F9725CFB40C0BA706A76B3D12A879458C4B9F7638F7ECAABE98AD74E56643CE5B91966B581A5B7A7A8EFF23FBFD4B5D23C252E
Malicious:	false
Preview:	.....................=.."\.................`=.......>.......?.......L.../..X\|..h......................C.:.\.W.i.n.d.o.w.s.....0................8.......=...............9.......7...................................................................................... ..........<!........... ...+..$....!..........\|...........T.......H.......x.......(....<..........................................<...............4=..............P.......<.......X"..X+......X7..8................<..$............&..\|........'..........h...h!... .......#..@ ......\....$..4....7.......&...... '...<...................................................................................(...............................................#..<.... ..t!..."...'..."......\|%...)..........4...T...............................................................h.......................................\...@...................,...................p1..,....... 3..........H2......................0..........................................

C:\Windows\INF\mdmelsa.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe940 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	166556
Entropy (8bit):	3.663462651905801
Encrypted:	false
SSDEEP:	1536:Ey2BZnbDPgaxVDxr/tjsrnsYsQaVG5CCiiwzfiJ:Ey2BlbDPgazDxB4rnTvWhiwzaJ
MD5:	E845E1626A9715F0EF3097434A77204F
SHA1:	9368AA1A9D34A65E465D299488ACC0E15B105640
SHA-256:	AC26D2EA4F53CD432C10CEF90D3639FA56F887CED8F4B586A2BE52BFAD1F8DBF
SHA-512:	7731D7EDF8FF158B81C7C924FEE8E13B5FD9570255B0E97D9CDE2DD9BC1D3AC51F373E16BD49749E1832B90D99061667247ABD2258E80965CE67624259406ED1
Malicious:	false
Preview:	....................@..."\.....................D...8...P........5..X%..$.......h.......................C.:.\.W.i.n.d.o.w.s......,..............A...5...M............t...\|....P..........<..........l$...%..........T,..,...`(..$........@......@...............HC...C..x........ ..h...........x.......X........ ...N...w...,...t.. ...,O...... ......t....M.......3..................8&..0r......hz..D2...G................................. ...............L........-..X....8.....dM..P8......l"......80..X....J.......@..L...\|6...:.......B...A...G...-.......$.............. .......PM..pI...G......<Q.......9..P...\|....+...'..@'..L......)..L)...(.......(......[...6.../..0H..\|.......7.......[...^...v..xB..X....e...[..l........b..h...(...$..................PO...P.......O..8.......hA...\|......h................F...Q..\Q..p...........`................b..........4...........h...2.. L...I......T...h0...q...... ...x...x3.......:..4f.....d6...m..H3.......0..TK......\.......hG......HN.................

C:\Windows\INF\mdmeric.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3080 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	27172
Entropy (8bit):	3.545831363042965
Encrypted:	false
SSDEEP:	384:f6oDvWCtE+Kv7kA2At1dJa5EQ3DfnjynYyU1i:5DvWCtE+Kbg5E+/jIU1i
MD5:	0348C7931FCA8F783B89DFAC2C910346
SHA1:	A6E899B9F953725EA4E3C3AE2B69118E7D6B3F05
SHA-256:	A5649CCFED63A6CC0A4B817961740F2AD88E03372FD97AC8CC5BBD45DAF6BD87
SHA-512:	9B62F107E6DDBF0D59EA8D9F25B3B5A6B9A5899732A5AE4FF0293042E814F93A8AA656AE4FDCAC9C12CBE98C98AA7366A4CC6B9E96C403CAB690FB086D211A9D
Malicious:	false
Preview:	.....................0.."\................../......x1......h2......p9..X....Q..h............... j......C.:.\.W.i.n.d.o.w.s.....T.......................................................................\|...........P.......l.......@...4...\............................................)..L...................(........)................................................4...............................................................)..........t.......................................@............................... ...L...t .............x...@.......$"..............."..,...p...........................................................t-..............................0)......l)..........................D).......)...+....... ...!.......!......t%...$......d*...+..p........+.......#...........&......................,...............P.......\(......................................................D.......x...............8...h...............................H...0-.......................)...............-..

C:\Windows\INF\mdmeric2.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3608 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	38908
Entropy (8bit):	3.4712720413520373
Encrypted:	false
SSDEEP:	768:K7Ml9OG47IS7y3UxSWPsddv0xtc2xgASgF9QK:K7Mu5IS7y3jgnf
MD5:	D794CD666E364B5FE72E29A81AB4F266
SHA1:	AC82373DADAB300FE1A050169DEB706E099789F7
SHA-256:	E3BE8DEEDC52FB6AEDCC06BEBD10C6AD74C9E4B08594C75ABE1423A1F298DAA0
SHA-512:	7000F3CC91C73F9269C2115B1D173614A38C52C596CC71B1544A6217B2A668E36B9E6DBE26D74A2BF28A9395E732E7D4EF031B079921E12EAE799552F93E1C06
Malicious:	false
Preview:	.....................6.."\..................5.......7..@...@8..x....D...)..Xn..h.......................C.:.\.W.i.n.d.o.w.s......-..............8...........H........&......./.......4.. 2...........1..T....)..h2...........0......t.......\|........)..................................L........................'......L...................0...L%..t....%...................&.....................................<,......$............... .......(...'.................,........$.......... -..........D...................@........$.......&..,!..t...........H1.......2..l....1..........p................'..L......................................D+...... ....+......T.......H...."..4...................."......\...4#.. !...3.......$..p ......\| ...#...1.......$......T................................................+..d...................................\....!..................0....!..........\"..........h...............................................\|$...................)..T....%..................h....'..

C:\Windows\INF\mdmetech.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x71e8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	94004
Entropy (8bit):	3.4729859971404706
Encrypted:	false
SSDEEP:	768:Laae7FQ4r81gGPUnWO8UIHB7tteyZHH0UaKo8BVm:Lre7Flr81ggUvIHB7tJpHu
MD5:	DBBC35232089FE03C9ECC8123E98B48E
SHA1:	D0191B2EB5F8932611B14AB768CDFF5CCC3DDB63
SHA-256:	FCD4CD1C36574E39D7B171B016237DC497115778C52D4629337BFA2EB8C28F60
SHA-512:	8AE4F956E09264321F05DBAB725EF82AD0133F9A3BCAC92484F1B6848A97027384679F96BE1F07DDC54925417F63FC5C0B839D206CD2F06F4986DB0CBB6CD129
Malicious:	false
Preview:	.....................q.."\.................dq.......r..h...Ht..........(o......h...............0o......C.:.\.W.i.n.d.o.w.s.................8....j.......q..0j..di...j...!.......>...Q......Di...k......HB..<b..4l...o...........?..(g...p..........dO...l...*.......l...6..........LF......h....B...........J.......K.. ....l...V.. ...\|.......Pj..D....j.......p..84......`........#...................4..8...pk...Q......8q..8g...........................,...H..ph..Th...................q..H...........t@......TK..lC......h...4...8K...J..<....%..L.... ..(...X.......8...x"...l...M.......p......D....L......Dk...j..HM...........................n..........D.......Tg......H5..0...0....i...........h...o..$p......D....<......@...............hB..Hp....... ...L......\.......x...4n..<...........................................X...4.......Xj......8O...P.......h...........................G......................4...h.......<6..\........E...........o..........L.......h...............................................

C:\Windows\INF\mdmfj2.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x32f0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	28404
Entropy (8bit):	3.48337589243557
Encrypted:	false
SSDEEP:	384:i9HThLNImLSQAacQh6zdU4lv5z9rEZI4b5Y/HEk:ifNImLfAN5zUXbeHEk
MD5:	442F8388BF239057BF3B05E7D9DF9299
SHA1:	E652C45D3E1A5F54B972828CDF453CECB6A59B34
SHA-256:	BD62020F383BBD2CB95769C8EEDB0054843BEFB98D3F8E86562A8E96ED682494
SHA-512:	E535DD05AF6566B0471E3121ECA0AB66C65D62736C53F476191F35506C2D73A02ED70311D26CC0249138A2E5AB02A788AF1440DB9ED5EFA7D11BD0C0D1107EF9
Malicious:	false
Preview:	.....................2.."\.................p2.......3.......4.......;......hU..h................n......C.:.\.W.i.n.d.o.w.s.........................................................................................D...............4...................................................................t.......t.......D...........0.......,.......h...........d...........................................................8...........................h...........................h...........8...............................l...D...........`...@...0.......8.......L...............................................................................................................h...................................\|...........\......../..........t1......$... 1..........P...h...,................2..................................................................................................................$....................................................)..........L....!.........0"..........!......L+..

C:\Windows\INF\mdmgatew.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x6e90 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	104716
Entropy (8bit):	3.331299954211213
Encrypted:	false
SSDEEP:	384:67utRFX8ilggIlphgHmk6ZVKQKbTfL9xXVsr75jl60t8k/EcpBs16s1LlYH7wvq3:YutvX9lGlphQ77q5jl6NNSBgzLGbBS0
MD5:	A776020229AB4E8C7C1A29CB6B3E6CEB
SHA1:	225605E6E9A96AEBD4B54A2E6ED478B36DF39C4B
SHA-256:	85740EF91FC5FB4DB0672684E61776CB50B45782D57C235FBC9212EA19B546D0
SHA-512:	C7F894985283FD2F16D5203C959A7421B83EACB5F91BB209D6E6EF2ED719EAE8AE0D03D576324A4033512C934EFF46A03D13D88B7817048A3EA835F7A0BF2454
Malicious:	false
Preview:	.....................n.."\..................n.......o.......q..............H...h.......................C.:.\.W.i.n.d.o.w.s.....(....).......<...-.......'...+.. .......`....a..(Q..<1...m...R..\1.......U.......................R..........p&...............;..........0I...e..X...HZ...!...&...U...\..T...P_..($...`..(!..........L...0...l!..............(....(..@F......L!...f...1..............d....F..H........1.......'...........e... ..............x=..l\.......P..0................'...#...........T......``..<W......4&..`m..(`..._..D!..`5..4+..H%...%..@+..........D/...,..tZ..80...'..."......$a..P$...#.......Z..............4....................... c......Hc.......G...........(...................................i......H....(...g..........................D'...%...#...$..("..0b..............\|3.......................$..p$.......d......t...lX......Hl......pc...c...c...c...l...[..t#..............,'.......m.......m...m...2......p........_.......m..T.......\|....`......................t ..................

C:\Windows\INF\mdmgcs.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5f98 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	59820
Entropy (8bit):	3.5317706227190766
Encrypted:	false
SSDEEP:	384:jqs8vUDdaQ7X3fzPmNlZ6ga0v3Ks1PGJnW0T:wUDEaPLgaAaOcW0T
MD5:	9F3AB5A2FBAF6716C21679E6120ABAA8
SHA1:	6A1BB3BC0EFA2753915E8F20C02332D3354E4D8D
SHA-256:	FF4ABB89B5898FC105E2DAC52D7BB7672EBC87BC77BF0A5FE8DDF4B02B8E89A7
SHA-512:	947B0CA9AA42EF2CF47DAE92F30FF3F717B67FB540068782A6AC5C980D443C08502CE5FA73DA595EBAD196575F60CE0C5191471FF8708D389341D49B78FF47C4
Malicious:	false
Preview:	....................._.."\.................._.......`..T....a..<...(q..@<..h...h.......................C.:.\.W.i.n.d.o.w.s......7...........6..t(......X...(.......................x...............................d...............T.... ..t...X1.......................................................Q......\|...@R..<.......P .......,..........`....8.......................,..........,2..................D!...>..........X....;..........d<.......$...<..........<...T...............<........... ]..$...(....\.......1..8...\|...\|....^..X....$..p^..$H..p....T..............(U...-...-..(...................@....=.......@...........@..4........................=.......&..........d&...........&...........^...,.......-...(......<...hI......8X...J.......V...I...+...)..........8...l...,...............0A...........X..............\...."...Y...........Y...........Y...N.......V..0T.......'..l.......dV...[...)..X...<*...........[......x....F...+.......E..........pF..................................................

C:\Windows\INF\mdmgen.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x8758 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	110916
Entropy (8bit):	3.574012471316048
Encrypted:	false
SSDEEP:	768:RDIHkZMczUuKyZ5LKgKCtVlwRxzbLpBRYK:0kZv1KebK+sxYK
MD5:	94847959AA7FF70C99D128042D75EF02
SHA1:	BAC4671CC5F7F5E3E99AF258A4AEECE67262C4EA
SHA-256:	8CD37FD88DF1085D63A79299303A07F60433ED3A43F3B35D8E59DFC1036EAC0D
SHA-512:	47386923D86C45EA9D30DC28189353AD6EFCE7463E6E750200C7D1DF17FABA520F340679A98BE0F754D716C95FC4A50301E1D9EAEAD4B1EA51D387B7E45E5211
Malicious:	false
Preview:	....................X..."\.....4Ne............?...P.......@...."..........0..h...............@.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........"...U...`......8\...h...2.. V......\|-...\......<....................q...O.......................#..........0......\Y......8;...!.......A..H....-...6..........B..H.......X..../..D5...,.......c.......'..x0......,...........1..\S.......-.......W...................T..L#..............t...................<...d.......4F..@@......._...$..............1..4(..........pO..l.......P.......)..0%...6...6...,.. R..4&...&...%......T!..$'...T...L...X..d&...1..........p5..\|1..................,...T...\|........`..............................@T...+......<6..........h.................... .../...%..x@...k..<%...&.......o...h...Z..Pd...0......d(...(..41...2.......................................,...+...,..H%.......X...R..................................?..@/.......................l...\|...z...s..l'...o.......~......@-...j...'.......-......dq.. o......P...........

C:\Windows\INF\mdmgl001.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xafb0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	107156
Entropy (8bit):	3.4339187262068394
Encrypted:	false
SSDEEP:	192:Hk9dc+dxB1UKnWbVKCQWyk0IgyslJNDid2HcdR7uzzxzg0V5Hq8SKhaEsZmnES+m:VLNugSeXbDSPLWV27zLs4aqfJQ6
MD5:	5EC7A8FC4F506A33400581A07CF1FA12
SHA1:	D203497EE6BDF166F621731FA82AD71060843957
SHA-256:	B4C5B982EFE9E97F9219D2D34F99CCFD1FBFE8CE4280D9B5E0AE864AA47E9ACC
SHA-512:	9639405FA2FA3567B60E096629B068D93492E8EEC7C8B749D138016C77A544A0D1D7A2E78CAA34865FD9AF0F49C3850256BBDD13508E9AAC166D7DE481F89729
Malicious:	false
Preview:	........................"\.................0...........d................l...5..h.......................C.:.\.W.i.n.d.o.w.s.....<........n...H..........0....z..@j...z..............e...2.....d........l..............Ds......$!..................H......H.......<.......(...................8...........0...\...................d.... ..............TE..........,c..<........5...........X..........................x...............................................`...........D...........(...................D...........l................!......P...8...........p,.................................................................Tz..........@...............................................................................d...p...<.......d...D............................5..........XX..........................T*................... ...4..................(...................................\|........g.............j..........\|...\...<....i...y..........\|...................H...X................r..............

C:\Windows\INF\mdmgl002.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xd1c0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	123452
Entropy (8bit):	3.580817324972982
Encrypted:	false
SSDEEP:	384:gz4awsrqKlwkrlAbWk66Z+tqfnvo1lBHZFRRfW:yrqK2kOWkZktgnw1XHTRRu
MD5:	A5237D320E073ED1A9D90870CA6A5369
SHA1:	2FEBD273774563F51186184C7854DA25BCCE3B74
SHA-256:	B024C5150F0F2F0D44361ADE72F231D67F12096E5211787FE2F303DB1D13639F
SHA-512:	07CB85ED106D32CB203CF984C65116D9DE41E4F3723162F77F8983BA9CE48EA2DDC4AE9789E7D828B676B59982A8E8B1F3C77E609EECF848E7F55EA423554A49
Malicious:	false
Preview:	........................"\.................@...........P.......p...x...\z...g..h...............8.......C.:.\.W.i.n.d.o.w.s......N......x=......P)..$....)..@....J.......3......`3..........DQ..........\~......................................................................................................\........?..........d............!.......m..............p+.......Y.......................................................................=.......................k..........T.......................<....5......x............................%..T*..X.......H..........L.......4................................).......................2..................................................\ ......................,N..............t.......h.........................$Z..........p...l?......................xL..................d...(Y...................$......,4......H.......(.......h...(.......................\|.......................................1......p...........\|...................................

C:\Windows\INF\mdmgl003.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3588 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	101876
Entropy (8bit):	2.9754269669597755
Encrypted:	false
SSDEEP:	768:rp3WkZKWzF4bTiEn8g8S8vI8g89iES8vY:rppcW5Q
MD5:	FC8F735CCCE2B51DE6665A888A2B7488
SHA1:	6F3CEBEDB4D601639FC4B13B32207A45C721D1BB
SHA-256:	91B86BF10FCAD28C65119A04DED19F4E96A1C57ACB847BADEB2D1981137BBC9D
SHA-512:	CC1353D7DAE380F7471B15772FD5972201CEEF41A1870B8416CD088871C5C43947F36BE4D6E76386F972D6F1318E7C187BB77118289F5BD6298A2670C6B1133E
Malicious:	false
Preview:	.....................5.."\..................5.......6.......7..`!..pX......0...h.......................C.:.\.W.i.n.d.o.w.s..........,......./..<4...4...4..\-......T"...-.......$...-.......'...-......0(.......................'...........(.......2..............................x4..`2..................,.......0...............................................$0...................................0..................X...............................\... .......P$..@.......$#..........\|%...........'...........)..........l...t...X........*.......%..p...t"..........8,...$...1..$'..............\................1.......................................................1............................................... ..h....... .......P(...........#..x3......................................................................................42..t+..................................................................................................................................................................

C:\Windows\INF\mdmgl004.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xcc88 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	1542780
Entropy (8bit):	2.858293845365994
Encrypted:	false
SSDEEP:	3072:Z0uRhv18KnyLuEn76WQ1UIAwPVWvFSWdxIhUB:R18VuQ7xgfZyFS0xI2
MD5:	D38F98625ABDDD1CEEA597AD72EA84C9
SHA1:	3BC15B8F67AEA0544C5B3A6097F6146B504BF4E1
SHA-256:	E4F6998A6F2A0D4F629540E2F859849AD24261146A8E1967AFB64976F87801D0
SHA-512:	E6A4882662C68CD2CBA9B76AC8E067E4CB460974AFB72C342404EECF0EB4388F98C64DA27A9F81563C7CAB86B571247752E01F65B4D91A35998C862DACFF0452
Malicious:	false
Preview:	........................y.....................<...........0...t.......h.......h...............x.......C.:.\.W.i.n.d.o.w.s......N...]...<..8...\|:...:...:...8...8...9..49..\9...9...9...9...S..h6..\|_......\|...<...`....f..$................d....;...;......./..............1......l.......................lL......................x................9......(8..TB......LK...K..\...l................6..x.......$:..8...P:......................1..@.......d......`....6......<.......p............7.....................4...T-..."..$@...5.../...!...I..<........I...I.. J...,......\...<..............,.......................$D..........................lK.......................<..8..........XF..............0......T'...%..4"......&..x$...;.......;...E...@..<E..........TE...A..\|....F..........................@.......................................\|......................l]...k.....t...$....d...........[...l...E...A...1..$E...D..l@...... F...D..,6..........H...d`...Q..Dl..<...........`C..............

C:\Windows\INF\mdmgl005.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xc018 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	113196
Entropy (8bit):	3.5476813475388354
Encrypted:	false
SSDEEP:	384:NhpIbiC9zNj6fnCx52OTEYnr9vbWk666B2SUJBWVeQ/L1YQoX3pqox:ruuE6fY2sVDWkZA2xrOix
MD5:	CB3FA7D0D117B41F4B613CB3E790F79A
SHA1:	A684375D9C5D13836BAC732C484BF56C6616D741
SHA-256:	A20E7015A89CB403210542CBA59E3F01F7AC211DD2082E8D2BE2BA86CC2CFE78
SHA-512:	94C9AA530850DACFE2B027740A7141D86D3DBBDFB0EAE041152D745DFBF1792B9F0B8AD2611FA4F00F663508DC4A072985BF07634AEF913022FBF5565C71E762
Malicious:	false
Preview:	........................y.........................................h....o..HJ..h...............(.......C.:.\.W.i.n.d.o.w.s.....4j..lw..<u..........T....n...{...#...M...g... ...d......((..tC...........Y..h... ...........................................................................................\|...L........9......h9......0-.............(t...............m...z..................q..0...........Pk...x..Xv...............o...\|..8......................................................d...............................p...X...............\|&......h...\|!..D_..<....'..\...................@................................................................................................#..............................L....p......<...`w..0u...n...g...j.......F...........X.......8...................................................................%.......-..."..........L*.....\|...X.......\|...`......4...h...8......Xl...e..d...........(j.........................p...................................

C:\Windows\INF\mdmgl006.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xb1c0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	144188
Entropy (8bit):	3.3857506641413297
Encrypted:	false
SSDEEP:	768:knVdDUlWsu9zPi3kFwE/LO++ezZCjV0uiSD/K:knVdDUlWsOijEOS
MD5:	472D7CF4A180BD597C39395A50966D40
SHA1:	B172B8C70D63503AA14124B4365A874AE726DB0C
SHA-256:	CFFF39D4454036027BECFF4DEF1B1BC69EAFC9BA439B58CCDF38EC4DF6979342
SHA-512:	9D1AE55BEC948317FCE5A767D9CB11807ED0F6FACB124DF48B00A791A029EDD6AB34F495D5320132309C3D100AEE1766A81A86453EBCD0983C433E7B94243E88
Malicious:	false
Preview:	........................y.................@....................'..X......H...h...............83......C.:.\.W.i.n.d.o.w.s.....@4...............A..............0H...8...........9.......X...G......da...n...@...@..........d?..\I.......J.......?.......?...............................5..\|4...................9......06.......J..T>...4...7......T6......................p6...........l..l...4.......\........E..\|A...E......DA...........6...<..h.......P<......`F...H..........H4..............l3...........7.......Y.......3..db......4...L6...........d.......B...j..\|...,C..8...XC...E...9...............:.......I...............D...4...C...B..4G...C.......T..._..`A...V...V...>.......5.......D...F.......C......l5......x(..H7..h)..x....k......8@..hP..$N...Q..LQ...6..<7..p7..\H...7...5.......................T......4^..@V..H:..$:..........\|+...=...:..8X..hE...`...a.......f...A..x....c...........h..Di..P....8...2......(...............\P.......?..XQ...Q..,?......$9...............I...I...I...5.......W..........

C:\Windows\INF\mdmgl007.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x13200 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	220204
Entropy (8bit):	3.5307100075508315
Encrypted:	false
SSDEEP:	768:W+44HEq1Wkgb2HJcYWVmvIJ6dDDBBTQka58gc8Xb/Ky7DflTTXcOuNG463mDj:W+4EXTO2pIEdDDXTQWNGO
MD5:	1A0A7287918C71C5BE0995E230C30675
SHA1:	6DB126584FF6387A339259CD3EDEFED074C7E9DE
SHA-256:	3B0984A1A6B3694650EB71CE5D81816BDA4E5AEA25000118652E8CA1AE3F10B4
SHA-512:	5AD5BE80C7E6DD2D71D39A834DBE62C0250ED89E1D897F6343E5CF806B32B2FCB7E06E6C16BA86DB82432AFAEA9B5064D43557A814E7DEB42322A10EB2BDF435
Malicious:	false
Preview:	.....................2..y..................1.......2.......3...5..8i..t....b..h...............(\......C.:.\.W.i.n.d.o.w.s......Z..hv...w..D...PG...h...E...L.......J...A...q..4@..........d.......z..\|...H...................x8...........'..............l... ...8!..........."......P...."..$...H....#..t...................4...\...........`....X..Lt......H.......D........-...............o..4.......H....a..l}...x..`.......... k......(.......X]..........81......X...$........0..T,......x...T&......P....*..........,....-......`...H.......\|/...............0..........d............................................I..........tN...........C..........................$U..............................................H&......T...........,'..H...<... ...\|.......,1.......+..............\>.......................8..........<(......dV.../.......T......................0.......([...v..0......\|....h..h.......`Y...t...........W......0...h.......H{......`p...>...m...........~..._.............x...,.......`....]..

C:\Windows\INF\mdmgl008.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x8290 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	79908
Entropy (8bit):	3.457075896641433
Encrypted:	false
SSDEEP:	192:YaA7oy5B+FNvzH49cV4OLryyxqoNKKxDfJh2jIVv8IQvUNML6FB4W1AHjPaIVepL:vA7oUBLtVj8wv2271B2SlqjMYaS
MD5:	334543901F745E4F16D90352C0FD2B3E
SHA1:	F141BE3AD02DAACB73DAB7A72B64E33A3E148A80
SHA-256:	D8C1FA18FEB819EDF7F29C19C53801F3E18084D16D3D9D7C209CFA6E14886C21
SHA-512:	3727E5E23A51ACF6DE2763B25C8A78C8CE2A9B418D91FC0C97E8FF684FE7F553CBA43C3EFB7F6203308C6BA371B3657683405BA34B710BA78F2BB23C23597388
Malicious:	false
Preview:	........................y.............................x...............<Q......h............... 8......C.:.\.W.i.n.d.o.w.s..................F...G...................H...I...q...s......tv...w..4L..@t..Xu.......x..............................p.......................................................................D.......\|...\............................z..(...........`........}..4~..................................................................................................................................d.......0(..........lK......T...p....c.......p.......h...........m..........................................................................................................$.......................`K..........<(...7...............f..X...............................................................$.......................@....!.......... $......xP...(......`U..T&.......R..........W......................h.......x................!...........#...... P..H(.......U...%.......R..\|......\|W..

C:\Windows\INF\mdmgl009.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x14320 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	226028
Entropy (8bit):	3.6117794330500264
Encrypted:	false
SSDEEP:	3072:6I/Oajg4ENRkS62UR5J+OOeSOOeBOOeifOOeqkp:j/OGHE0e
MD5:	67BCF3FC6C982F8E2C693F4DE4DB6017
SHA1:	71555C0310C0C41EC8294D19E59EA26876CF05A4
SHA-256:	AAB38F54E94C18532B1E70229F518F3F1563C684841BEACA162C75F582BF8323
SHA-512:	ECF77DEDE39783A44ABFC30548D4B3067C1CA12BB922347636585D0E20A48DC7E2535E5E19CDB7DD4AB10235E4FFE7A2EBF05DF333DF90362A176095944723DF
Malicious:	false
Preview:	.................... C..y..................B..W....D.......J...=..........}..h................r......C.:.\.W.i.n.d.o.w.s......'..l.......$....+.......%...4...2..,....Q......L9......@,...2...4..X...lE...'...)..........\|....8...............7..@`...9...?..D...T)...(.......w..TM..\|....B..P%...$...y...(......\ ..T....2..h.......hc..p...l...x............&..h...<B......\|...0............=..l............,...;..`,..8...X1..........,=......D....'..L<.......1..x1...@...'...>..h...p%..`....#... ......h...T...8..............t....+..p.......*.. '..L....-..\....$..dB..d-...)...,..@...D'...-......X....3..(4.............../.......... 8...5..H............?..t1......X....................>...8...........t...A..................x,..x0..\|+...6...<...9...?..8>...?......d...<5......,........&.......?..................T-..........@2...<......4;...........3.......\|..P.......=...0...;.......+...1.........(........&...;..P7..((...<..(?.......6..D>..0...\|'..,...d...................................T........+..

C:\Windows\INF\mdmgl010.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xd1d8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	150796
Entropy (8bit):	3.4232232143273675
Encrypted:	false
SSDEEP:	768:SFQIh/q4lKGCN2wbSW60O7YXfj183WVp2wQkyzAdB0721FzZgcGK0TBkWvSzEHbE:SFQIh/qZQSIR/MxZW3f8f5Bee
MD5:	584E743CD918F1E23FC2F04F2B57F1FA
SHA1:	D2580F4ADEC975D7E8BD648FA4FD1C1563D487D2
SHA-256:	3AC9E93CF24A373D9F73F3D449CBD244096661AA2B672EE5E501EF9082845086
SHA-512:	1E6D1C711AA469D1DFFE554F261E4C40B9D75596A7647EB82C420E0F1A5B1C54718D71D0612EB3CA588F0F54E65290A78C35789BCF348FDC1A629B1E25583F60
Malicious:	false
Preview:	........................y.................T....................$..x...D.......h................M......C.:.\.W.i.n.d.o.w.s.....d...........................................H.......\...\|...........L...l...l...........P...................P...p...@=.. ........K..........4P...........M......L....R......................................................................................................d.......\|...............................dU.............d...................D....6...6..X.........................................T...x...<............ ...,...#..,........+..\ ...-..............................................T.......,....<.......H...J..<q...;...O.......I..dM.......N..tR...<..@...........X....X..<;...K..T...LS...... ...1...,...2...............................................................................S...U..........X......................H.....4...p......T...T...,..........\|.......X.......< ..t1........\|.......l.......\|...................$.....................X...

C:\Windows\INF\mdmgsm.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4338 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	41980
Entropy (8bit):	3.5876704540941637
Encrypted:	false
SSDEEP:	384:RrUF0a6z2/pyOAXVKqosCFr4ogVQXCCOHFg1WBwff7fO61QnvGRH:9a6z2/pyOAXVKqosCFr4XMOiXbOTvI
MD5:	743FFD12BEC37AF60E925D3EEEC177C6
SHA1:	0FEEA2792C9DD5CA2293523B790F2592DFEC8BE5
SHA-256:	DE32C0BE383A1F99923FDD2E28B2ED0EB787449C6C193A190A6ED08545E9E8EC
SHA-512:	1EDF2B63903F15A49879C4A46E07A6BF9C0437739EC3AC36AFE5C0A6FEDE969B3B4314649418644D3B2B4C0E63CF5803979DF1392A38D63C5DFE83FAC986399A
Malicious:	false
Preview:	....................8C..y..................B......0D.......F.......R...(..X{..h.......................C.:.\.W.i.n.d.o.w.s.............$........;......d$..X........!...............%......................h.......................X&...4..X;..............................................8#..01...............!..d...t........&...0......h...............H....$......,....#..............,...t.......................D...............8...H...........D...$...(3..t3...3..........\.......H$... .......................0...2......."..T8...7.......4.. 7..."......,7......P...8+...6.......<..4$..,...........0!..........................................................t........=...................................2.......2..(........:..H<.......<..\...(9..........$.......,.... ... ..$ ..."..................................."..t!..P!.......................(...#..............\|'...*..........0 ......\|)..4)...'..................@@...)...........9.......................!...5......................<...................

C:\Windows\INF\mdmhaeu.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x18f8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	10276
Entropy (8bit):	3.457349409589094
Encrypted:	false
SSDEEP:	192:7tSueoRNIdE4PS++S8+4g5E3Dt7zQ5kX12XcHIjDcx/Gb20:JSyqdE4PS+t8+4g5ETt7z0kX12Xc4Dcm
MD5:	FB0139F9CA5340DC548FB33F8B4A9DEC
SHA1:	58EC9DBA2F9B63CF0EA4C5A56E2026646F36119E
SHA-256:	30B010A86BA8B94D7541E15A9ABC80EDCB1869C56C4C35FE46203CF772FBC4F9
SHA-512:	901C7EB589AC7B3A0345079970BBF60E7A76A25D1F4934AC912070381E3BCF44AB68C725D5329171A65CFD76CC782B5FC46AC03F92BB906F0CD7413736CB80AC
Malicious:	false
Preview:	........................y.................t...........................8...."..h............... (......C.:.\.W.i.n.d.o.w.s.....T...............T.......d...........T...................................p...........P...............@...............................................................................................x...(...................................................h...............@...........................................t...`...............\...............H...p...............X...............................................................................4...................................................................................................................................\.......d...................................................L...........................................P...,...........................,.......................................................\|................................................... ...................0.......p...................

C:\Windows\INF\mdmhandy.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x86a8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	81100
Entropy (8bit):	3.6223546823993664
Encrypted:	false
SSDEEP:	1536:SsASulMrFogWjdG6qdgrvxfxIs6qI+5bkGi:SFSu0FogWjdGXdgrvxfxPhi
MD5:	1A43466EBE7D5E857B4E2A3D02B3391F
SHA1:	B04EDE70F64CDBFBDD551E7228EB38CFDB1C77FF
SHA-256:	374B41701EC00459AFF3FC921C2715424DDDEB84AEED2C196218898FDE0FDD93
SHA-512:	CF47B7527A393E3C184A7A803CB963039585B9E6428EA09B597B6FF686A45FF5EFB2B4047E3DC1D1B3CD7B3075302F719E4C27ABFF3DDA6554FDC10ACB459B3A
Malicious:	false
Preview:	........................y.................$...........@...........h....O......h................<......C.:.\.W.i.n.d.o.w.s.....\s..........Xo..............\|.......4............,.............. ...........................................D...,{......dW...............................................k......x"...t..`...........xU...}..$....[..h...pN...........Q...........(...\...........{...........!..................L...........h....s...........o..........\...H...................."..................tj...:..........4D...)...o..\|....'..tr...q..l...@&......H...T........X......................."..`...........hk..4.......@t..H>......T...............O..h........Q..l...t...................p0...A..t`..............T........T.......+.........x)..hP...v..........4"...........................^..........Tl..........."..."...[...............n...!..x...,r.......?..T........M...Y...!..p....+......PS... ...]...W.......l..x ......(u..........$q..P$.......x... ..............P=.......,..(............S......

C:\Windows\INF\mdmhay2.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x76a8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	104788
Entropy (8bit):	3.4537976418653575
Encrypted:	false
SSDEEP:	1536:1DFDhHw8Jn2C1gDt0vtIxj14+3TNVngILW9+aCdSBdFmVOS:1FDhHw8Jn2C1gDt0vtIxZ4+3Rf
MD5:	DE160F148BF88C28C90BDFA4CC84B0A8
SHA1:	3697C21C24CFEA90545391C1A0F6D7F4230F6F48
SHA-256:	33A81EFEB8F643FD37C250289E2B9C9651EB51847E17EE901AD9ACAC2F5FF8C7
SHA-512:	0EC2613A538A4D0DEEF2E3FBB95A6F2AD7EB84ED5A7F4411C142C5C0ED1E8D93596A054A2701888A441F3F59AA28EC7689DE22A43FF8BCC34F172945148E5D77
Malicious:	false
Preview:	.....................v..y.................$v.......w.......y...!.......~..h...h...............P.......C.:.\.W.i.n.d.o.w.s..........#...(...7...o...U...s...o...n...n...R...V...U...X......tj..lp.......W..Lp..<l..(j..p.......PP..H....k...................6.......r...F...........]..8....(..tU..dO...u...c... ..8d.......q..0................p.......p......`s...1...............-...................1..x....p...s..H...4s..t....... ...............\....M..._...m...l..........X........r.......................c...X..........H)...c..Pc......d0...%..8.......`,..........<-...(...].. q...r..........Td... ...p...p..<^...........................n..d6...............i......@]..P........o...........b..............d...pM..`$...#...%...'...s...+..Xk.......%......H(...... .... ...n......H.......................................<!...!......tn...9......l1.. ....l.......B..........l........^..D....q......4X..................PE...*...,...,.. ........j..................................................................

C:\Windows\INF\mdmhayes.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xcbf0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	148172
Entropy (8bit):	3.5370963488491602
Encrypted:	false
SSDEEP:	768:mU9WgZ7CcCh33kwUUrmphW8N/sU/EWRijURDB0fYCdb:mUggpEh33/mphW8NH/vrCdb
MD5:	889F7C159722268E9746A4AD89B3C479
SHA1:	E1647CC2E55874C44F767AB176BD8D40F5597499
SHA-256:	A22F37F029E08882751A981D13ED134FF7D3DFE91C1127AC120E13DF54775E9F
SHA-512:	25B79599B22406CC7D1486F7642AA90DFE1628C5C75BCDD03D8E3649AAE200A0DA469CEBEA86EA0BF9BB2EE9905BEED5E76E5E35F447C6975843CEA7DE684527
Malicious:	false
Preview:	........................y.....4Ne.........\...........X...@...()..h...0.......h................B......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S................................................................:...........D..pR.......J...... ...\G.........H5..L$......p..........h.......`....l...o......d... ....}..........X...h................5......4...T...............<...8...........0............P.......$..<...........8...x.......$...<0......0..............~..8k...n......."... ...{...$...................................;.......$...E...!..."......$1...&..\H..d"..`1..4....(...+...0...1...(..l...........................\|".......!......0#...........4..............."....... ...8..4....... ...............8%.......Q..< ..L....0...1.......0...0..<1..l1...2..H#...v...+......L"......\.......P ..D........\|..................A...8...........................9..<:..t...DD...D.......I..DJ..l....F..........,M..tM......L...@...p2...0...1..T1..x1..h!..................4"..p ......P4..........................

C:\Windows\INF\mdminfot.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3758 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	42716
Entropy (8bit):	3.44531317317346
Encrypted:	false
SSDEEP:	384:fAmTX/4JQZ5bH8Z21OAJ5cyiU/fSfIwcG81FXI+h3pF82wWH3:fAmTX/4JQ3XiU3EMGXmH82wWX
MD5:	8D8E72C04A5BA2E226B30B77EB03DF72
SHA1:	56D4297A6FBBAF7BD3385B2C8CDE05E7B85BBA08
SHA-256:	769F18997DBFD0083FF2849459D68D077F735FB61675B0A442D93FCF35E16A53
SHA-512:	DB6A3C8DA88B89B5E27677D889602463F45869AA4D09C33CBB715DA145B458064F9B5E24DC3B41B8E0A61985045902E63BA349665308C9FBBD5A5F7E5E18E2FB
Malicious:	false
Preview:	....................X7..y..................6......P8..T....9..@....G..x/..`w..h......................C.:.\.W.i.n.d.o.w.s......................2...........3...2...2..........................X4..........84..P0..<..................../..\|.......P................5..................,...............h.......D.......p....5..............0....3.......4..h...8................................................4...,...4......d,..........4/..........L...........,1...0......................................................@...$(..h.... .......(..p ...$... .. $...... ....5...'...5...5..l...............l....4...4...............................2...................,...................3...................................#... .......'...!...(..l/......T$.......'...-..T........2......<...................................................h2...................0...................-..........l....5..........................P(...(..()......8...................p...........,...............8.......8...................

C:\Windows\INF\mdmiodat.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4660 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	42532
Entropy (8bit):	3.503880011898171
Encrypted:	false
SSDEEP:	384:PgslopUm7pvwgvn7uyPZT61ZAIziVM0XKe2XMok+RqlOpcoeXTlt8yNZpJuEZblx:PD2B7pvwgvn7uyBSAIzpXrR1eXw7U
MD5:	732C8D8B5D8F552EA6FE7B6A1E9486E8
SHA1:	20ADF860B99E8DA2245211B3B01ED0F26B5E4435
SHA-256:	E7DEFA72C36A078DC935F002D7A4DA50772F79992E3AA05493DE82D27DA58B35
SHA-512:	076C7D44827C8B5FC3C97800A8899EB3CA70C310A76AC89E574F7551FCA37004C84D9FC068E71C0A42F4D15BE546DCD9E69BB3DED2155F5478EF36722C8B08E2
Malicious:	false
Preview:	....................`F..y..................E......XG......pH...... S...)...\|..h............... .......C.:.\.W.i.n.d.o.w.s......................@..................................................................L...............<.......$...............................................l........................-...................C..............x...............................................................................<...\...........p...X)..........pD..P.... ..h................................0..............x........1..........8/......l..../..x......../..........X........................................)...........B.......;...A..........P(....... ...(...............4..."...........!...........!..<...................T....................B...@......@...p........B......................................<...................@...............<#...7...........1...4...#......45..."...3...6.......C..\|5..."...2...5..................................x...........................P...............H;..

C:\Windows\INF\mdmirmdm.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x98b0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	136092
Entropy (8bit):	3.5880321007290528
Encrypted:	false
SSDEEP:	768:hb6tnzjBPP+5gcnDYl93qprIhNmabg94f4sJW6stSf3bQLU4BEirdOr5:1GzjZP+aiDYl93qprIhNmugWf48kh85
MD5:	531881759FCBA13F49968D6F828C8C81
SHA1:	40E235CCF7BE325EA45ADB25B98A977C78520115
SHA-256:	CB317CF2E11BB07F73A3DB28CA72347F5D2D09F2381D835B6A676C2F4DB5DF45
SHA-512:	257A899A5178B386D0B06FE1C1837258108CF35AA2F314D1029049D166F995404E3111E348F2B063DF018229C1D1BD5416B301A1FE9E3DD9EB0CB8ACD2FF01FC
Malicious:	false
Preview:	........................>.../....#.......... ...^.......X...................q..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......4....a..4l..0Q..\h...5..tj..Lb..........H-......\m...........Z...b.......[......x... ...,.......X[..l...$....:.......e.......F...+......dM..t........A...<..0p...N..X...`...L...l=...@..H=......Py..X8...<...8...p..@q...'......<...._.......3...4...c...#..............<`..@........6..D...............`....................R...K...........;..................n...........[...=.......\......x:...;...!...B..d!..L^...0..$1...1..$V..,2...2..43..\|X...d...Z...s...u.......@...=...........d..........\|............l...x......8/.../..4...X;......l`...........A..........po...............<..\|....<...-..8....A...;...\..\Q..(...PW...f..p........3..........@#...<..........................................................(e..$_.......&......................<8...9..................t...T,..."..................y...................................?.......................=..

C:\Windows\INF\mdmisdn.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x6b10 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	90700
Entropy (8bit):	3.50618952522517
Encrypted:	false
SSDEEP:	768:CosAxZwFnoHSh66iKzP4ZXmGJxhOJxh3Cpym6N0N9:NsOmFnoHSh64zP4ZXmGJCHBYym6N0N9
MD5:	C6007C5B6F83870B9674A4614AD1D45E
SHA1:	2F05E1990270DD6E68E4E694DD17B72DDB4172D0
SHA-256:	9F708DE468AC18FB0676AA845398879D60F925DF8150A9F80D21E3573966539A
SHA-512:	EBA306CD9E20376EDA8994E364EFEEC0BE95D4EA0180990BDCCFFB1E1619C630A0244F16E22FEE125DE79E8143C38A27086EB326DD1C27D072B0CA39F5C5304D
Malicious:	false
Preview:	.....................k..y..................j../....l.......o..l...(....j..8...h...............Hb......C.:.\.W.i.n.d.o.w.s.............LO...............D.......B..l@...^..0A...@..L'...4...A..h*......PA......(^.. ...HY...............]..D5......H...............L"...!...... ....=..,...<............8.......0..$=..D(......H8..........LG..(\..,.......`....<...!..........h)...)..xZ...Z...`...V..L$..$ ..........4...TI...Y......\...........X...D....4..............l...\H..$H.......D..p1.......%.......................5.......#...g..`(......d....3.......0..x....h..`h..$N...h...h...D.......3.......P..<............"...A......TP......L....................................(......(>...........$...L...................'..\|J...C..4&...E..`F..`;...3...@...;.......b...2..........@2..........x2...........................b..Db...............................5......D........................1..<%...$..L1...2......($...".. "..x:..lC..\|$..........lg.......g...........N...,.......2...............(...............8..

C:\Windows\INF\mdmjf56e.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3bc8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	35692
Entropy (8bit):	3.5058740434692153
Encrypted:	false
SSDEEP:	384:SMnovhHhh+Jmy6GvOsqi8PqN7XuIPXEbZ0g571SSJF+eh9TwfIok5qi:NghHhh+JmsGVCN7XtJg9oK7cIok5qi
MD5:	E01E00A1F5C8DC819D3744EBA01971E7
SHA1:	B673F29A316DCF697DBFB1ABA1B57CBDAB9173BA
SHA-256:	C137B3707FA6D0607380D18B10BE8D858B0EFF67F3D1277FFEE676C9662F6E30
SHA-512:	B37F72ECF14929D6728742AE5169B986F973563A90AB3F7A2487DD1479EEE9E99BA43583C16E1E670F980C43C195D2D0238CC71B0D8346E4D477ACD4D26CF65C
Malicious:	false
Preview:	.....................;..y.................D;.......<.......=..x....G..$"..@i..h...............h.......C.:.\.W.i.n.d.o.w.s.....P...............d)......\|...........`...........................................`...4...............$.......\|...........................................................`... .......................t...4...................t...............................................................................l...........................4..X...............`...................................@...$2..............T3....... .....8,.......!......P+..,,...!..L..........................................................................................<+...................................................0.......3..l/.../...-..h0..@1..,...........,...`...<...............................................h...........8...........................................l...$............#.......)...........3.........../..........$............#.................................................

C:\Windows\INF\mdmke.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2070 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	14972
Entropy (8bit):	3.577242522898101
Encrypted:	false
SSDEEP:	384:GvTb37OqpweLsg2jiaA+8oYtQHe+7F3M+xIHcaJo:GvH7Oqpwusg2eGP6cr
MD5:	82CB8BA70D4BAB81E72454044C19F5A2
SHA1:	2A386851526124F19786BE121EBAE85D723F767A
SHA-256:	9BA1E7C5F8E3BD1CB1BF543D501A9B17BAA7FBC4EFBD43588FD9B9A32FB8E7E3
SHA-512:	AD95293FB5402FBA9781ED14FB77E9D4FECC3C6DD41DD734E218FE3224BD6323F157B784E2E811B8D5DD6DDB11AD43EAEF0D1282122225EBD3035D0BDB2F6BB2
Malicious:	false
Preview:	....................p ..y.........................h!......0"......8&......X0..h...............x:......C.:.\.W.i.n.d.o.w.s.............................p...\...............................l...........$...T...............................................................................,...........L...........................,...............<.......................................................................................................H...............................T...............X.......................@...........4...H...........4...................L...........@.......................................................................................X...................................l.......<.......t...........................................P.......................................................................................................d...$.......@...................L...@...........t...............................d.......................................................

C:\Windows\INF\mdmkortx.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2060 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	16572
Entropy (8bit):	3.604674581592643
Encrypted:	false
SSDEEP:	384:k5F0YVQjRbo+7uB78rlH0vkX02XcpPp+6aPU4+9U:kAYVQjRbo+7uB78rKvnjaN
MD5:	A1449F082CD9E83B54D9B07E2920DBD9
SHA1:	07075EA446FCA5230FD3D2EA12EBB2E399FC8CD1
SHA-256:	DCCC8BBFE63F9B991C283B56F26973435AED5E507A796929F1C4783060AF4019
SHA-512:	3DB01C730AE0EA1B5939D3839089F67403F15CCC0657D5851F3FBCB33F3FA18FA23566043BE81AAF50330C27A2FB2E26C3F3C6F828B0794A971A77AD0846A656
Malicious:	false
Preview:	....................` ..y.........................X!..T...."..T....).......4..h................@......C.:.\.W.i.n.d.o.w.s.............................l...T...............................x...............0...............................................................................P...........................T...............d...<.......x.......................................P...................................d...........(...................................T...........P...t...........P...................P.......T.......p.......................d...$.......t...........<...............................................`...................X.......................D...............................,...........l...........................................`.......................................................T...0...D...........l...............................................................4...............\.......t...(...........................................................................

C:\Windows\INF\mdmlasat.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3460 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	28308
Entropy (8bit):	3.692139272050169
Encrypted:	false
SSDEEP:	768:UvmjHq7NH3O3dlj9WGq+jY7g6WFeQ3mk4NzywNYGImt/qE/fvmSoZx:smjHqZH3O3dlj9WGq+jY7g6WFeQ3mk48
MD5:	A8E95AA33BB98906615064EE8FD9AE99
SHA1:	D9ACEA84D7EB1876ACC879B8F14985F09E741FA3
SHA-256:	1818151A7DFC507E420C9DAF6B703A3378BADB776B99355ADD21913B8AD1158A
SHA-512:	ADDCFA8333769288AAE3093180D9120A26D5164D0CE620EFC44E62943943574BA7A4B864A9393C3CF3C63CC61F82B89E18CE0D6EF97D47360353743CBB596B7F
Malicious:	false
Preview:	....................`4..y..................3......X5..X....7......pA.......X..h................n......C.:.\.W.i.n.d.o.w.s.....4...............$-....... ...-...+...,..........l............+..l....,..L,......./..42..L................3..$ ..............................<...........L"...)...................'......."..........X...\!...#..l...........0...t ..........................P...........4...d&.......(....... ......T.......0.............................<.......t"....... ...&..............\|$..................l...(........#..........\...`...\1..........`0...0...0.. /... ..............0'......<...,...\|.......t...<...............<...............()...........!.......-..........t....2..H3......."...'..."...#..............0..l3.......... .......<#...#...&...-..p$..........................................t'..P'......l,.....................................`(...)......0&..<0...........0...$...$..l........$...................2...0..........l0..D%..........................."......H...........

C:\Windows\INF\mdmlasno.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x6080 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	59428
Entropy (8bit):	3.5760143662628385
Encrypted:	false
SSDEEP:	384:9Xl+C4Dw7HX+nhkiQQg0qw3pvXe3R/iJqdgI+LM43x8sci2YFbnb6:F3T7HX+n2hpG3SiacMuxWiz2
MD5:	8B50A9ADA75236B341D99C8989C6A32F
SHA1:	04D0229D674E644723A4ADE4308866529D0E7139
SHA-256:	60CAC70FD8D19BA5DF5A481FFB96F83B998F28B04E12550D0447663B04A20605
SHA-512:	772A5FF54C9A044D6B9984F3B37B59704D9E9A448EA3E7AFDA02CCF6B08D507A974FAB688101DCE10AE87868B81F114FB77D428C419F57BB683462A9D4C91DFF
Malicious:	false
Preview:	.....................`..y.................._......xa..@....b.......s..L:.....h............... .......C.:.\.W.i.n.d.o.w.s.....(................$...........$...#...%.......................#...%...................(..L................)..X...............................................\|.......................L........&..p...L...$...x ...$......<%.. ...................l................0..........................H/...!...............................2..4#..<...0....N..`....... O..@!.........................../..........................<>..<........'.......?...&...'..$'..............`............%..l%..................................PZ..L8.......Z...!..dO...D..8....O..p$..l7.......#..H)...)...E..L....!......(H...H..........L....)...L..............(.... ..p!...!..4!..(...............................4_......P.......4....$...............]..."...P..p[..........P....:...P..`....&..(....\..........\|...(M...Q......pM...........N.. )......HN...............+......(....................^..h^..........

C:\Windows\INF\mdmlucnt.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5260 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	50252
Entropy (8bit):	3.583597469156279
Encrypted:	false
SSDEEP:	768:g8S7KIK9ko+m4vWSq73dlT36jjnCDlhKOTE:RS7KV9kw4vWSC136jjnCDlhKOA
MD5:	9CAB84CAA3BECA1AF9A32E3B4CE949A0
SHA1:	78DF800A8176E2C0B7EACA2F4990070F8BC8D40B
SHA-256:	E83F5692E183165900B095844C5F5E563B6940AA908204DB099E8BCC2967FA4E
SHA-512:	8B0617A9728F2DB1C375C0E28CAB807D8785E52DA89197C5D1021F21CE837BB6011F6A896A5E66C3793B44A7C2E8551FCCB8BD8B244C18BB1745E76E2AD52D1E
Malicious:	false
Preview:	....................`R..y..................Q......XS..T....T.......c..@0......h...............H.......C.:.\.W.i.n.d.o.w.s..............................................................,...........4..D=......T8..........8...t...<....(...$......`................L..................................@.......X...................8.......D.......@.......P...............\............<..`%......@................ .......P..L.......X...........$L..4....$......."..........................................................p$..@....7...5..8....@..p.......................t...............h...............................D...............T...`...P#..4%......8....3..h...........$..................."..............t%..............4...\|(...M..H%..(.......$G......................."...............................(.......1..h..........................<,...,..l .. 4..h4.......7..@!..\....5..x........9..,:......<...0...........d.......\|..............................................................., ...+......l'..

C:\Windows\INF\mdmmc288.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2180 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	23628
Entropy (8bit):	3.2690119136907745
Encrypted:	false
SSDEEP:	192:drj5nybR+jYd4U8DV8bECG+AkXzBXcOy7P9+XLegk1VwsjWlHtm:dpnYR+sd4Ug2bEC+kXzBXcOYPIkDAM
MD5:	3A716CBD56DBABFE063FA2E67287E991
SHA1:	47545B2AD9EE0FF2FD0FF464826004E6CAA7157E
SHA-256:	7B344B86F324E6BD21EEFFCF7BA64AC8185E6D1044BE4DE850A68034C74B209B
SHA-512:	EBC49096514AC4C60FEA7C3F2872609E99E9C284735E69C778018305E513AAADCE215EC67D16D44715880FAD85AF9529AC5BB963E58FD66D672628D431B31538
Malicious:	false
Preview:	.....................!...#.................. ......x"......@#......H*......HC..h...............H\......C.:.\.W.i.n.d.o.w.s.....P.......................$...........H...............................................X...............H...................................................(...L...................d...................t...$.......................l...........................................4...............@...............p...........\|...h...............X...................................L...........................d.......@...,...x...\|...............(...t.......H...............................................................................................................................................X.......................8.......T...................@...........................................................................,...................................................\|...p........... ...................................................................d...................

C:\Windows\INF\mdmmcd.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1b88 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	15396
Entropy (8bit):	3.3249311099947567
Encrypted:	false
SSDEEP:	192:GgZ17Pkm3+B9fejdfh/2DINENu1vE/2NRa:GgH7Pkm3+BNejdfh/2DR/K0
MD5:	270E88CE8FE34DEB6F0D5CFE9C45B5C7
SHA1:	4A04983214DC9C700D34E68C2ACA9443C970B8FE
SHA-256:	1A20D0D396AD82DFC0ED47762AB240BAB3A3630CB8408E584555B587551F0BAA
SHA-512:	4497C96C5FCB98359AC794B3973B68473952A829208186BE5A81A569C3CEDB1FACF1C225CBEE3A2E40F6FFB27058FD58152297FFAF66BA6E86E2FB6C14A7BB91
Malicious:	false
Preview:	.........................#.................................H...8....!..P.......h............... <......C.:.\.W.i.n.d.o.w.s.....,...................................................................................D...............4...P...............................................................\|...........................P...\...\|.......@.......................................................................................4...........h...................4.......,...........................\...............h...\|...<...t...8...D...p...............d...............................................................................................................................................................................P...................x...............................................................................................d...........................\|.......................................d...............................d.......$...........................(...................

C:\Windows\INF\mdmmcom.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x63b0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	97108
Entropy (8bit):	3.3916023439464063
Encrypted:	false
SSDEEP:	768:FN3bz6lfbKwEi5rmSOGJbG4YV8uhGMszzx6G5Gfbc41kUqmF:zbz6JbNVFmSOcbG4YVMMszzz5ybc4P
MD5:	EFDC2C65D1763251A010CD8B279850D0
SHA1:	CCA26A13E41CB79AF108B57D729853A919036793
SHA-256:	B7F0DA22D3DB277998BE5529CD4CDBE84EC24EB10E03187F52D68C1AA7B31D66
SHA-512:	3A5215FF8FA17530476363761657EEBCFC6E27137890A7D4E2B6EBA5DC0FB61EAB2F25904D11BE3F7F7F1AF1C40393FA767CC9A2F46FEFD5544AB14A87201149
Malicious:	false
Preview:	.....................c...#.................0c......d..H....g..........(\|..(...h...............P{......C.:.\.W.i.n.d.o.w.s..........W.......F..4X......d............"..TX......d/...W......0/..tX.......R..(....... ...........`R..........t.......4^......H9..\|^.......@..._.......D...........B..T_.......F...%....... ..............t....!......< ......`........T......X .......\..................T...p$..........H...................L........_..D....H..P>......,O..4.......D...La.......$...a.......R...!...b...S......8......L2..02..4 ..TU...'...........)......x'...V...)..L<...-..$%..,#......@1...,...#..............................(.......................lb.......T...........1..............................X3..P)...&..P....(..4(..4-..@(.......)..........$/..$!...$...%...!... .......................................%..\%..................,V.......+..................(................................!...+.....l?..t+...\..@...+...+...*......L+..t........"..p0..............\|.......,............+......

C:\Windows\INF\mdmmct.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xa5e0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	82308
Entropy (8bit):	3.6392197363454906
Encrypted:	false
SSDEEP:	192:LxXV1BhAKUgVc6+uoK9v4AGfhm8oukNbCvdnQTyQ8uNRIplbEXZXkwMj04G624MI:bhRUgV1+/K9v4AGfhm8oZuz1Epu3s4xX
MD5:	2F58407AAFCA2890854033B06A717E73
SHA1:	4AA031D49833737A4CD8AD0453FE14D5247DC600
SHA-256:	88F6F321D1DACC54640F8C7EFE6718E929C5599CF266B12EF38AB0154E418481
SHA-512:	29262B9F2B02554CF936439EBAA079AE3988BEB6B750C90B2BC7B56E9E116F071A30174AF6D62D5804003FBBF0E0F14F7E4BDAC3EE42CCD3996BFEBDE0A3EB6D
Malicious:	false
Preview:	........................#.................\.................. ........D......h................A......C.:.\.W.i.n.d.o.w.s.....P...........D....D...........Q......................................................P...............@...t........................................................-..(>.......:..........D...TK.......H...X......8U..h.......................t...............................................................\...........t...,...............X.......P....e.......b.......................o..............0i......`...h...........(...............................................(...................................................................................................................<...................t...................`5.......................B......$....O..............................................................(...........................................................(!...........;.......8..h........4..........L...........,...D?......0O..P...................

C:\Windows\INF\mdmmega.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x29d8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	23476
Entropy (8bit):	3.4871364664827422
Encrypted:	false
SSDEEP:	384:x+6Uw7HjTDMPs5yVsAEoxe8YCIieJXxOXKpH4irN0PPEhA8:xH7HjTDMPs5yVs/gIieprN0PMhA8
MD5:	FA8AC2EFA775CE83A8D449F9E2E142EB
SHA1:	58365255BAFB9742E0BBD6A07B69148A4E6F3DF8
SHA-256:	2E49D26328386AA5558E03E6FB9D23675377088DDC0F6BA3A0C2FA92CC00D45D
SHA-512:	DDC24A485AAE105AE13BF3A04EEE260656626472C673BD9D2C558A40491AA1FCE69CE0AFE9B9D5A10EF406BDADE787C5F5AA86FA6C6482CDAC69A83CC3787F35
Malicious:	false
Preview:	.....................)...#.................T).......*.......+..<....2.......F..h................[......C.:.\.W.i.n.d.o.w.s.................................................................................................................................................................H...................H.......4...........................X...........X...........t...............................................,...............................d...............$...4...................................................L...........P...."..T.......@...0#..............X$.......&..................p.......................t...............................................p...x...................................@ ......................$'... .......#..............@...t........................................................................................ ...........%..X.......<#...........&......................0'..........................................................................................

C:\Windows\INF\mdmmetri.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xf3d0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	157004
Entropy (8bit):	3.637290900284516
Encrypted:	false
SSDEEP:	1536:jNMvMZ6soDT6iz7E/nBKjHFhYIImejY8ATp:jNMvMZ6soDD7oByXp
MD5:	1F1ED55D2E4F156FA4A00A75FA85F88E
SHA1:	8C89344FE1D8A565261EA27699E0780B4F8AD9E0
SHA-256:	47BC3398DA763463C7145E726CFF2CCD017A3D15B64589F1112A2440A1CB2A87
SHA-512:	68D8839C0E9628ED351885A8AE379E0E2FC578076183EB310E7F95DE71459CA3227B6917CAB84037FE6C14BBD071F4D0EB5E9B980B0C0F8ABA1732EC81745C1D
Malicious:	false
Preview:	.........................#.................P...1..................X#......P...h...............He......C.:.\.W.i.n.d.o.w.s.....p%..............d.......<...........t-...................h...........r...;..p....w..L...x...\....#..<...pc..D6..........................................`+..................8...,........+......<c...%..L'..p,..t....+...........9...........+..................t...d..../..p)......`...........h...\|...$....7...]..............\|....... ...x%...M.. &..t_.. ...8................7.......i.......6...s.....H....+..x....&..\|/...&....... .............@G..P...................T.......,............9.................. ....... ........q...........f...'......h.......@0..$0..t7..........87.......=...1...%...\..<<..........(3...3..H....... ...T....)..p...,-......h.......(...l...(............o..4....8...8..D%...............h..Th..<...Pr...r......`w...........t..8)..`....y..X(...(...........S..l2...I.....h0...3..........,.......<........'...a.......................7......`....7......

C:\Windows\INF\mdmmhrtz.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x9338 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	108436
Entropy (8bit):	3.479112526644655
Encrypted:	false
SSDEEP:	768:SojcHjZokI7ghQPQ869gpctuph201RT1ao4:3jcHjZovghQPQ8kgpctupc01c
MD5:	6DDD78DAA23ECE43D307423F21EC493D
SHA1:	6F33DB81B994D995DE47D65F3CD68C373A7770EF
SHA-256:	63DDB89B42946E7FA7FA7A8EA62E56B4F39E8C752D0CB434C374838820633252
SHA-512:	3C5F9C3DDD6B1B791344C6F8A9C90FCD797622F70127B79475FC71215515973273B4FE5D48AD0BC182299CF5963DD9CD0E655304ABB3050A4AC5F6E2B96DA633
Malicious:	false
Preview:	....................8....#.........................0...h...........@....z...,..h.......................C.:.\.W.i.n.d.o.w.s.....t....G.......4..\H.......N..<H......L...\|H..`O..,=...G.......?...H......(A.......................@..x...........L...........D)...........0..........X3...........2..H........4......."...............l..d........m...............O..LE...............K..................,F...................N.......p..................,....6..h........<..\|....... ........N.. ............@..P....$..$B......P........$...#.......C.../..d........:......X.......L=...,...?...N..........."......LJ..............X........................O......D...............\F..l...0...\|#..........................................T/...#......HA..$5.......;...L..8O..........P.......D....O...............K....................... .......................D...................................-..........................t................K.......................................#..............l...........................

C:\Windows\INF\mdmmhzel.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1b708 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	283500
Entropy (8bit):	3.7448282886285744
Encrypted:	false
SSDEEP:	1536:oQa13GH4DwaPTcaz/Fp2g5ic695PaVmxwIFJcLnzMBh:za13A4DBlH26ic6zaV8eC
MD5:	45E0D59CCD768206000962738CCEAF13
SHA1:	BB1A69949DBEBE065AD91591EA130E9BE5D3054C
SHA-256:	A90F7F53E702A29FAAB1B50E23F7EEE0E30072B6DFF15DE35E711EEBC8CF3DBB
SHA-512:	710D1F00D07D2663EBF803952F59BA12C2E5906119CE1C58B1D0D16CE471C90427E952E70D5EF73E92AACB5E8CFF819EBC1502CC3A31CD341122D590571FABE5
Malicious:	false
Preview:	.........................#.....................9.......t...x....J......d&...-..h...............hS......C.:.\.W.i.n.d.o.w.s..........e...,..x1...)...5...#..x$..d...D...d5..X6...5..x6..48...C.. ...,...42...........B...8......P#..t...tD...<...9..P...,....U..........................(>...<...................A..`/..P>......<....K...$...?..H....:...:.......D...2......l....-.. ...$....G.........,+...@..............,E......x.......x=..........t.......U..T%.......'...~..,........D...A...............?..............p<......p....:..l>...5...(..P....)...6...#......t...8....2.......D...............A..........P...d...............h............,......\|...............XE...=..h....................C...D..............X=..L?...'..p4.. +..@6..<D..H9...,..T"...9.......+..P'..h)...?..................0........................A...A..T...........\.......$.......h....&..(.......4.......ht...@.......^...........@......`u..X5.......,...(..(-...j...C...9..<:..."..\a..\|-.......i..8>..@...t.......l=...m.............

C:\Windows\INF\mdmminij.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1d38 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	14084
Entropy (8bit):	3.476568592606977
Encrypted:	false
SSDEEP:	384:iKDY31zaYf2F5Ja7iBV5VIcAWPPp1d1qPnV:fElaYkJf5VIc5h1d1qPV
MD5:	F8F416420E6B5600A02146FCE3A85180
SHA1:	50E4CBDFAE3746C4671B599D050E1F6387A742AB
SHA-256:	99D86EA281ABFCAE24DA8DE8265ED27839BCF7088B4806088C04170232B5545C
SHA-512:	5B94E35BE339E0E9D85D9692B7A34E0F782F80F7BF5E7D210B9515E5B81C4FB417F9AB012D395653A81646599BAF44C935671969744D9ACB05D3C5846232C020
Malicious:	false
Preview:	....................8....#.........................0...@...p.......@#...... -..h................7......C.:.\.W.i.n.d.o.w.s.....................................,.......................................................................................................................X...$...........8.......@.......(...........`...............L.......L.......................................................................\|...................0...D...................................T...................<...............,...........D...........8...................`...............<.......................................................................................P...................................d...............x....... ...........4.......x...\...............................\|...........................h...\...........................................................................................................................................................................................

C:\Windows\INF\mdmmod.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3360 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	3.782547335310098
Encrypted:	false
SSDEEP:	384:P21UipOjfXcvGdusgDbIYxNeuD63w54sVHv+cZKZp+/AhwPltO:QUoOjfMeMsgD8IHVNZ2p+YhwPltO
MD5:	841A20F62818B17ED28F43C28E820B93
SHA1:	C13E53C6B9B62DFA3FBB286EAD111668A363CA3A
SHA-256:	28E8538272B2E7DD1807A7D58778511601D78F33DC2731F0D348409FB1B2C6ED
SHA-512:	7D1BB2AD9F67308E1C71E3452A9F30B8616B742E5DDB47C90F5DB511A22503286091F326B1B1189402D73D8351C3CEE854C71766929C9B8C6C86CE23F86D306A
Malicious:	false
Preview:	....................`3...#..................2......X4......P6.......>..`...PP..h................a......C.:.\.W.i.n.d.o.w.s..................... ...........@...0-...-.......................-.../..@...X...h/..........$...........l)......L"...........1...........1.......%...%.......#...#..................$'.......$...1......H....#...'.......%..0/......,...........4%..............................,!.../...)..........$.......l....)..............."......L,...+..........."...........(...............&...............!..t.......P....%...)..L........... 1...........1...1...1..<0..................T).../..8/......$........................-..........t........)......X...d#...................,..............x#.......'...(...&...... ...............................(...(.......(..H.......................................t$..P$...$...-...................+..................@..............,2...... ....2..H&..$.......H...p&...&..X...........@+..<%..........P2...................0..,1..\1...'..L...............

C:\Windows\INF\mdmmot64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x10ca8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	889036
Entropy (8bit):	2.744485370398496
Encrypted:	false
SSDEEP:	768:YfXvLbMO5iyCNl2S3G3qHgcjNDbYICwX8TKcZSm25mRJWiGQjZx2Zl:2bMO5iyCNlh3GQgqbcDZSmuEJ9VjZxs
MD5:	77FAEB3DDB7C5FE762B15E74964A2FA1
SHA1:	302F477D6F755616D6618B9B8DA0F13D6504AA79
SHA-256:	DA2D83629B53C40122C6EFB1DA169389816CCC0419CCB42F795950DB0E20DECD
SHA-512:	04F9A0262BE8E126E88F668DC5A8D08DF80B5D95167C563464F20B7178696D527BDE61CC9F1AF8935916A495D488876BC5968A5F2B284920D570897A851EEFF3
Malicious:	false
Preview:	.........................#.....4Ne..............................I..HY.......u..h......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........8............?......<... D.......)..............p.......D.......L8..........\-..............@.......d0...$...........................................&...%.............. ..............4...........x....(..\|.......<...T...\...,......................t...,...........+..HB...........?...........D...&...1.............. ...........8#.......%...........................(...........7...#..............0.......8...\|.......L.......8...........................0...`.......z..<................`..4%......dc..........D...@.......d...........H&..........@.......4....9...!......\&.......l...x......li..Lv..,...............\........................(..............t...P...l?..D...\.................`.......X......X........&...................1..p...<...x+...F.......6.......)...v..(...Xv............d...........L.......T........)..h%..@.......w..........&..

C:\Windows\INF\mdmmoto1.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2b88 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	27996
Entropy (8bit):	3.602911143642098
Encrypted:	false
SSDEEP:	768:XhvXW1SOulZoDLqQZac616hbnUCQDoIIJOJL4D:RvXW1SOulZoLqQZac616hbUC8oDJOVG
MD5:	4069277CD54A490B856EC49979AB23E3
SHA1:	1EF07A77437400A57EC130B3B4770BF7570174DE
SHA-256:	F8C72A04261F7C5638CEB4702622DAFDE085BA08BDE1684D8637F632173D013F
SHA-512:	069FDFD2C5443871AE5D4247F94414D4E932F9F4BBBD81E853252B318D0F6A4FF5EAA4CB7FA6B20A079B77E2735B2851356DC89AB0D52DE3CAF4980E6E758EEA
Malicious:	false
Preview:	.....................+...#.....4Ne.................,......(........:.......S..h...............Xm......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......l................$..........l(..X$...#......................."...(...............#..T...........,.......('.........................h.......(...............,...............................(...........@...( ...(..(....(.. ...L!..........................................P...D....!..p.......d)........... ......................x...$..t.......d...........................L.......................H...........H...............d...\|...........<...........h...............,!..\#..................p................#..........\|........)...................(..........\...&...'..................X ..t................&......................L ... ...$... ..........................................@................................'...................!..T....... ...................\|.......P...,........................&.. ...............................................

C:\Windows\INF\mdmmotou.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1968 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	10756
Entropy (8bit):	3.4690327151349565
Encrypted:	false
SSDEEP:	192:mZ28VHjCskO+PzrQkBqmUJaaiXXCQKXeki5pw/6hgAA:mvVHjCskO+PzNBFUJhiXyQKXekwg6qAA
MD5:	9BD2BC29E87E1D0E7E975E62FA260479
SHA1:	81796097389BC6882B2F2E317377E8D2CEC17BD5
SHA-256:	1E478351BA6D30F4A381DFDF65C716E38F01716A36EE11AE651BE67BF70C05F9
SHA-512:	3DC79984C7D7353F8E93FEC9887280594334DAB28B711CEE601BCFCFB74B384F4D2C9E2F35CBB1F1310E4428DB10357A623DAE026A8E4FAA6C66497587B123D5
Malicious:	false
Preview:	....................h....#.........................`.......(...$...P.......($..h................*......C.:.\.W.i.n.d.o.w.s.................T...............<...........................8...........................................x.......l...................................................................@.......$...........................H.......................d.......................................................................................................T.......h...............H...................0...........D...@...........\...................................T...............h...................................................(...................@.......\|...........................T...........<...........P...,...........................8.......4...................................................................................................L...........h...................................,.......................................l...............................................

C:\Windows\INF\mdmmts.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x9520 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	122564
Entropy (8bit):	3.361514861389633
Encrypted:	false
SSDEEP:	1536:hCcJbVsYZDc00ucP4gXcUCG9D2GYRm4QBiB3YM:hCcJbVsYZDc00ucP4gXZ19D2GCbhYM
MD5:	A82FAB729D1B0B174C3096E4F476140A
SHA1:	769EBCF7A61CFD01C73D4AF314612966516DA076
SHA-256:	F87B7DE66CA5ABB132164A8A24814FCE7530BFD9408A34293D5F4BBEB1A74D29
SHA-512:	C8078C6B93F4292235075E666F280A2C39207D825FA6AC90CAB123E8A02E3588DCA9968034C9FFBC66236590F051F9BDF4EBB17661837C9BFEDC71AD48AF2E22
Malicious:	false
Preview:	.................... ....#................................. ...L#..p........M..h.......................C.:.\.W.i.n.d.o.w.s.........`C...^...S..........D"..........@....F.......o..(D......T.......D....v..................,B...q..p...p...................pR......<...xf..........4}......D....v.............. !..8.......t...........p........................"...M..............tH..................XM......(...........`"..X............................U..`................<..,.......("...............r..`.......w..................P.......lK...#..T...H....$..$........G......`}......"..............H!..T...T.......X0......X...........H_..P.......`\..,.......t.......8N..........T...........D...................@m..h...H#.......B...-..\v..8........$..8............ ..4........ ...................J...........2...........!..h!..................tL...........3......<...............h~......D.......Lc... .......z.......e...r.. I...\|.......,...".............. .......L,..D4...........4...............#.......5..

C:\Windows\INF\mdmneuhs.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2f80 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	27828
Entropy (8bit):	3.547850178850757
Encrypted:	false
SSDEEP:	768:FU7pMHYKk+wh59XXYGd5VgsNf4Z3ezq5Cl7+o0:FU7pMHYKk+wh59XXYGd5VgsNf4Z38q59
MD5:	798DEF24B359E19117B144AB12B77E4E
SHA1:	2E18CFDE948DAA67CC321D5AEE96DB0C607A9D7C
SHA-256:	E4CC06AE65B6DAF9AD973E7D4201DF96EA4B2DE8F5F99DDDF72528AFF8CBC585
SHA-512:	117B84FE5E8BCD1C683738C2996A74FCADB765505DD3E49A67BEAE9D3CA6553F2E84015CA2E0F2D2668175BC6B6159228A58F62626C93487623C6AC320278545
Malicious:	false
Preview:	...................../...#................../......x0..T....1..<....;.......S..h................l......C.:.\.W.i.n.d.o.w.s............................. ........-..............................................$...\|........-..l...l.......................................p...............4...........0....... .......0...................T.......................h........................................-.......)......<..........................<...l.......,,...+......0#..........................<........................+......L...L...........\!..X...x ...............!......@"..................H....+..........@+......................p......................t#......l....#...-......L$...........$...........$..........@.......0...."..<....(... .......)..\|*..x...................................................T.......h.......x)...................+...$...........'...)..$....%..........d'..........L............'..................."..........................h...........................................

C:\Windows\INF\mdmnis1u.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1fd0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	14156
Entropy (8bit):	3.5809217779590705
Encrypted:	false
SSDEEP:	384:DCM73rackxdYImCjt4/WhQXyG8h9SWvuxGJ1xK8y6GX:OM73rackxdzmyWGJ1AX
MD5:	7ECAEFF006041607C249E404DC703487
SHA1:	BD37D1F9F066148193393FC35267325635D5BA97
SHA-256:	EA591D2704A2F2C5EA421522AEF9BAAC78160744826600FA7B46CE648F1FEE62
SHA-512:	EDB748D482B5494CDC926205BA749AD94CCC62B007D77F24015FDEA7FB4AB99A73F39C732F4C4B8B32B55923A9D7A7B1F33972209E5F9215A82920DB99B0D01D
Malicious:	false
Preview:	...........................................L........ ..@....".......%..........h...............H7......C.:.\.W.i.n.d.o.w.s.....................................h.......................................................................D...\|...........................................p...\...............L...............................T...................\.......................................................T.......................................................................................8...............@...................8...X...............h.......................,...................................................................H................... ...4...\...........................4...............H...........L...8...................................................................................................................................................................h...\...........................................................h.......................................

C:\Windows\INF\mdmnis2u.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2000 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	14252
Entropy (8bit):	3.6103098858518488
Encrypted:	false
SSDEEP:	192:fghadtVTkyYhAsU7ruhhPqQXntebVXXkOR1HXxgbdL/uddJv55:4kdtVTkyYWP7ifqQX4VXUJ/2Bf
MD5:	9F4557077EE9A90103572F739C56FB80
SHA1:	67A7EFA87DBE90EB8D324C0F28050347FCF3F7ED
SHA-256:	4AF618507C837F3C33FF27CFC45A6844D7CA3C1878F241065222C381E731B6C8
SHA-512:	0E68279E10728ED8BE52554254C3C8B072407A1C9E87DDFB6521D8EA759737BB289C645C78D1152CD46720E611C63D074D6CBA8279A84FCC069DDD24CE584C44
Malicious:	false
Preview:	..................... .............................. ..@...8".......&..........h................7......C.:.\.W.i.n.d.o.w.s.....(...............................h.......................................................................x...............................................................................,...........P...............P...................................................................T.......................................................................................l...............t.......H.......H...l...........D.......h...................4...,...................................................................H...................T...4...............................h...............\|...0...........l...............................................P...............................0.......................................................4...........................................................................................h.......................................

C:\Windows\INF\mdmnis3t.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1ad0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	13300
Entropy (8bit):	3.419919494250374
Encrypted:	false
SSDEEP:	192:Kyv6AhSsU20rlIFnFuGaKr9m4Xae4LAE8TtgBB0WzRmOjgTR:KY6AhLU20rlI7Hamm4XaazWtvjw
MD5:	8CC0DCCC6684E176AB452E552B1B629E
SHA1:	29ADD67545B06370D0879FF80096BC0DB394CBF7
SHA-256:	67C0F6CCC6CAAEE3898A23910FEBFBC5FA6E9B547597FF556E55A0AA76D6039F
SHA-512:	5A1F2ABADB2E5BBF9D6A090767DE26A71AB616D6231FAD905ECBD256691F05293EC517A41B5C75FADF2CEE478A6DF0D9305AF0B542E1A28D4B1260580A94202F
Malicious:	false
Preview:	...........................................P...................l.... .......)..h................3......C.:.\.W.i.n.d.o.w.s.........................................................................................8...............(...X...............................................t...............h........................................... .......x...L.......................................................................................\.......................................................<...............l... ...\...........<...P.......................0.......................................................................................................$.......`...........................8...............L...D.......P...............,...................................H...............................(...................................................................................l...`...................................................................................................

C:\Windows\INF\mdmnis5t.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1ab8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	13276
Entropy (8bit):	3.3927835531474675
Encrypted:	false
SSDEEP:	192:jUYlvJh4+K9M80sJF4AnDXywJ3L6dLgXIZ6O1wJN:jNlvD4+DIJ6gDXyQ06O+7
MD5:	4CE35836D4EE25CB1CDB9A4D4CCC78F1
SHA1:	0362713E8F18BF71C1A4CB112C5F88AE8B0DC685
SHA-256:	7DD5E17F77880B9401F168A68895A927CEFD60C38F40AF27471FBD964F8EAA5C
SHA-512:	FC71594DFA6EE8CF758D2B679CC046E86AE16E698DE73168CD96DF45F3C972B7CE1173D11BAB7E7B1836EF6D3063BD9A2BBE69562C17A5F72DE3CC4F4E531F98
Malicious:	false
Preview:	...........................................4...............x...l............)..h................3......C.:.\.W.i.n.d.o.w.s.........................................................................................8...............(...<...............................................X...............................................p...................x...0.......................................................................................\....................................................... ...............P.......@........... ...4.......................................................................................................................................D.......................X...................0...(.......4...........................................h.......,...............................................................x...................................................P...D...........x.......................................................................................

C:\Windows\INF\mdmnokia.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x9228 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	77692
Entropy (8bit):	3.9757677591372036
Encrypted:	false
SSDEEP:	1536:d/+HfKLhCi3rZ+SDEGT7767C9f1h/j+LjwIAfjWtWWtWRrQeT9:d/+HfKLhCi3rZ+SDEGT7767C9f1h/jSe
MD5:	857C8EEAADB55333165700083571A6BC
SHA1:	511346AC77F22AA0937B1442120A1E85F659E63D
SHA-256:	C03455A48FF833577131A507D7BFDBEBFCE7B15FBA687059900703EAF22BAD6A
SHA-512:	30A8B298F8D640FF00ACEC99805FEA1C38E7B07EC80A4EADD445738DD4AD2204F5AA649A3AA6E0E81BAD87DE81C55619E197CDE0CB5FC1CB2510462019AEBDE2
Malicious:	false
Preview:	....................(....$......................... ...`...............08..H...h...............x/......C.:.\.W.i.n.d.o.w.s......z...3......D6.......h.. \|..hi...j...l...x...n..Dv...w...r...s..@z.......D..........,........................{...........................8..................D}..........,..........PG............. {.............. .......<....{......................tB..............h\|......`A......\|.......H...,@..............B..\;..$4...............~...............\|..<....h...e..0j...k.......W...n..T{..\x..hs..dt.................\~.......C..8...............l....{...k......PB...t...>..DI.......y...J..HP...Q...S..tT..$...............................`...L...x............\|......$Y......P...............0...H.................................................... ........................................................................................................................~...~.......D..d\...l...\|.......u...............z.................(.......h.......................D..

C:\Windows\INF\mdmnova.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2ac8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	28732
Entropy (8bit):	3.402887895445632
Encrypted:	false
SSDEEP:	384:zAkMhi17+J+5nCbfvkXy2ZCMECJFd81b102VkwqQZ:0a17+J+5afv+J3S1jBX
MD5:	A37FB784BC7FF8D05D82EC3994C38540
SHA1:	E8B787B277478199A5E3D038C586D2A961DCBBD1
SHA-256:	128E07AEFBF7305F850323B06A789A05B0A9E8BC3CE01EF33C531107441F8FA1
SHA-512:	368F4E5CC0874E22F36957110C7B6D740BA8FDD249E7E596477470775E4297027DDF2059510F4ED6F6F517A6E11F3762570185C76B94D2419FCD908487C6A3FC
Malicious:	false
Preview:	..........................................H.......+.......,..@....4.......R..h...............8p......C.:.\.W.i.n.d.o.w.s..........&..........p'.......)..P'......$....'....... ........... ...'......(!..............................P................................................... ...........X...........<...D...........<.......,.......h.......L...,*..T!..................................................................................0...<............... ................)......................................P...@.......`....!..........D...x ..d.......@&... ..`....!...)..........h...D.......................................................................h...................................\|................'..,.......H!...........'..T)..........P...........................................................d...............................$...........................D...4...............$....................(..........................h...........(...........................................

C:\Windows\INF\mdmntt1.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2220 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	16828
Entropy (8bit):	3.559835737067284
Encrypted:	false
SSDEEP:	384:Np3Krv77rBS1GAJMwu2RVQBXUtSatLFqalfJI:NlWv77rBS1h1NbZF9lJI
MD5:	2CB3E5690D5E0C0110D2E2EB91F2DEDF
SHA1:	391BF1689937D0102F2A7D8EFCDFF28A4038D20A
SHA-256:	426C60232F536382F43BBA7340BE58B838B9E1B0509C07B16B8771B0409F3CEB
SHA-512:	ED65CADC0F284740CFB59C78D314ED832560E877DFB9653609FE564760DD47515305271CBE3BBBA5F96DB64A42D70B70F5D59B06FB1352EBDDFBC08065B6F0C7
Malicious:	false
Preview:	.................... "......................!.......#..,...H$..\....(......05..h................A......C.:.\.W.i.n.d.o.w.s.................................................................................................................T....................!..........................................h!......................................@.......8...`...........................................................................................................,...l...p...........................\...........................`...8...............$.......p...............................................................................................................p...........\...............................................l.......8!..............l...................................................................................................\...........................................................................P...................T...........$...........................................

C:\Windows\INF\mdmnttd2.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3298 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	30196
Entropy (8bit):	3.461078332983825
Encrypted:	false
SSDEEP:	384:ZALqUgxvUC+y9+FT6ZnMi7XBaUi+h/AFZGZGb:ZUqUSvUC+y9+KXBBi+h/AFZGZGb
MD5:	FD301BA013CA2E2C264146FE5EB22A76
SHA1:	2E707B19CC6FA80231F8D09F3804B7152F75AABC
SHA-256:	74A96D86DFE01799321B81A7295AAE46F475DF40618BF44DF4D1D90974724BC4
SHA-512:	A2E5C343453CDB9208A9C358EE08F21860C65F25768E5603D7F8F0F4C7021F78DECA2E7148A6351AB0FA6AABD2A8958BB5D4903220D6F6D4A27020324FC0EA40
Malicious:	false
Preview:	.....................2..x.t.................2.......3......X4.......;.......X..h................u......C.:.\.W.i.n.d.o.w.s..........................................................................................................................................................'..................t...................................d...............L...........................................................................................`...................................\|...........$.......................P...D................"......h....$......\...................\|!..h...............(...........................................h...........................8.......x.... .......................(..P...............,...P....#..................( ..............................T..............................................................L....+..................................4(......L...$...............,...t.......\...............-...-.......-...+..@.......h/.../.../......<0.../..\0..d...

C:\Windows\INF\mdmnttd6.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x32a0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	30204
Entropy (8bit):	3.4831118464419655
Encrypted:	false
SSDEEP:	384:B42iY7HUbokV+RJoMqMs/JaxWKfHlmFlmSs7w7l1byb2NHl2K+f2LOEOEXHOgmD7:BkY7HUbokV+n6axWKfH/
MD5:	389200C8753B233CD954887DE56F225A
SHA1:	B278957D913588C257028649431381388B305540
SHA-256:	27AFB95E9BD5D84CA26063AAD2CFA1F61F1C2BEC4506BE5C1D3ED378627DCA19
SHA-512:	A93F19B2FC9E5ECEED5518A37F24E16CD003CF9117C409F8E0EFDDBF4F895D547E06306335FF2C2FAA62972CA272C2967AB00084C75D1A9162F7EABB0ACC1E40
Malicious:	false
Preview:	.....................2..x.t.................2.......3......`4.......;.......X..h................u......C.:.\.W.i.n.d.o.w.s..........................................................................................................................................................'..................x........................... .......l...............P...........................................................................................d...............................................,.......................X...L................"......p....$......d....................!..p...............0...........................................p...........................@............ .......................(..X...............4...X....#..................0 ..............................\..............................................................T... +..................................<(......T...,...............4...\|.......d.............. -...-.......-...+..H.......p/...0.../......D0.../..d0..l...

C:\Windows\INF\mdmnttme.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1d98 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	14020
Entropy (8bit):	3.5270017233066713
Encrypted:	false
SSDEEP:	192:MUac4vavw8zCnbR5E4QV6Z0ElHXUL0+d00gkDhxtCooqOqrP5uyT6:M7c4vavwaal5ET6Z0ElHE3hGoTJ5q
MD5:	042E1C11CF5CD65622380531B03E0E5D
SHA1:	C838DDC92B181BC1D8C4C5C90F22213B4562A107
SHA-256:	AB4BA67CC6875B30AB10BE5FAEE5213934197808AFCE319D3E65715149B4EFD0
SHA-512:	057E918D8C35A2DE697FA06E43E5AA4D124FF550AF437251E55531BE4B10D3076471667680796FC2B76DCC5510A3E9B199FE73E364BB34DFC062B478AD2B9E44
Malicious:	false
Preview:	........................x.t........................................P#.......-..h................6......C.:.\.W.i.n.d.o.w.s.................................d...........................................................................X...0...........................................@...............`...............................................................0...........................................................x...............................................H...............l.......`.......................................H...........................................................................................................................................,...................................d.......................................l.......................P.......8................................................................................................................... ...........................\.......................................................x...................

C:\Windows\INF\mdmnttp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2788 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	21660
Entropy (8bit):	3.4474745937969633
Encrypted:	false
SSDEEP:	384:uEyl1Kv2J+h+3FELTEGBZkaLdl86+mvZg:ud8v2J+h+3CLfLdOCg
MD5:	420663FC76755B6191D773049E1AF978
SHA1:	3C41E086B25CD90807702C3A2DBA59E8EABCCD46
SHA-256:	9C054E7C50850C7357A9FB200A5EF2D935357B788EA93C698AD8D0D1B9FA1AF5
SHA-512:	33FB2BB464DFD968B8784F6AB566B17D2C69C26EB185F2157B94D989996C89CC2D3E18F9FDF0E3D2FF9A49287B0FF0578F1FF8FBBF83BF9FC0146F3767E03D08
Malicious:	false
Preview:	.....................'..x.t.................'.......(......p)..4............A..h................T......C.:.\.W.i.n.d.o.w.s.................h&..........l...........@.......................................................................@.......................d$...........&... ......H%..........8&...........$...........%..........8...X...........................................................................................................................................P...........................................,$...........%..H....%......l%......\&.......%..........<...................................................................t...................L...`.......0....................................#......8$......L....$.......%..........<............................!...........................".................................. ...t"..................................4!......`...................................."..........................X...........................................

C:\Windows\INF\mdmnttp2.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2b30 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	23396
Entropy (8bit):	3.5290537916450853
Encrypted:	false
SSDEEP:	384:CGpt+N7H111B87ROIvA07itp4RcMOkeS29RjQ9218D:CGo7H111B87ROIvQyySsQA8D
MD5:	AC2B2FC34CF7527B271A1924562CAB4C
SHA1:	9DBABAA450A7B0A98C010448A451258137AEB277
SHA-256:	E06E9F2B00FBF98FF7A1363C4D2BBE3506F1A34577BEFFAB4AB06BED17741DF5
SHA-512:	4A646C210BC1FED986A386BFC6381A40F084F214AD2AAB6EDB9A73EEC6FE35007248F77C1C65AD0681FFBEF10FAA7BF63990620FCB460D9471B4D5F68251EBDE
Malicious:	false
Preview:	....................0+..x.t.......................(,......@-.......2..4...(G..h...............`[......C.:.\.W.i.n.d.o.w.s.....T......................x...........................................................0............... .......L........................(...........)..X$.......(...........)......D....(...........)..x...(...H...h...........p.......................................................................X...................T...................\...............\............................................'..@........(.......).......)..x....*......t).......!..H...............l.......................................................................\............ ..................................\'..L...<........"..<(......D)......................................d%..........................`&..................................0....&...................................$......p...H...............<................%..........................d...........................................

C:\Windows\INF\mdmnttte.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1de8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	13868
Entropy (8bit):	3.4909314444620865
Encrypted:	false
SSDEEP:	192:8p2CwnLVvrQ+UsgNiqaXHXUdDiAEIzOqa4vrYc2YtSUP5c:8p2CwLVvE+NgwqaXHEzvrBjMUP5c
MD5:	712FB207D7077BDEBB85BBFC16E7F344
SHA1:	75F6519E234AA066A155FC9C5495061FA5C6B8C2
SHA-256:	A1B90055975F11CA617F645109E3F497E9C615C010A458EF920B59C92A6C9618
SHA-512:	64C5ECED53F009CD4E1C9B8E0B283172580A574DDBB19F0A72A69F452F711ECB2A2A92BA3283ED00E0B406F0EDE19E1260E4D874F1329634160AD9940DC7FC42
Malicious:	false
Preview:	........................x.t................h...................l....#.......,..h...............(6......C.:.\.W.i.n.d.o.w.s.....0.......................(...........................................................P...............@...........................................................................`...................T...............,...........p.......`...................................................D...........................t...$...............8.......0...........................H.......................X.......$...........,... ...................................................................................$...................................H...................................\...............\...........................................................H.......................................................................................................................x...................h...........................t.......................................................

C:\Windows\INF\mdmolic.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x46e8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	37084
Entropy (8bit):	3.797103961220546
Encrypted:	false
SSDEEP:	768:gXcHTXTCCuSQxZpPYfhED1YvOfdmwj491NmwWVFyoH6eOxpuKKJy:acHTXTCCuSQxvPYfhEhY2fIw491NoFAb
MD5:	02DB6827E2A086E02D193E70473EC26F
SHA1:	38F7819A43938F1043B802FCE41EEBB638E342B3
SHA-256:	3A6803D55B480676A4D26DC2FE429DE7286597226E0DD52A5830ACC8FEB982AA
SHA-512:	E633871BA2E6FD9E22077925B459EB5ECEA030C8BACA610F68BD74510BB292900589701C4E5F57144911CA188197EADE24A5670FD53ED56805D16B43BB8ECC2B
Malicious:	false
Preview:	.....................F..qpw................dF.......G.......I..@....X..\...xt..h......................C.:.\.W.i.n.d.o.w.s......C.......!......t8...1...(...8...7...8...............(..t....7..h9.......$..`#...E...<.......@..XA..D....>..........................B...................+..T+...............D...,..\&.......'.......&..h+...0...8...'..........x(...........,.......................@..0).......A..X4...#...(..@'...%...%..D>...&......dC...........6..l6...&..............(...................0..............H...&..83.......,..H(...5...5..$(..4....#...B...:...:...;...A...(...............,...9..89...............'..........xA..h3..................x5...........+...3..D8..tB......p)..`=...=.......,......H,..80..('..\/...4..\|'...=...................>..,0...........0...........................................-..,-.......8...................6...................4...5..........(F..........(;...1...0..\.......(1..4'..`)..........8=..X;.......&...:..h-..........................\,.................

C:\Windows\INF\mdmomrn3.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x12068 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	175372
Entropy (8bit):	3.649364729631091
Encrypted:	false
SSDEEP:	768:fhaIQb4GGwNheUiog/RM96dirdBcx++0VE4vH+c5Qd/ds:fx+/GwvMouRM96AxB4B2E4zQd+
MD5:	A29631E4A1943767A2690BCB880796B9
SHA1:	651A228E33AD8A9C7EA47A89587E2311044FF8FB
SHA-256:	2B701B6237572149080CC7412F07DDAEB4B11818DAE04FE669DCF34D09F32529
SHA-512:	A565064AB221667FCDD3EFB8CA0507BD16D395AF4A308F601DE66C0A67933C3B95BAF3055419FA92D7718A5A2E50EB67DD837F390B2BA434EE6F3C72ACD9CC1D
Malicious:	false
Preview:	....................h ..qpw........................`!..0....#...(..(L..p.......h.......................C.:.\.W.i.n.d.o.w.s......c..8}...}.....`...<p.............L$.......x..`...p...x....k.....................\|...............l.......................................lN...N.......M..............0.......X"......h.......X............!..4....!...z......h...l...........D...P...@...,...hv.........."..li..X...........p....[...r... .......\...................-..........D#...........$......8...<....$..........\|...,....8.......&... ...9..L&...)......L;..d...L..D7...7...>...;..................."..........................`............=...............>...........=..( ...=..\|...........\|5...........4..< ..........!..h.......h....:..X;..XB.. @...c..8h...T...!...$...$..L"...M..L.......XM..............l...,........"..."...........W...X...Y...X...S...Y...5...7...9...Z...:...8..."..(....:..T9...;..(%...-......8..(...\|....U..LB......d...Dh..D]..D........#........................... ..............0O..

C:\Windows\INF\mdmoptn.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1ed8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	14508
Entropy (8bit):	3.57739695059942
Encrypted:	false
SSDEEP:	384:8wviR2U1o9XYHg59JXuUQ8L5XR264htir7bA8uCGj7:TviR2U1o9XYHg59JXu7EUhE74jf
MD5:	057101766A60D9A67D63EC0A396FB833
SHA1:	65BADA21C535A3DEEA3AC2F818B8A9364D683D28
SHA-256:	1F720DA23F00DA898FCD4A4643F5FA4C9D595274D81721FE6CC6DC1C9A00DE67
SHA-512:	9D07F69E334A55D5EB306686F0E60D1EE532E24B27C3B14816F5BFA89743297FD282E0CBFBABB0307FD30DB6BE3151B2401A74E0345F02675E1B1C454290FCDF
Malicious:	false
Preview:	........................qpw................T...........@....!.......&..H...`/..h................8......C.:.\.W.i.n.d.o.w.s.....\...................................\.......................0........... ...P............................... ...........................................X...d...............t...d...................T...x...P...............X...p...........,...............................L.......................................................................\...........................................................$...........P...D...,...............................................................................................X.......................D...................X...........................p...........8...........................t... ...X...............................................................................h.......................................................................@........................... .......p...............................................

C:\Windows\INF\mdmosi.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x67a0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	66652
Entropy (8bit):	3.565147755025965
Encrypted:	false
SSDEEP:	768:WyI9iodCUP5f6slMoCF70DWZ8d91v9UHp2/QmyzbrB0mA16z7g+GD0tN6uN2x3La:WyI9TCUuN2x3LneQIp1
MD5:	C5ED2A2B0CD3287903F1DC9B15BF3869
SHA1:	1708635E13BE2127A5D0902C3DA8236B922E9B0A
SHA-256:	D8A8923681ACD1385B06E884B3FCE3AB33707DCDCCA8D0653F7CF7E75E136113
SHA-512:	6EACD224DF9DB8257A365264CD9BD44B26CAC30CADE19086AB65F0B2050F46EA925172D46AAB42B5BC327D3B031EAD4613D957B8D2F9EC533188F3C61903E1C7
Malicious:	false
Preview:	.....................g..qpw................ g.......h..\|....j.......{..,D..(...h...............X.......C.:.\.W.i.n.d.o.w.s......e..............l_..................\|C......T....8...:...9..X;..x9...;...9...b..Xd.......8...6...........9.......5.......:.......;..<9..\7..HD...C..,:.......A...............c...E.......B...............A...E.......B......T...X.......d...................................hE......(?...>..,....=..........8G.......<...c..@............`..X........d...........F...................................e...b...2...B... ..............l.......<...........`...lO...E..............tG.......2..............................`...........$...t...........$....@..`....@...........Y..........TY...f......D4...1...2.......3...!......(................_.. F...F..,G...F...........................................B...A...............d...R...........Q..,Z..0'...(..x'...(...'..@E..4e..p)..P(..La...D..._........... ...... ".......$......8%...$...........C...H...#...................E..L...........lI..

C:\Windows\INF\mdmpace.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3c90 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	42756
Entropy (8bit):	3.657612095971263
Encrypted:	false
SSDEEP:	768:OMd6ResiH8hh1e7khCKGVA9RMR1NmD3PaNkMT:OMdst5hXe7khCKpknNmD36
MD5:	71368EFA69079BA7A0BC2B4958474FC7
SHA1:	8BD2AC055183866519403481DA104BA032BFBB6B
SHA-256:	E37F4A7E8BB7F2D8632EE2265C3C73E64091472F8EC2D2C2D28D08B2EE26C6EF
SHA-512:	1A5DFDB04BB7B6C77F4E9FAA9D71148F36ACC5AF5CDDC3A8B3B7E382E191E54675A06D4BDBE5A94A22C2E95B4040A35DBF3AE4FE0180A73F5BA42502BB0F2054
Malicious:	false
Preview:	.....................<..qpw.................<.. ....=.......@..T...`R..P...\|..h.......................C.:.\.W.i.n.d.o.w.s.....l...........8....5..........(5..\/..t5...... ....................5......D...t........7.......,.........x8...$...3.......2.......9...:..................D&...8...................).......&...:......d........'... .......5..8...T$...........&..............D............%...".../......./...$..`2...,.......4...8...;......t#..........0....................$..X)..............L(...............#...............&..D+..D4..0 ......@........1...0..<0..h0.../...$.......+.......)...5...,......$.......@......../..........................\|2...........%......@,...0...0..@%..08..T8.......&......l&...'..h.......,4.......3...................2...'...)..p...T...............................t...........8.........H5...............8..L...................p1...+......d"..@6.......!..p9..\|(... ..0%.......(..t...............p3...6.......2..d6...!.......;........... .......&...-..............

C:\Windows\INF\mdmpenr.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x8880 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	121260
Entropy (8bit):	3.423364556551664
Encrypted:	false
SSDEEP:	1536:TvQZ7U3UMKP3FXtgEZIZQRrtLu0RFu2+pKFTb0YUL3Pz2FMtrHlGIE3rIalu:7QZ7U3UMKP3FXmELRrtLuQCE3rIalu
MD5:	FE8CD58612B4FACE3F8D9ABE0A6F649D
SHA1:	2BB807C534F02CC0C4DAB4AED7755A4C5CBDEBDB
SHA-256:	ED6D6BB2EE716A27120FD98693907AAE82F25DB9D57A83801993B3812869E5A6
SHA-512:	1B1EF99B45C2984D8DA53B8EDDDE89A2F0278455D6072CB97937598F9D2AE6FBD50379A67E797806EEA62E53CA2282B132EBA49F1D4DA85F4A89E2EF4C369836
Malicious:	false
Preview:	........................qpw........................x...,........#...........D..h.......................C.:.\.W.i.n.d.o.w.s.........\|I..Lk...8..$....y...a......4.......4`..(a..``..Ta...................D..d.......L...........<D...................w......`+...........2...........6..8...Td...4..H_..t....8..D...L#.................8...d...........,...d.... ...E..`}...".......M...................F.......v...}..4..../...}..........D........p..H....W...p..p...............D...........8"..........hD..,....$...E......\|...._..hv..T$...v...G..........\|...ta..D........H..._..d...8...T...........x#..l......4..../...........v...........q.......W...q......@v...}......`X......................X..................p%...I...H..0I..<_.......a..\|.......x....u..l_..........h"...... ...."...............u.......................................X.......G...Y...........Y..........0~......</.......... w...Z......\...$i.......1...i..Ha...a... .......................!......................@.......t...................

C:\Windows\INF\mdmpin.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x28f8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	27220
Entropy (8bit):	3.338141929959538
Encrypted:	false
SSDEEP:	384:db30st7HUPKQkyzB+/2GNuM7QOIzmXS5AYa:dbkS7HUPKQkcB+T8SwAYa
MD5:	AFE4C125FBAF24282BF8E89006530A31
SHA1:	C657D36586AE93818A6AA07E442BE8EE2499080F
SHA-256:	AB9C5293F69D629A00958E381BE7A2F54564B339865E4149F5344D7EF865C96D
SHA-512:	78C429969A5D4DC35D0D168687AD147C4159DEA46066F1F7239076C6B2E26C7D60CABDA7095F5FDED5F307D8A26262DD3D7528B0084E87D2150BDB9DCDC08CE0
Malicious:	false
Preview:	.....................(..qpw................t(.......).......*..t...02......@N..h...............Pj......C.:.\.W.i.n.d.o.w.s.....................<#..l%..................,$..\|$...$...%..................................................h ..............................................................."..........................(...t...................X.......l&...&..............................................................................l...........................D...........................................`...T...4...............$...........0...l.......0...........................................................................x...........................T................................................%......<...`.......D$...$...$..4%......P%........................... ..................................................$ ..........\|.... ..............d.......$...................h...@................%..,&...&..l....&...&..................................................................

C:\Windows\INF\mdmpn1.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x20f8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	13044
Entropy (8bit):	3.68818745877565
Encrypted:	false
SSDEEP:	384:tOLjIeWcKieiFaI+5xg5xjypLQu5kXGg8zGAR2VKyJXN:t4WcKilkI+5xg5iLQu5t2VKyr
MD5:	E8C173D34C738D88F5FB624B549C555B
SHA1:	91A94866840F998245C1BB99836937E4E957B8A3
SHA-256:	D58D543B528512F197DDFD521BCF6D1CE5E0F7169A6F42DEE2D43F21D8213C71
SHA-512:	A2837B709BDC430881B6F8D6C2FCD810417D9017B66AC46CBED1F5FCC8EE0D01A07B5B4CC889FF1328A9D15964CC914E9E3AAA3635DC06203C0D8943542BB6F5
Malicious:	false
Preview:	..................... ..qpw................x .......!.......#.......&.......,..h................2......C.:.\.W.i.n.d.o.w.s.........................................p............................................... .......................8...........................P...............................................................p...................`...............................................................\|...........................D...........................@...........................t...........................................(................... ...................................................................................@...........p...............,...0...........................................................................4.......@...x...h...............................................................h...........P...........................................................$...........................................d...<...................x...........................

C:\Windows\INF\mdmpp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x67d8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	86132
Entropy (8bit):	3.4028473157036814
Encrypted:	false
SSDEEP:	384:3Te69ucc3EmH8kwVi0yuAkB2ZCZY8O3EAOYi7ibk3KV0dgjb:Mcc3EmH8rVAYk3ilokaV9b
MD5:	16C9283C556600F7356CF1F7AB20CE9E
SHA1:	43C53938D23A483E4EBDFE8127FF3F4234E52FC3
SHA-256:	FF722308B1C84E075F1AFCD99AC4735295CBFE63AEA609703755890BDEABB7C2
SHA-512:	AC41D21F5100E2CE78D022013826B87DF0FF184F4C3E0CE84D0BAF6D00AB1967235D8275CD051E89F29D6A7157F786DCF135E75A95D4C1D3B7B07156C34EC95A
Malicious:	false
Preview:	.....................g..qpw................Tg.......h......xj..x........f......h...............pP......C.:.\.W.i.n.d.o.w.s.....0...TQ.......@..$d.......g...Q...........f.......d...Q.......K..4R.......L..........X....!..,...,L..H.......t...........................\|:..........h>..d...................X@...#...+..x...........T.......8 ..................T*...M...............U...................N..d"..............(g..............L...........\|...._..48.......c..8................f..."..........x....!...,...M......8...h...0,...,.......O..D&...........(..d...d....P..X(..06...'...f..........8+..8#...........6..........D...................._......................\`..........,`...........`..................<-...'...%..\...x'...'..$'...'.......(..................."...#... ..........................................\|#..X#......PW...`.......O...a..t........a...........a.......7..("...........b......0!..$!......P9..X!...V..<=..........L;.......................%......................@...................

C:\Windows\INF\mdmpsion.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2bb0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	20580
Entropy (8bit):	3.781866684282032
Encrypted:	false
SSDEEP:	384:KJt/1saJMLEYEkdvOGGFGwUnTqFVpW0qzf8i2/6gSDR5Lm7XefIlCWfuSMwiX1In:W1n4RZdX2/6gSDR5LqXIw5V/N3
MD5:	7DD1CBA02E943790B12C6530D5CA6184
SHA1:	A284C17849F7CF0140E9A0EBF20341192ADE8B70
SHA-256:	CEC32F20617AB5B125D38B418A577783FE6D55F7A00FE25ABA6804F4CC98590B
SHA-512:	686A6E7C3642F2156C7D19E4C9E1CA2318AFE14A26B0E1932718644513BFEF23130E06B5B4551C2CD56520405115C83D94430AD0EE20DE93D051C59213DE1F5F
Malicious:	false
Preview:	.....................+..qpw................0+.......,..h.......,...@5.......B..h...............`P......C.:.\.W.i.n.d.o.w.s.....D........................#..........,.......................l.......h.......................................d"..........................................<!..( ..................P........$..........l...< ...%.......%......\...X#......................................."..8(..............T.......4.......4...........@....!......\|.......P........#..........h(...............&..............(".......".......$......`.......t..............................................)......0...........................................D.................... ......(!..........<#...............!..,....$...%......."....................... ......H%..$....(...(..\|&..L!..........................H)..........T*..$)..........................8$...............................(..................h....&..........X.......l............................................................$...#..............

C:\Windows\INF\mdmracal.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xaa38 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	115628
Entropy (8bit):	3.562921251411511
Encrypted:	false
SSDEEP:	768:Bb7H0hx3y0uDBH5YSixWDVSnmsqejqnrsnDGL93550fed:Bb7H0hBylDBH51ixUVS50NL93Mfed
MD5:	018F0CC1DDF053F98402546162FC55FE
SHA1:	E6ED86A8A51541E58D60996284E7D8E89425E4BC
SHA-256:	24865364A2C4668AA4C3EEB63A6C1BCA36E05DF92CCD34BB0C48FC4F7B6F311F
SHA-512:	DD6930CC695AFB801E6FB72EA0DA06FD2B244C4992BF6817CDA24A026AF76EF9185313F1E8156E3791CA4D223E8C0E91312556D9C65EE4862276BCE538B0A1E6
Malicious:	false
Preview:	....................8...qpw........................0.......P...t.......l{..8H..h.......................C.:.\.W.i.n.d.o.w.s.....p.......................P..................4...........h_..........,g..\5..xB...i............. .......T-..............l............<......................................... ..................p..................p...8.... ..P...........<....,...l....................T......x...t...........${......x....\|..........p...L......x...........D1..$...0...............................h........%...$..(...PG..,...........X..........8...tA..d...X...................H ........... ..............................X............e.......]...M..h...................................\....!...*..."...$..x?..\|'..@I..HK.......+......\|@..........`....................................\.......X..x].......................... _..p.......f...........i..0.......Hh...........k..LP..<...@...4.......hD..XF..DJ..@L..............`...................X................................^......D[..

C:\Windows\INF\mdmrock.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3478 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	30948
Entropy (8bit):	3.6614204398291674
Encrypted:	false
SSDEEP:	384:yJ7x0SIgXG6fp2U7kMc74XfyS/Tzad/RrKjr/cYztQCr:ylaSIM5tc74Xf/adpWXE6GCr
MD5:	88B1C4951A92415FACFC67360060E8B2
SHA1:	F50410656A99E8599B68A2437DA8F5F91BA832B0
SHA-256:	0859FE03CE578922AF4A8125486F85CD5B04F36B1083D91AD088340716A1D67F
SHA-512:	FDE28EFDF5662C36686C30043178FEE324414ADB3E6E05F3E8095570B042C84EF30F9430FB594AB56CDFB9FA8398E267075F152ABEB2C637B600EFF8E6FC92DC
Malicious:	false
Preview:	....................x4..qpw.................3......p5......@7..0...p@..4....\..h................x......C.:.\.W.i.n.d.o.w.s.........................,....3..X.......4.......................................................................................................x/..............8......../........... ......0...............\|...........T...........H3..........p........-......................8 ...............3.......................0......d...p1.......................1..x3..h ..H2......T............................&...%..L...(....$..\.......D,..l............,.......2..d3...............!..........\.......................................\........2..........l........................................!...+...#...%...&..t(.......(......x,..............<.... ... ......................P.......................H!..$!........................................................... ...............................$..8...l...p&...........%..........$...................................................h...

C:\Windows\INF\mdmrock3.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5190 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	78244
Entropy (8bit):	3.5000903239321506
Encrypted:	false
SSDEEP:	768:4x3ECwdEpGEq9T4PQ7XKhfUKGcflkj+RZmmlIjhvQHD/lHM+H/ArUEH+d:4xUCwdEpGNWPQ7EzG6lkiRt+jkD///H
MD5:	E70E1FB78B8532641031E21319D4DEEA
SHA1:	46BC4586E0377BE6A3F74FDDCC9C99221D299770
SHA-256:	B80BF2B610BF12CCCAA778436EE0095314ECCE3A110C1F01989E9C2F9918108F
SHA-512:	6548B69A54419D6F0E02A6951FA228A2ADAECC93026E0D01424955BC2B2ED650E94F6DE556AC360D6CBC99C517D5C4EFE592952AD6B193B9D6481C74F2390291
Malicious:	false
Preview:	.....................Q..qpw.................Q.......R..D....T......pr..._......h................1......C.:.\.W.i.n.d.o.w.s..............@...*...K..D=...B...L...J..\K...=...5...6...>...7...J..0M...5...2..P.... ..<...H...P6...O...P...;...1..\<...<...P...........N..............(5..@"..."...................&..`4..P....N..T............'...3...%......\|....#...,......(%..............................X&...M...!..........$...L........(..........`...T1.......I...I...........!.......A..h(..............T%..........(....1...=..P&...G...%..d=......l........9..\|....,...-...<...9...M...A......p....4...)..pM...M..............................(;...............:...G......<;..."...:...F.......F..................."..8....&...'...!...6..`....=...6..p6...5...#..\|5...!..H....(...K......P"..............4:...................... $...#...$..T....................I...................G...H......(&..`N...............%...A...7..X7..l....!..L)..P........ ..0%......$.......t...........\|................&...2..............

C:\Windows\INF\mdmrock4.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x89e0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	96028
Entropy (8bit):	3.549653856629484
Encrypted:	false
SSDEEP:	768:yiSKP0AxeJH+SW5fcXBcuyTxe9c/7lptzZX3Wm3/:yVW0AxuPBcuyH/7LX5
MD5:	851EBA0A181F5EB57A31FC73F4826F25
SHA1:	074F82A26824E447003CB8E40F74B09EDDE4294E
SHA-256:	CFEA93B9678AD606BCFC28ADC44E977687879ACB07D924ED9FB7F4FF3ECE29C4
SHA-512:	A9563E1FE2A600BE15C92EE270E1687A6FD5073C85ED84F2697DFB7A70F7D45CC6251592A8505BF959140DFC7F034DBB00836F16E0ADD2A44B98F70D134F4419
Malicious:	false
Preview:	........................qpw................\...!..........p.......X....f..8...h................w......C.:.\.W.i.n.d.o.w.s......\..........D............\|..0...\.......,.....................................P...............h.......`....&...f..........................@ ...........................N.......,...]...)..L............$...)..P...()...F..h...P\|..........D)...k..........................\,..H..................HN.......(..\|\.......5.. W..........(............'...........,.......P..........L...........&...q.......U.. )......0Z...Y.......t...... ...@....p...k......l\|...............,...............O..........t....B......8.......<.......8F.......7......P(...7... ......$9..............g..d(...h...1..`"..d4..Xp..X0..hs...t......p4...H...k.......!...,.........................P@...........P..........@-...-...8..X...........DV..P,..D....Z...@...u..<w..8....w..dv..(,.......x...v..hx...*...\|.......q..xr...s..dt...]..Hk......XX...........a..\|+..<e......@................(..............\|d..

C:\Windows\INF\mdmrock5.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x10b88 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	179340
Entropy (8bit):	3.652575549392294
Encrypted:	false
SSDEEP:	768:izE+/BS2CjAia+1FphVlQLc2XSNjEtcHhVTHqWEVuI:X+ZCP1FphzQLc2iNjrV3EVuI
MD5:	3D3255C0AF3047B7F9EDAF4FD4E8E290
SHA1:	CB1E95B61B26F93B3FC277BE1B26715F8138108C
SHA-256:	B40439BB694EDD07BCEA7EDF6EDC64EE54CA8A765E50CA54B2E37ADEAD2DD821
SHA-512:	59ED6C47E1DCEFC9C5F5779F72D8497D54DF65F40D1A9AF230A4DFFBA6CF2CAACC1DA0577BB5B6D7F3CDEA3A10575EB36D4B899C9E8AE8CBE7D64D76C4E585B3
Malicious:	false
Preview:	........................z.y..................../...........0...D1..xA..........h.......................C.:.\.W.i.n.d.o.w.s.....\| ......Dy......p'..X+..X...H.......@...........$.......$...\|&..................&..P'..X................$...,......(<..T.......P...........$U...........!..4...<...(W...........0..T...@...L...(...(...d.......X....#......L.......P.......X.......T........................0..X...T...\|...t.......X................=...]..,...@...t....... ...p.......H...<....*...O..8........).....xi..@...T,...x...V...2..\.......T%..D...."......... !..@...t...0`......(........... ....1..,...............D...........$........................y..,....l......-...w.......G..<...D....'..0(.......-..<....[...1... ......[..8............P......,...$ ... ...0....../...!..........................D...........`1..<1..........8m..$.......{.. ....k..\|v..T)..<...........@...x0..................)......u......0.......L....%.......'..d...L.... ......./..............,...D...\......................

C:\Windows\INF\mdmsier.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5b98 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	64868
Entropy (8bit):	3.481078098542315
Encrypted:	false
SSDEEP:	384:eceUuu70AykaBpdQ3c3O18Fph0W94bv0H9uutBOccSoGThegUwP8IsNoTyzs+fap:eJpu70FkaBEXOn0WGG9LtjheRe8d8LT3
MD5:	76C46185D38D874DA48586E2611C6348
SHA1:	D0977A3210D216A61B9C2ABF107D10EFB3843F20
SHA-256:	9B55BA67B0D502E5A58B361C84E26393EDA3F082DBE3D305312C8AC7B9CF403C
SHA-512:	9680330FD053297208BE6499841D1AD4C102F35B71A687965F2980B26A66FDB2A4D4FC137DA99A92A02AE98CD8178DCA0B80B53080B7D01FC43DB3E26CFEA660
Malicious:	false
Preview:	.....................[..z.y.................[.......\...... ^.......p...F......h...............`.......C.:.\.W.i.n.d.o.w.s..........".......%..,L......L...@"...... ............'..........\|(...........)...........................................-......P.......................................................d*..p...................X...............L........$..................................\...D...............................D...........@...d...t........M.......... ....L......t...............`...................L7..4$..."......x$..."..(........N..T....4..$#...6...)...(..........................................................</...........................:...........!......................,;..........$....P...F...R......,9...R..lR...P..pN..h6......\|.......................................................T...0...x+...,..............8............<...@......<....B..`A.......A...C...A...K......tL...Q...7...O..$...`R...S..4V..\|V..\U..<T.......W.. ...........................8...............h/..

C:\Windows\INF\mdmsii64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3508 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	32292
Entropy (8bit):	3.4123466172469237
Encrypted:	false
SSDEEP:	384:u/HPTDFaXU+ypSUXeLKUKd82um2+3G7oi:GHPTDFao0Qd5umB3G7oi
MD5:	09FD9408202C35ABB18A9B1700D30B41
SHA1:	B8C0CDA768B1588A03D0E27B2733D7D05D0073FB
SHA-256:	2EA6919D105A62CB426E1116688746D14964EBF1047D4D5ED80571CAF7DA761D
SHA-512:	480640FB7F104FE18B2C5EFDB06E3FF0A34B4C9CBA6D2EE90C0F3356FEEFD8EE77A423969A3B05BB500FBF75D710997C4D372A0776338C3855C3ED0DB5E6B392
Malicious:	false
Preview:	.....................5..z.y.................4.......6.......7.......>.......^..h............... ~......C.:.\.W.i.n.d.o.w.s.............................8........................................#..................4...............$.......................................d$...$......t...h...........\...........................D...p........... .......t...........................................................x...T...............................\|.......h........... ...............................p.......................`...............x....(..4.......,............)......................$..........................................................................$.......`....................%...%..8...........h.......l.......@"..x...............+.......*..........(+...........+...........+...........!..................................................................T&...&..........h...h...<... ... ...........................................<,..................................................

C:\Windows\INF\mdmsmart.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2828 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	19140
Entropy (8bit):	3.6669564618692783
Encrypted:	false
SSDEEP:	384:gTeR+IlSFpGzKy0D+iSfJrW+XjkoXR+KnQYZrOho:Z+IlSbGz3jRRrW+eo
MD5:	810AEF0B0B31E559F9FE48F9A900C902
SHA1:	67692683BAC4598599B971235730DDD4C00B06E2
SHA-256:	CB2F15DCDEA7592415BDC85FF8A8223C285EB3E600A43ED3674279E2F99D2687
SHA-512:	77D478884FBB99F76D476EE3A84B36F4513D5DC5E2988579A3C919DD2D29B601C62EF71448E6AE0D266852CC1CB00E9A5658AAFA7C281A9D5967F47258AF18F2
Malicious:	false
Preview:	....................((..z.y.................'...... ).......+.......0.......=..h................J......C.:.\.W.i.n.d.o.w.s.....<...........x....$......`'..........."...$...........&..t&..........................p.......L............................................................ ...!......................................`.......p...............H....&..............L.......H...............<%..................\|'..............h...........,...\...............D........ ......D'..l#...............!..................t...........................h...(...0.......................0'..................................................................D....................!......\|!..........\|%...............!......H........ .......$..h...................\|...T...(....#...#.., ..............................................H............................ ...................#..........8 ...................!...!..........."..D"..l%...$..........................8...........................4...........X.......

C:\Windows\INF\mdmsonyu.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xd520 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	123364
Entropy (8bit):	3.6555932294906452
Encrypted:	false
SSDEEP:	384:NXJaeez+Jx0xw6gPNxLwzzJIRovheXzwif/qBdFgdNTsbL:RDeYNxsvJYqUwiXqBdFgd2X
MD5:	7B2DEF6F69B74EB6D9FDCA003578D2CB
SHA1:	8A205A1FF0F6A3797E963EE6337F636983C4E97B
SHA-256:	3BC05C1A8A4F892ED64F8520354F44924FE77FEC10D3A34F653D07170385A316
SHA-512:	E4C6DD156BB36D41AA6BEB0DB6BAD1FF5E8EC463D2FD91679B449B0188352BE1B833DA721FFF36C2627E30145C1846BEC190F7146368C2E4C8B54562F0F71575
Malicious:	false
Preview:	.................... ...z.y....................................0........w...i..h.......................C.:.\.W.i.n.d.o.w.s.........P)...6.....@...."........ ;..`........'..@....?...u..P ...-...+...8..(.......L...,2.........<...................Hw..................................\|...........\.......x...............,............... ...<...$f......l....C..p...X....w...........S..............................t.......`.......X...........L...........lZ..........._.......... U...........o......<....N..............H....'..D...4...,o..@...p.......H_..,...D@...9...T......................................................d...........................................D.......0...........................X.......X........!...%..<...4g..4,...*..L#...........;..............L....S..........................,...........l...H.......x..........................d..........h...........$...........p;..4F......`'..P7...5..h....!..L...H...09..P................=..........$....(...5..,.......l......H...t:.. ...

C:\Windows\INF\mdmsun1.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1b78 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	14964
Entropy (8bit):	3.343057412793613
Encrypted:	false
SSDEEP:	192:72A7H4Yk35HYGgm04zOsG5AXXkX+TV5b2LB6sThDZs3q:SA7H4Yk3549eCL5AXUhNya
MD5:	4A83410F7A9DCFEC22F58610E5CDD290
SHA1:	9BC9E69E3239956E5CBF798535F2958EF9F6DCED
SHA-256:	5F8A27060A40DC23B6F2EDA5C850A67C6799D6E15B8BA76CF683070429340830
SHA-512:	FDF4814993E5D1A73B06B94FFFD84DF2E7BFD230FF3E15B080E06B4E5A427CA7B0C3297B0BD4FE3A616CA21F1B6E8FB96D35C287ED9B53ACDD7144C0CFE8F4FC
Malicious:	false
Preview:	....................x...z.y........................p.......8........!.......-..h...............p:......C.:.\.W.i.n.d.o.w.s.................H...........x...........................................................<...............,.......................................................0...........l.......P....................... ...@...............\|...........................................................................................`...L...............................\.......................................0.......T.......x.......x...l.......X...................`...H...............x.......................................................................................................................x.......<.......0...........................................$.......................................................................(...................................................D...8...........l...............................H.......................................................

C:\Windows\INF\mdmsun2.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4d98 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	47508
Entropy (8bit):	3.5493996760551028
Encrypted:	false
SSDEEP:	384:DVOh4Bq+3Q3zKazla2A6aYLXe3AiEH5WARd1yb7ijUcjz5TE:DVOh4Bq+3eKd5Y5WA9ybWIe+
MD5:	04BAE2B4B5F5AC2BFBCDFBCB1946D423
SHA1:	EC5281F1615BD044608D6E488FF61A08EC9AD6E2
SHA-256:	23BB0199822128394FE8E14861A3E4A1A39A818FFCC6E6D5D2111A2EE4562EFA
SHA-512:	8B7FAD5201E825A35FD1A013654C441C0297758863FD7C0A4B2D60E08FB4501071D519DF8F7ABC3FD7BC49DD6C4FCE9454B9B263C6CA2ECE147E178B18C35AE8
Malicious:	false
Preview:	.....................M..z.y.................M.......N..,....O..<....\.........h.......................C.:.\.W.i.n.d.o.w.s......................7..........................................................l...d...............................................................h...........................`...D.......T...........,...X...........x....... ...........................................$...........................................$.......<...........h8..@...............t...................................p...8H......, ..p....I......8&..\....K.......&...F..dG..`:..."..........................................................................................h...................X............"..\|............?..0F...D.......J...C...C...=...E..82..89.. ...T...,.......@...........................................h...................(............-...#.. 3...J...L...5...3..........p6...4...K.. ....7.......@...4..@;.......C...C...........@..t...........l.......................8...................

C:\Windows\INF\mdmsupr3.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5a40 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	66772
Entropy (8bit):	3.582715332729113
Encrypted:	false
SSDEEP:	1536:NhcNufIMqYC2DchGfKxz0SiTBSGZglkl2:vcNufIMqYC2DchGfKxz0SiTBSGZglR
MD5:	95E3AB216F0944A91677DF370DEAC8C3
SHA1:	6A0451181B95DE46B2B2C06F26CC13529C5B6361
SHA-256:	523EF6144EB4B0574CF658A23816DDD2650EEB689FEDF2044C19BB22F4DE062F
SHA-512:	6D799D37B709BE0DE65269803B6E8EB3BBA22E3F056558FB2BCB9004AE6EA981AFD3C04D8BB355F547B44B5D49B5F84661D3938F7C2C94DEA7B1CEE44C62C6B7
Malicious:	false
Preview:	....................@Z..z.y.................Y..:...8[......._.......v..$G......h.......................C.:.\.W.i.n.d.o.w.s......(...9...=...C..@S...I..lK...X...U...R...H..pJ..PI...........P..4Y.......J.......T..lP..$#.......X.......Q...0..\|....................O..................d2..$ ..........p........7...L...2..TO...#..8(...(...3...X...2...X..P....N..lD.......Y..................,....O......l6...N...U...N.......O...........2..........4...d0.......W..`R...(......X1...........6...............................0...=..d6..\|L...2..$....)...)..T)...?..\"...(..D3...3...6...N...7...........U..\T...T...Y.......&......\|$...$..........T........&...'.......O...........2......tX...........W..(Q..xQ......(2.......2...3..@(..,=..x)..(?...Q..h-...;......d=...=...(...4..$S..p4..t2..............\|+......................x7..T7...5...R..................\W.................. V..........<6..$O......,................... >...>..\-...)......$....Q......`...`)...................................2..............D...

C:\Windows\INF\mdmsupra.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xc118 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	210844
Entropy (8bit):	3.3214476196730063
Encrypted:	false
SSDEEP:	768:kzPYQrsYn/fD2mAeOSqAAEkPKr56f5KqWd6aX3mS0UjY+p9143e1p2MQmyzbJQ0N:ArsYn/fD2mAeOfAAPyW7IHGZvzwto
MD5:	F0F60A13D0FC3F0E46AEC2B797DA6C83
SHA1:	DAEB64989854DD7523791B8D9F6D375E412B10E8
SHA-256:	3BEF4FE70EE7736E9693512064A0822BDC7E6E6491DE6BC91C1C3DD5F6E2C80E
SHA-512:	3875EE9F5BE7C6ACF2E2026A99CC27DA84940B0EC28B005B3EE2409E860FC038A2CE7351504A169278F9F0B0D7A9C2DD190DAC06D4994682B81798754A06EBCE
Malicious:	false
Preview:	........................z.y....................&................C......P...H ..h................7......C.:.\.W.i.n.d.o.w.s.................\...........x...<...T...........X...............4..............................X.......x........(..........T.............................#..0)..........\|...P....%......<$.........8.......D&..\.......D........0..........`$......................\|.......L%..T...."..x.......T...........d.......4.......(......p.......................\....+..........H....................(......D%..x...X$..8.........................)...)..........H...X.......D...$..(.......H.......h...P...............0........g.. ...x0..p......<0..X#...'........X.......d...........l#......$....N..PU..H5......hU..8O...4...2..4P...O..,"..h&...&......'...".......................................+...+.....d..............8...........4................*.......%...................... M... ...3..X8..h....O...4... ..<....O...P..d........ ...-...@..L.......<A..TA...%...A......\....-..

C:\Windows\INF\mdmsuprv.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4bd8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	60980
Entropy (8bit):	3.519621243844655
Encrypted:	false
SSDEEP:	768:rtn60qjIrcTzEpPhB0gqMJgErT4GLkZWk1x3gdPcZxFXRewscaRIzgUfIe:rt60qjIrcTz8hB0gqM+Er8GLkZW2d
MD5:	7E3EBE01259FB015B92E41E00F02AC5A
SHA1:	19B61743A77D0E41E76EEC44E155F63AFBA9C9D0
SHA-256:	BE0B6ADE3474C7F79B68471A8D642C99474B977FB37C78BCA970A2DC77DFB195
SHA-512:	26D50F3CD16D08F660029D128676E9F223871AE95BEBB8C3100D102A80F7F867C1B9D320BB88DC65BA49425EE508A60D99E35BDCE2851340FE9061D7543509CA
Malicious:	false
Preview:	.....................K..z.y................XK......L..H....P.......e...D......h...............0.......C.:.\.W.i.n.d.o.w.s..........,...@..p....E...?...E..4E...F...E...>...?......L........:...K.......4...........9...........E..P....;..."...........8...........8..................p$..."...................)...5..P....8...........#...%..TE...%...E.......=..L2..(K.. %..........\|D...........9..0....)..l7..,G..@7..`F..49...........$......8........!...... I...H..........\#......(F...).......... ....&..........`...P"..L>.......5...$..<................?..L.......P%...%...)..d7...F...........F...F...;...J..$.......(...........D...................<.......P9.......... $.......F..........$...\:...:.......;..l....=......$....=.......?..........@........=.. >.......&..tJ..\|&...$......................................h..D*...(..\E..L................H..................tG...........(..x...........(8...&.......... ....>...?..,@..........4:...7..........\|8.. '...........................$..................

C:\Windows\INF\mdmtdk.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x6d30 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	101684
Entropy (8bit):	3.3587155756423144
Encrypted:	false
SSDEEP:	768:noKvkAyqktD34m8j+Q1zcibQ/hmINDvMxkDGqgvJEz:rvktqcD30+Q1z/0oINjMmtdz
MD5:	4F5D6EEB81613957F78B07BB17278CC1
SHA1:	26F2DB423E1BBD9F713BB39DD47599E7AA6A1826
SHA-256:	FCB5EBA05DB1A4656001C5C29A38A856154856B2F9A98E29E60CDEA8E39768DD
SHA-512:	56A719A7B6A933B5D4B22A079D160EEFA81692665C82CF01B55B55CD57DF64B995391A73C440DE659F3CCE98E936A46A8AE3ED648BCE8AB0579678C1C0B9CCA0
Malicious:	false
Preview:	....................0m..z.y.................l......(n..\|....o......@...x.......h...............0.......C.:.\.W.i.n.d.o.w.s.....$...\"...:...1..4i..`V..T]...i..Dh...h..x.......\|D..`#......$h...j..Ti...I..........................\|...............([......./.......k...@...........]..d.......hI......0....U...... ........k......H.......D....i.......i......8]...*...............'......................0....j...d...j..p]...c......PM..X.......(G...........S..`g...f..,.......4.......\|...`...........(H.......V...T...........^...V...V...W..._..L$...%..P....e..(........'...k...X...j..$]..@...............Lj...i...X..........Te..........x;...h......h9.......c...c...................i.......................E...........#...`....... ..."...I..."......@%...........e..h........i..................(...........................@............h.......Z...........g..(...............Pd.......[......dk.......>..........tL...]...^..LF..@(...^...R..._...^......$...........`...........................L...................

C:\Windows\INF\mdmtdkj2.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3b68 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	37916
Entropy (8bit):	3.4676843436041525
Encrypted:	false
SSDEEP:	384:/aB7XbvdD2kyfPst/z1NtAdkbWGUiHPs/Kpd2VCvJjODq:/atzdD2kAP61N3WGU2U+Kq
MD5:	3755D92EF78AABC093A28D11C338C3DC
SHA1:	2C5290F270C30D00367BEE2A58795975A95FAF83
SHA-256:	8D71F0A7EA3DC7D88B9B2ABE63CA0D43362CE2960900999600EA1432B90B49A8
SHA-512:	559A6E023FA2F3029A5EC1F990BA1BA964712FC118CE23CF2212367A6305A3546041D2B7B87129EAD6E007204C63A57BDF9C84045EE31C29C53833DEC1EB6D42
Malicious:	false
Preview:	....................h;..z.y.................:......`<......x=..L....H...%..pn..h.......................C.:.\.W.i.n.d.o.w.s.....0...............X+......\...H........,......................................t.......................t...P...................................................`...........................d...........T.......L...............................................0/.........../..........(1......x...l...........8...............\|...............8...t...0.......@...@...........D...........................8!... ......."... ...$..\...$#..<............#......\|2..,...8....7..........,5...........8..........49...............................-..................................................p,......\|.... ..D!...!..,%...!......p#...........+..p...p........................0...:......,0..........\|1.. .......h*......................4...................................................H....+..........p...........4........................................7.......,...4..,.......08......H...

C:\Windows\INF\mdmtdkj3.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3240 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	39300
Entropy (8bit):	3.371147367504872
Encrypted:	false
SSDEEP:	384:w0evgHH+210xcZHP2wZh6Xc4iGyy5pxdbbq7YXW6RsRXd:wJvgHH+21BP2aGVNb4c4t
MD5:	869C871EFE48C79E3ED1E74EDE5A606C
SHA1:	A64C40D03251AD991E4E1503DAB1F2DD19B0BC3A
SHA-256:	516BC45D8F31718BCF2D9E7CB5C91A388E0ACD3C51A51272A516F515551C961E
SHA-512:	45A3D0DC36F3B3007B963ADD6D504F826D9C7306A6B7B161AB46B5F0E18F66B0433B8AE02F6CE92F2B2F19265F546C48E26B55FF3F58BAE9C9F874802ACE3E0A
Malicious:	false
Preview:	....................@2..z.y.................1......83......P4..`....@..d,...m..h.......................C.:.\.W.i.n.d.o.w.s......................&..........d...........................................................................P...8...................................................................P.......................p........(..4...........8...........P...........................................x...................................................................................`..................................,....+......................T....)..(......x...................x.......................................\1..........D...................L...0...............8...............`....1......(........).......,..........\........)...&..........D.......x...............................................H&...................(...(..................\...........x.......P(......8'.......'.......+...+.......... ...........................................................P1..........$...

C:\Windows\INF\mdmtdkj4.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x38a0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	33596
Entropy (8bit):	3.500715700911209
Encrypted:	false
SSDEEP:	384:IBDb7HwGkbaLSOBfomiHU77KHln2KIOS9bPTBvQuj50RmOz:eb7HwGkujfomUMKIZVIuj43z
MD5:	98F2CEC1C85A0A9DC4B32B28BE8685A8
SHA1:	06D788306607C5B49592C5FBED8A812B01E2EF53
SHA-256:	C719CCE7959588F9BD407C7CF555E6533D68FFBBB80FD170CC582467C18BCE62
SHA-512:	86CB2E4D1F6512EF88CFF709E935BADEE7620F90DD69D0AE2EF3A0B49FF512B82823A9E0E1919053A26782E82A40B9F0792B99B69456130B772033EBD6041AF3
Malicious:	false
Preview:	.....................8..z.y.................8.......9......x:......(C... ..0c..h...............8.......C.:.\.W.i.n.d.o.w.s..................... &......T...........@...............................................H...............8...................................................................p...........................,.......p...............................................................4...............x...............\...........l...,.......................T.......8...d...............8...................0...............`/..D.......4....(..`...\....-...-...(......$.......................................................\7...................................7..................................8'..<............,......./..l+...+..h)..h,..L-...%..............,...........................................D... ...0%..................(...X...................................................l....&......p*.../...........+..................d...........H.......................P...P7..............

C:\Windows\INF\mdmtdkj5.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3f08 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	42172
Entropy (8bit):	3.443480167683224
Encrypted:	false
SSDEEP:	384:Q4etmoTdHk3Yf0/v5Ur+VkgE1taRcUsptC5UfV2NPEdeSe3fmtw:QrHk3Yf0/vHkgTatjVAueSe9
MD5:	35A958BDBAC7E64153E860C05975EE74
SHA1:	6C189AF294366D5813EC51E4547A1D8F4E6669F8
SHA-256:	607DBA2C89CF94B3E0CB12673F765C52E855CB0D40D8C6BC11D4B27B4B42FDC4
SHA-512:	58B0FCA84F0C1042DA395DE9532622075ABA060AF0EDCD676242386F90539C15B8688DA36B95EE2BA9CF937154218235BE85BCE6CE696ABDA3EBAFCC86275FC0
Malicious:	false
Preview:	.....................?..z.y.................>.......@..T...XA..<....M...+..(y..h.......................C.:.\.W.i.n.d.o.w.s.....l................+..................D...............................................................................................................................................h.......................t...............................................................8...........x...t...............`...............................t.......X.......<...h...............<...............P....3... .............., ...#.......,......D$...1...2...,...$..(.......................................................D<..........d........................<.................................. ,..@............1......4...T0...0..P.......42.................0.......................\|...................H...$......................,...\...................................................p....+......X/...3..........4>..............................t.......................T...8<..............

C:\Windows\INF\mdmtdkj6.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2878 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	23788
Entropy (8bit):	3.34918828333837
Encrypted:	false
SSDEEP:	384:i2XJMan3hqICNqI2Q8zh3rkrvOvH1Yd35:i2XJMaxqopAvceJ
MD5:	B0F68087F3CB31160CD49465B33A1D92
SHA1:	66DC2DA768FE572D2BE8637E46DEEAD31CDAE615
SHA-256:	FD1629010B8695B1888A1CB4625C5DA133B5859C65A23D43C4894C10DBC9FAB0
SHA-512:	BA5025040EABE91C7D2A1D68D1561FF94822A464C8FFD03ED57CDF65AF8334A1DE42871055E44769FAD4A13EFCE1943BB75F9FCF0D38EBAC9603A077425BEEC8
Malicious:	false
Preview:	....................x(..z.y.................'......p)..@....*......81.......G..h................\......C.:.\.W.i.n.d.o.w.s......&......................T...........................................................H...............8...................................................4...p...................p........................$......X...........................(................%..............@...............p...........................l...H...............................8...................0...............\|.......H...................................\...............@...$................................................#......p...@#......d.......................P... .......................................4.......T...........................`$...................... $.......&..('..............................................................D...............8...............................`...........d ..............<....&.......................... .......D...................................

C:\Windows\INF\mdmtdkj7.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2668 "Provider", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	29828
Entropy (8bit):	3.2776995985175876
Encrypted:	false
SSDEEP:	384:/aRmwDHf1JOhJ+i5E+lRlD6lby2SX/jXoZGlwlMjD0b5ww:/afDHNJOhJ+i5Em2TQl7O5ww
MD5:	14C8DD280151C9FF4C392B88B443FB1B
SHA1:	BDFCE9D13E9B08CC83006ADF6B1C773EEA11235A
SHA-256:	E8254155065FE1F5592EA1C5BAF2BCA8742E418684F91DD39DF3AE98787FB6C4
SHA-512:	766E22DA564EAE68404E1C866A3046A62E9DFF95EA23DBAFB1B2D80F2A3255041C7BAF530DC1E7E277F6C1C8024AE98AB07BDC2C7FDEEB601CF8E1FBD1577930
Malicious:	false
Preview:	....................h&..z.y.................%......`'......P(......01...!...R..h................t......C.:.\.W.i.n.d.o.w.s.....,.......................<...t...........................................................................................................................................h...........................P.......l.......H.......8...p...........d...........................................x...................................................4.......\...........h...x...........................P...T ............... ..........X...."..t............ ..."..P...........................................................................................L...................................`...`...\...x...........d...,!..0$..\$.......$......4 ..............(...........................................................................................................P...................L...@........ ... ..........P$..........................4...............................................

C:\Windows\INF\mdmtexas.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2148 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	23356
Entropy (8bit):	3.3104334364410413
Encrypted:	false
SSDEEP:	384:bWbnVsVo+niSHjX5Q78i6B88gB91roeEubNL8IAvRgQOAwMXEw3DBDz9hJ0kxcke:SnVs6+iqrDgB91MuRLlAvRgQOAwMXEwA
MD5:	AA034E4EE333EC458F89C91F4F2D7A4E
SHA1:	647BD8AB39C1BB3D05DB90B258683A99325A8406
SHA-256:	995D6E69BA4DBED95D8D1C20B85D4EFAC69FD594F0C73B29A61C0B4735C8875D
SHA-512:	C1B0D4F4B9F11D17389B50F42B83322E7ABFB8E1522E6B05CB3E1D87C3D6BB714C5B1EA69064F64940E2E6BC0D43BF205BA2A55181D82219EDFEC7A741F3A9E3
Malicious:	false
Preview:	....................H!..z.y................. ......@"......0#..h....*..L....B..h...............8[......C.:.\.W.i.n.d.o.w.s.............................\| ..@.......................................................\|...............l.......................................................<...............................................................................................................T................ ..............\|...............h.......................D.......` ..............<...........................t...........H.......8.......h.......P...................L ..................................................................,...........................\...................................<...@.......x...............................................L...H.......................0.......x....................................................................... ...................<...0...........d...................................................................p...................

C:\Windows\INF\mdmti.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x6300 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	80508
Entropy (8bit):	3.4918357898942767
Encrypted:	false
SSDEEP:	768:9ZAMpdzSIB8MDRHh+4TJqYxDp0EFHux8d4:kMpdJBPDRHhxTJqKF0EFOx8K
MD5:	AA896351F55BA4D33AAF9C32FC534994
SHA1:	B169D422C7BC9083874741513AE3AC82A8E23F26
SHA-256:	F3467485CD2CED81F3EEB8ABE7A163693731C3C3858DBB636FC65708D71B783F
SHA-512:	2C378D47869F0C79B62A983E6A83098222C76DD0B84099E3EFA2843D3E67EADDA7DECEB767F0142B7B1159B2D704122128E419647573AF7210F4681F37C88C02
Malicious:	false
Preview:	.....................c..z.y................\|b.......c.......f..........T].. ...h...............x:......C.:.\.W.i.n.d.o.w.s..........4...8...[..t....]...>...0...]..d...\|/..81.../...=..$V.. ....=...T...1...V......D...4....^..hY..4.......t....X..hV...Y..........................t#......................l........"..................`........................$..$2......................................x!..._...W...`...?...a..............`.......h....b......@\..$\..........h........>..`...............................8........%...)......D0...%..`%.......Z..h....`..L3...-...=..,`...>...........".......'...^.......]...... W.......`..._..\^..XX..............\W...........(......8_...........\...........D...........K...@...A...T...J..$D..XU..,U...T......`T...[...........\..T....................(......................@ ... ...................N.......[...M...E......LN...W...!..,M..D!.......N..tQ...R..(....R...V...U..dU..xT.. U...........Y..lT............... ..d@..........................................

C:\Windows\INF\mdmtkr.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5220 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	51468
Entropy (8bit):	3.468235071078439
Encrypted:	false
SSDEEP:	384:JCJwc5j1d2UT4mGe1eG5E+G2tSDABRIFBkXJyE5cwcG8V8Ae96:JCJN5j1dt4U35jGFz4cPjP
MD5:	70F20BFF69BC22D09A13A0034074DEC0
SHA1:	37662E1C7FF31FB6510D15171A69976B686C9CAC
SHA-256:	7F968FED8E913790FBBA6643897A052D24E5ABF4783F349D3EAD75CF6EBE29C2
SHA-512:	69738CAF5C1120BC99820ED2CD551AF4F41B0AE1746530CD2556568EFEA7518B5A58FB65CE51117CEB0F0995D93FEF7B88824209D3475A4B2C822128F767BD7C
Malicious:	false
Preview:	.................... R..z.y.................Q.......S.......T.......`...4.....h.......................C.:.\.W.i.n.d.o.w.s.....0...............pP..........P.......X.......................<.......................................\|...p...@........................................... ...x.......................................T.......p...............................................................................x...............d............................O..8...............D...............L...8...................h...,...p,...........*...=..\.......t........F..0<..................................................................h...........0............!..\!......................8....!...,..\|,......<0..D.......d,..h....1.......1...0..p:..........................,...0................................................................M...........2...1.......:..\|:..(....9...N..L2...<..<<...;..h....N..L9...A..pA...<..........@@...........B..............0...................(I..X...................

C:\Windows\INF\mdmtron.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3368 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	32676
Entropy (8bit):	3.5794032016909196
Encrypted:	false
SSDEEP:	384:8h2C02tXkCTdh+bg5xVfrdZBXIPjXznHBNSzCq2fpLlWADYWE/bAo:m2l2tXVP+bg5zB0PHveJ2hRpDY5Ao
MD5:	3D536B0B1D663B967C12458D3911E984
SHA1:	64CDA06BA4F922BBC1676B9478D26BAD932EBF78
SHA-256:	BF2E6A98E573FA8746F697F0CE7AA06DBB248D1B18F9AD45E77404C7499C970E
SHA-512:	6E670FD02F78A46EC46BCAF7193652593284F3FF0B3440C5BE659001BAD93C38D4215DC6ECFB13051978C43BCE596EADC5D5466A9BEADBDFAABFFC8C4D9B4C3F
Malicious:	false
Preview:	....................h3..z.y.................2......`4.......5..@...0A..8...h`..h.......................C.:.\.W.i.n.d.o.w.s......................,..........p...............................................8............................0..<...........................................................`...............................0.......................\|...........................................p............1.. 2...1..........\........)......................................................l.......................L0......\.......X...\%..........h%..l........*..,+.......'..........<...........................L................................................$..H................................&..\.......<........%........... ..............p.......<...............p.......................................\ ..P...,...............\.......................................P...<....(......<'..\|+.......1.......................(..............................\|#......................P...................

C:\Windows\INF\mdmusrf.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1b00 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	11476
Entropy (8bit):	3.5210402392265543
Encrypted:	false
SSDEEP:	192:B4V2CNxv4/tmt5tUXD+Sg5+W6mJ6mP8BJGqlsUx72wkX+bRqrnNSxm7PS3KXK5N:B4V2CNxvCtmtbUXD+Sg5+47P8HGpUx7X
MD5:	762E4DAFB8E24F9C6AEDACA86FEAB030
SHA1:	05A48DD5A6D08B4E92A7153128BEED23318E0A61
SHA-256:	7E96870E9B6ADE30715A45295BBC9DA022848F254D0BB20AEFF25C29ADFDEAE0
SHA-512:	71E476E6B7D77C243A771722048E3E23F5BAA765C852FD1C407F0839350AEB6A256F90263F2466128F2DDF5224C0CD5E6F36991D1562E8A4F3405DF2F86F2DFF
Malicious:	false
Preview:	........................z.y........................................` ..4....&..h................,......C.:.\.W.i.n.d.o.w.s.................................(.......t.......................@...............(.......t...............d...................................................................(...............`...................,...................@...........................................T...............................................T.......................t.......p...............4...................................\|...........8...........\...h...................\.......................................................................................................................................\...x.......P...D...........................P...H................................................................................................................... ...................$...............................................,...h...@...........................(...................

C:\Windows\INF\mdmusrg.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x39f8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	31188
Entropy (8bit):	3.7668562456163905
Encrypted:	false
SSDEEP:	768:bnuCiwkBJYByVguqd4AOh27/LL3vNI1rAIHAyefFP6l32mYDb:bnuCiwkBJYjuqd4AOh27/LL3vNI1rAIc
MD5:	ECEA5346207B21516786B7F4551A93A9
SHA1:	A73E0959946F980DA642FDC6730C361CDA61DC22
SHA-256:	702726059A2FC9367B9313B1BEB475BD34E11452190E567DBA98E5A92C2A70B4
SHA-512:	189C64DF4EB1BBC02712DCAA4372D66E94C2D26276FD4A26695CC087E9F08C8165A828A41839279D57F58C382F399637A011C60BE12E20AADC6B193716D64687
Malicious:	false
Preview:	.....................9..z.y................t9.."....:.......=.......H......8a..h................y......C.:.\.W.i.n.d.o.w.s......................0...........0.......-..L ...............3...-..h1......0...`.......................(......x$.......................6...6......D........ ......................4)......@&......8.......D ...'...1... ..........L#..........d&...............................)...2..8...................... ...t............#......$,..............4%...4..............p...$... "..............<$..D7.......!..\&...4...4..p2..D...(-......H...........$.......D).......2......\)..T-..............................................4.......p+......,....%.. ...$1...........,...............5..8....%..<'..........0....5..T/...................+..0'..d'...'...'..........$2...........................3...)..\|)...-......p...............40...................*.......7...(.......7..........\"...(..X2..,(..@2..........."...6.......................(...........................&..................

C:\Windows\INF\mdmusrgl.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x7530 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	53260
Entropy (8bit):	4.006095517046172
Encrypted:	false
SSDEEP:	1536:EJ6tAVg9xu6jxrkpPaUZB6SYxb5hFoeie1je69y0Xgt7MbDCFCPC7CZXfNVnFCoL:EJ6tAVg9xu6jxrHUZB6SYxb5hFoeie15
MD5:	3DD6FC0FAA6828BF6E4471831D8FA4CD
SHA1:	26D5F184C41728238CD830779152AD69DAF35789
SHA-256:	8E53EDEB954BFAAD10FEBA27397619075900034F569656B8453906534EE03ED4
SHA-512:	C5943E20BE2B904292A9AC2509B258EFC63B126AAA1B242FAE5019B79CC525709BF82F278D901F67DCBFC9B9CD0A352285A9D0DA6C699CCAD7F69208518350B6
Malicious:	false
Preview:	....................0u..z.y.................t..g...(v......8~..\........ ..P...h.......................C.:.\.W.i.n.d.o.w.s..... 2......\|X..................X%...n...............'.......\...........................%.......1...)...%.......Z.......\.......\..T................................_...\...'...p.......].......^.......q...X..$S...5...Y...S...$..\|Q...T...'..tV..HW...<...3..x9..\-......\|r...>...-...>..0?..`................a...........%.. d...).......<...........e...>..t@...>...p...?..P?......8t.......n...q...J...J...K...X..$Y...O..PR..,R...E...Z...;..t1...B...;.......................................,......(B.......+...)......4<......P&..L,...........*..tH..........$s.......s.......r...C..l"...D...q.......Z...q..\|;..L<...p...r.........../..t].......-...........]...............^...................`..l<..................................................................\.......t.......t...$ ..............................\|...D-.......................0..............$6...G..................

C:\Windows\INF\mdmusrk1.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x9ea8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	110308
Entropy (8bit):	3.7475597602445117
Encrypted:	false
SSDEEP:	3072:EfFkZ87dPIz5LtJTzGRIXFhVAwRJ2lwaWGusXMTZ2Qo:N4GNVTZbo
MD5:	049B5F45761F54F74B3199725D767EB5
SHA1:	E4B7F0021EA0D88B43BDB63D87CA24314D70900B
SHA-256:	D7AF600633542AEF21D5D34026E41679B415C4EC15C2E3A8F06B267067154223
SHA-512:	D393CD55F8E293C8090D2BE9972AD9D32EAD9BEE72DA6791D4EB6055417C4633FE4C5A8F7A6B8D6D5C76F04CE48DC3C95EB262F5224113586BFEBEE9F03DA435
Malicious:	false
Preview:	........................z.y..../.g.............D.......P.......)......lp..p>..h......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........?...'..........,x......tS......$....................F...G...x..........*.....T9.......:......,-..`....y..`O..........0........(...)..D...8M...M.......@...B...............8..DR.......P...v...;...K..`I...Q......(A..........(S..........DA...............................J...u..(...4<..H<..............p........Q......N......\........?.......O..tt..XS..XE.......... ....C..86.......3..$O..T]...H..8N..d........G...Y...".../..`8..@G...v...\......,v..DS......`....%..lR..0........S......0......<...........`...LJ.....................0W.. C...7..X...........\B...y..`y..pY...4...$...W...V..,N...\......d_...{..........xB..\|...\....G...E.......Q...I...............+..............\<.......R..L...du..........TK...7..<..........`Z..,5..h^..p........O...I..xv..\|_...;..Xw...C...q..8R......L...l".. \|...@..,R...H..pu..<@..lG...w......DU..........D....3.......P..

C:\Windows\INF\mdmusrsp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x19a0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	11924
Entropy (8bit):	3.4530433139508077
Encrypted:	false
SSDEEP:	192:z1mlOCS+FTjUXLFwkBk+u0ieX8dZbiJFJ+HZDWF4qLSQrT:z4lOCJFTgXLrBk+PieMdZbiJWHZDgpv
MD5:	51A05F62E6D670C1F4990B90534AFDA1
SHA1:	9C2045458AEBC3B83509D51763E29EC9A2D45B99
SHA-256:	1D7E60452638DC09C625D9B982F697A4C5F8BD1AC06A110AD12618DBD152C4DB
SHA-512:	40FF2CC01CFDA7539A8538617B62D799BF130F51FA7991B97F417896C54235398DB8A8F8ADD14F3E5969580253B3508C9135CA7B94238D29C4358DCBF1E8F872
Malicious:	false
Preview:	........................Z.{................ ...........T....................'..h.......................C.:.\.W.i.n.d.o.w.s.................................<.......................................................t...............d...................................................................................P........... .......................................t...............................................................$...............X...............................................4.......................4.......\|...l...............(.......................p.......................(...........................................`...x.......................................................................L...0.......................................@...t...................................................l...H............................................................................... .......`.......................0...............L.......................................................

C:\Windows\INF\mdmvdot.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x17f8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	9900
Entropy (8bit):	3.433950732859895
Encrypted:	false
SSDEEP:	192:lW0yW7Ho85g+5567gj45cOshAmcuhiiXXnQXKQRMBd8:oW7Ho85g+5567gE/wHcuYiXXQXKQv
MD5:	ADB54AA75422A7AB4CFDB74891D69E7F
SHA1:	28ADEF600E47BAA7AAC18F6640D839E1F87C75D8
SHA-256:	FB72C3B4EE75097F024ABCAE053B7BEDC4228A7029AF8D343CCEB9C262CBDFC3
SHA-512:	A002FDABD2A655EFDFC5847EB423813FCCF9BBEADD09F40122F9995A167BB5E655524C51825ACB32569DBFF76AECF236462225DEC7219D194855AE3D551FF1FA
Malicious:	false
Preview:	........................Z.{................x................................!..h................&......C.:.\.W.i.n.d.o.w.s.....................@...........................................,...........\...........<...............,...................................................................................H...................0.......l.......\|...T...........................L...............................\|...........................`.......................................................................<...(...x...p...d.......................................................................................................................................H...................................\...........`...........\|...X...................d.......T...@...x...................................................................................................................................(...............P...............................@.......................................................

C:\Windows\INF\mdmvv.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3d68 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	38252
Entropy (8bit):	3.6423581940657135
Encrypted:	false
SSDEEP:	384:0Uo3UfPYDUHcpMC6I/XmxytUSL+kebLkhKwdcipzM68f3nxnjstz9KgXj7DU:iUfgDUHcpMAUq+kebwh+iZMv/JI9g
MD5:	373FC3F8429A37C2A474A2C575FDAE69
SHA1:	58B75DD1A32F62CA0A267E93AE2FEED6B72A0E38
SHA-256:	8C3D89264BD74BA95BDC48600792C61AA3E4417E7C7E7EAF1C98C16CC624620B
SHA-512:	8F7CD0CB830D6C2B3329437B365DFC505592C608DBFAE6E7C5557FB1805069F5806DC6027F8B39FCAA3EDB4E310035020D2F275D64D5B2B5E834BEA9619CE3A6
Malicious:	false
Preview:	....................h=..Z.{..../.g..........<......`>..D....@......hM...$..hq..h...............h.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......`................6...........6...5...5.......................4...7...................;..0...........<....<...................................................3......L...........p.......................D...\|....7..@... 7......t........................................... ....7...1...8..........$...........p.......p...$.......d4..05..h...................................................X....(......(#..8... ..."...........+..d....'...8...(.. -..48..............<...8....7..P7......................8........5...9......(........1...................6.......9..H4...;..,<...............$.......%..\'.........L....0..t....,...'..D2...........5..8.......\................................................5...................3...................1......................................\|/..<)..x-.......,..8;.......;..h...............@.... ......................d...

C:\Windows\INF\mdmwhql0.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x12670 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	242612
Entropy (8bit):	3.688410659367968
Encrypted:	false
SSDEEP:	1536:TqVyCdU9S9/UN8G3bz0IBjxdd8Sz0T8N1OUR1BzZ0:TqVLdU9S9/I8G3bzjBZxdN1Ou1BzZ0
MD5:	9D9BE86121873AF88C85E13ABAE78869
SHA1:	BAB98B2AB18AD9BE689C7CC503C2741A5289131B
SHA-256:	8624BD6F37FBFC9C3DCAC3BFFB9155E9668107F25A34B0F6A9D490467316B7BA
SHA-512:	B6C444E23B964BC860CF5096948E97EA4FEEF091D0432EDB2B0E38144C34CEC20B4752F630B148FE61785704EF9E24D9F4BC25F4691A0462776F88FA9C699495
Malicious:	false
Preview:	....................p&..Z.{.................%..E...h'..d....,...I...v...... ...h.......................C.:.\.W.i.n.d.o.w.s......?..d...lK...Y.......z...s......p...P.......x...................T...\|...P........'...%..\)...,..X....... %..@...........X;...................................'...........<...(...6.......3..p<..$...-..Tt...3..P...`....J..h...X:...........".......\..`j......XH...U..l%...1.............`.......\|+...F...!..Pa..L5..h....8......H........-..L$..p2.......s..` ..............4..`............9..........t....3..\.......H(...-...o...'..h... ....<.. ....:...s......h........6......\...............H1..T,..$-..t0..t...........<.......8............2......................t$...$..............@d...<..,B...F...V.......M..8...D>...&...?..p...0#... .......4..03..X%..........x........................7...6..,...l"...7..h-.................../..............,"......`6...........<..,...D....7...=...V..\m..8B..TK...7..D...L$...?...}...7..."...5..4u..8........;...;...;..X3..................

C:\Windows\INF\mdmx5560.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xa8a8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	97020
Entropy (8bit):	3.70701912183162
Encrypted:	false
SSDEEP:	384:+r1BLQbTqe60ZY0+sRDkcZBFDrgVgP16I0Ppby74PthW:+r12bTF+sFLFDw+1l8Y4a
MD5:	5EA54B2E56C19819024F2A526E338ABC
SHA1:	049694AF035600F847D0A2E3A54E5411DEE6CD20
SHA-256:	843FE465FD45942D00150B8458C54271E79B948FE37376C0D31F6803CDC4BC23
SHA-512:	E43F1A5946C234CDD8CC7A83272941604A495FFFE83A7073BB3FBD10FC6F610943BBF9667A016CB1FF68F66C1A5D4BB551B72A0A1A3617875B0F54B06206ACC9
Malicious:	false
Preview:	........................Z.{................(...........@......X...8...`\......h................z......C.:.\.W.i.n.d.o.w.s.....D...,...9..........@"..............,.......'......\|...`i.............<.. ...t...h...............X..........................................................................(.......t...........h.......D...Ht.......a......d....D..........\l...........Q....................................0.......H...............8..............L....]......................<h..(........M.......i.......v...u..H...T....g...]..8M..p...(].......B.............8..................P.......................................\.......\...8.......................$...P...........x...................,...(...t...L ...%..t...tb...-......#..........(...h...............................................`...,~......p...$..................................................@.......$...............H...P(...:...8......X ..........`=..D........%......H............-...*..............<....2..............

C:\Windows\INF\mdmzoom.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe990 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	195452
Entropy (8bit):	3.509626478524839
Encrypted:	false
SSDEEP:	1536:lp7lWWgB2pt2HxtP3ipYLMXb+uNg5kucTXW1N:lpBWWgB2pt2HHP3tD
MD5:	A15E491EF234C5AAB864774374C45353
SHA1:	1A398B19E5485DB28AD8FBC416A71698B15FFF5F
SHA-256:	206B0A8D7217243D0F5B37F52C5CB768A19612F563DA36130397EE1909BA7E9A
SHA-512:	AFC5863FC5D76BB885E5AFF298099813D0C28D4E0CCC89CE42E764CF7D9FBDCB70621641E2FAD30228E35D9E606D5C4A03D24FA62BA9531310D551C84669EE27
Malicious:	false
Preview:	........................Z.{............................D.......H<...)..,...H...h...............x.......C.:.\.W.i.n.d.o.w.s.....................\...\|...\...\|...0...............4...................X...............8...8.......\|...(......\|.......\................m..........................<...........<...............@...<.......P...........$.......x....#..4.......@.......\!...I...{..D...t.......p.......\.......\............j..........<m..(...................................d................... .......x4......@....>... ..D-......`+..D...DA..........l.......\....*.......$..(........$......@...8...\|...............................................0...$...@1...!..`................................J..T........v..`........s..<c..<...<.......P%......(v...................... ......................T/.......:...0......`.... ...............2..03..(...,=..t=.......B..x........?..8........F..........P..................................l.... ..................."...$......................`....2.......-..

C:\Windows\INF\mdmzyp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x90c0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	119236
Entropy (8bit):	3.4165683984103583
Encrypted:	false
SSDEEP:	384:TJzKDMWQPqk1X0SfwhFpi0dRdB0O76DBYLUeQBv4wnEQ7cJ:TEMWQlwhrisj0OelYLUpBTC
MD5:	E7E32679EFFD90B9364AB267A2F927EB
SHA1:	CBB47692D677CBA691C192FAC51444F6430AF282
SHA-256:	E39EE43902F7BB33BF737742BA045BBE2B2BC9B11B49F5358449DD4DC3D9ECA9
SHA-512:	F5840E01AC98A4C937D28FCBC7219968DE5AD1E798E87B207D8B96793E716664ACACFB49D0783590E41CCF49639774B40DB4CF704DAA8F5FC6029C61847C8F50
Malicious:	false
Preview:	........................Z.{................@................... ...........B..h.......................C.:.\.W.i.n.d.o.w.s......U.......................K..0...........P...........p.......$...........P...........\|............<..l................K.......-...}.......7...[.......C......<....>...Q......pG..l...4...X.......4........T..$...................X .........\|........%..................p)...................K...............................M...D.......P...............r...K......pW.......<.......H...?..pV...........G...G..t....(...................................I..D....K..........TH..............\I...............................Y...Z......d\...\.......a..........DU..._.......d..<e..............l;..0.......0...........p................H..........H...(...`.......................X...................................H"...g...J...)..<L..d.......0s...s..........h...$D......L...........0................6.. ........B..........8>..................d........................... ...................

C:\Windows\INF\mdmzyxel.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xf8c8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	174740
Entropy (8bit):	3.5935389972728298
Encrypted:	false
SSDEEP:	768:Eb8F8WZoydjG2awGWKCD6hjtyoikVH5f0HChQ7VYJFHirQSJXYXfJi5XqVdAwg/A:EbSdjDZGWX6rFH5NhctTJEi5xYf
MD5:	3D090D3B4E209108D3C94127F2FDE2F4
SHA1:	F742DADA5984B4FB87108B162A4E2259C050C989
SHA-256:	7973B8A48C3C8C070570FFDDB637FD283FA28DCE91FD79D135A4A436547E5A47
SHA-512:	229463973303F28E8D01ABED2D80D8BCC9CF079C563D1C69F6084C99E78172B629AC76E734259E199C58BBC98F6ADA14B0FF0CDD27760BBAA42F75E5A763ED57
Malicious:	false
Preview:	........................Z.{................D...........0......../...+..d...(...h.......................C.:.\.W.i.n.d.o.w.s.....L...TQ......X]...........h......D.......LS......4i...Q..x...X ..$.......Tp.............\|........m..@...(....!...... 2...\|..\|...p<...........H.......u.. ...."......4L.......y..T&...z...#...........B......p$..dF..................X......\|.......DU..4...............HY..$&..`...........pv..L............#.......4..t...$_...v......L...T.......,....>.......}..TC......4n..8%..@z..Dq.......!..L............#...W..........x...........p....T......4u......d&.......~...z..\|&......0.......0...........\...........x .......... .......T~.......Y.. #......................\|........D..0....l..l)..t1...+.......3..,............+......(............}......,%..D.......d$...............................&...}...........&.......X......T........3..T...l........~..<v...%..p...`...t.......h%...N...%......<.......(...........T...P...X...........(... M..............\|... ....#..................

C:\Windows\INF\mdmzyxlg.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x11878 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	193588
Entropy (8bit):	4.126409675482927
Encrypted:	false
SSDEEP:	3072:YppdABu20mvXRRgUFspXhPnpKBPupdY8QUoMgPjnbfz3i+qmScBaWdplxNZVYkgZ:Yd8hgUFspRRKBPupdY8QUoMgPjnbfz3m
MD5:	46ADF78E3D38618F77910BD525943590
SHA1:	25431C909220FF0D5D3CE5840999EFCEFCE751F4
SHA-256:	3EFF4004B738DED0F8E7E1A8ACC2D323A4F339E8368AD802F958FF2C2E29DDD3
SHA-512:	E839FABBE714C5CB4C487468FB88067A7856360117E56EDFCB0D00638409CF9B96F5F4ED22C9A28008D537A5132F316E90A621FED5A6CBDE7E0E27B61894AA82
Malicious:	false
Preview:	....................x...Z.{....................f...p.......h!..(\...}..L....8..h...............0.......C.:.\.W.i.n.d.o.w.s.....T.......<<.........8........C......4=.............................................................d..............P...................d.......\|...<.......p....!.......{...x...o...u..\|u..X....5..<t..$...................`...............,.......,....... .......(...........,...T.......x...........4...$...............4...........................0b...^..............pe..8...............h...(...............\|...,...@..............T....\|...........#..P...............4...<...D........O..\|l..........x...T...$..........h!......8...$..................d........... .......X.......@.......(...........8...D.......<.......d.......8.......X........"......\...H...........T................P..........\3......................D...........@...............t....................8......@...............x...0.......<...........4....!..............h...................t...l.......t.......

C:\Windows\INF\megasas.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x26f8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	15060
Entropy (8bit):	3.8294908172434003
Encrypted:	false
SSDEEP:	192:EHYK0aZC46IIItMYuC+Ldy3glGVDvcG03a5wUIEfx4s8PEjbADHY7/4MIlct/rJD:EoaYNCrSGVLt033vEY+QMI8jJsgUyTXp
MD5:	64435340985A428017C100763308968E
SHA1:	FCF105E70BADD26BA43C492CFD605F76DF417567
SHA-256:	0BB71467B658C2018C0F2617AA802B8AE522D5A460C29C2EF9E453420347F0EA
SHA-512:	DFDB66C6F4FDB5EC9FB2CE37948E437024E10DD20A479A15C727DF0F29107642AFFD81D7D72786A65E0CDA7FB90D6306F033C6AEE3177ECC12DFA96A04BEF30D
Malicious:	false
Preview:	.....................&..M%......R..........d&.......(.......)...............4..h................:......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................x...............................................d...........................`...................................................h...........<...`...........................L...................................................................H.......................................0&..............................4...........$...................T...........H...............t...........$...............................................p...<".......................................................................................................!......H!......."..t........ .......#..0#................................... ..D...........x%..................................,............... ...0...............................x.......l.......8.......L...0...............P...........x...............P....#......

C:\Windows\INF\megasas2i.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2148 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	12596
Entropy (8bit):	3.7730648328955034
Encrypted:	false
SSDEEP:	192:hQH6IOCTF/P+nl//ng7pttFUfVOm4IeDWqFDRlFYLE:usCpK//gdtj4VfMDRlFkE
MD5:	BADDE4D45A698F72FA0646209FC5E831
SHA1:	DFF23094C5D018BA591ABBA2BAA315A0B8CD5242
SHA-256:	8B06212DB80A348E08F2A66B5ABFA7568079DC2BFE5DC2EFC28507EE79EE1B7E
SHA-512:	11C7BE1E76099EE3C1A87A0D0F013B37E7BCAB5EEB076DA83A65B780DCE4C5571CE257D9AF13A78B1200FD9D8E8EB8F1EC6B3838FD9DC16264221510E6280556
Malicious:	false
Preview:	....................H!..M%......R........... ......P"..h....#.......'......x,..h...............01......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......t.......................................................................$...................................................................4...........................(...................................P.......t...<...<...........................................t...............................................................................x...........................@...............................................................0...t...........................................................................................................`...............................................$ ..T ......................................................................................................\|...........................................................................................d...........................(...................8...........

C:\Windows\INF\megasas35i.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3720 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	21004
Entropy (8bit):	3.9722638913228914
Encrypted:	false
SSDEEP:	192:FCfGQIjcW94HucDu/CuuLWOun3huJWmuUCnJL+lKHlTjqhpsAjMQ2UAVQd4oWDmI:FCOwCGmTjqnvj4HV7JahnEx6ib+kb
MD5:	90EDC87D3765EC0ECA50F21D0DFD662C
SHA1:	A54ECCD5C9C22E275B467139B9290CCAF0140A7C
SHA-256:	789FE47F823271B6F5ABE2CE435F7E4C3D24FE645C86E70AAFF69FB7B949B956
SHA-512:	75C47A8BE05DD362AFF56BE6E638F27426A8E2B6E4B13955732340A8D7599BBC04A5FBEA9BFEBB984FB82C8CE2C219A4582E355F578A35816F178C189E51A61C
Malicious:	false
Preview:	.................... 7..M%......R...........6......(8..h....9..D....@......pI..h................R......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........#...........+..........X................%..........................$...0...........L/..........................................$...........0...\|%..........P...........4...."..................8...................p...8....%...........!..................................................t+.......................1............... ..................."..................t.......L...................................P,..........................<...p............(........................... ..................................................................\........................................&...'..<'..l'......................................................................@#...............................#..........................,$... .. ...........................\6...'...'..h#...........)..P&......."..h)..............$...................L"..........

C:\Windows\INF\megasr.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x438c0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	364708
Entropy (8bit):	4.168309185831594
Encrypted:	false
SSDEEP:	1536:vrBDH+GuYH9TdocornvdVR+1GuwYCd5/7bZkNETpLSbVppLSbVp:eYH9TdQvdVR+1GtDdpl9LSbVfLSbVp
MD5:	5D3ED117F37D2D886EE4EEC9A68A3B99
SHA1:	F59F281C1A5112B5ED34D197AADA84AC638AD94E
SHA-256:	8A222A18AB15FD961064C40B8F7890E281CDAF70A36186F84256F33798B32145
SHA-512:	1E9B37C25384F1E03CDD0AE3C882FFC53E9DD8930C6E609D05423342FEE2EA89FBE2AF40244FB2BA5A77EF184B33DA98A9A16E838DE5592B42A3B84A160B0135
Malicious:	false
Preview:	.....................8..M%......R..........08.......9..h... ;..lf.......w......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........hq.......L...M...M..xN..H5...L......X9......(a...a...b...c..hd... ...f...f...g..xh..H\..."..........._..X`......h....E..D....-......h....3..8....1.....4...<....m.................8....y..........X..............(.......8.......H........N..h....R..x............!..<-.......Y.........4...\...xn..............4...Hb..\....i.......d...e...h.......c.......r...G..X.......h.......(...X......(...x...............l......(g...g...Z......D...........L&......4................c..T_.......d..Xu..............F..xG..HH.....T0..8...8<.. 4..(...8k.....Xf.............X...(.......(..............@...hL..........\......,...P...PD.........(......8...</..............X...H......................8.......XL..(M......8.............x....I......H1...*..................................................p..................,...p...\...T...........................

C:\Windows\INF\mf.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1288 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6388
Entropy (8bit):	3.275995560174736
Encrypted:	false
SSDEEP:	96:yziA/9fHT5lpxp31AQgbButx0IVYm8QxdE4g2vWL:VWfHT5lLpiJuqmde4I
MD5:	E0EA57D5B07C397907A8F21314DAC650
SHA1:	312078BEBD66A57D5F8D6FDD5695ED47B7BA7F56
SHA-256:	D22C41F3C31E3A1A83A64031B85323D1FD4F5E32DE6AE8B77E07AB862AF4C703
SHA-512:	703BADC1A93A4333E861681035DF397695DB6305E7DF2B12C31B2756D7BCB4CBF7F5EA1E7C1094F83A64E8CAEF51A0B1CFDEE68A4ECE91D00CAE05FCD8C14BFE
Malicious:	false
Preview:	................$................b.............................D.......p.......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......T...............................................................................................................................................<...........................................................................\|.......................................................................$.......................................................................D.......................................................h............................................................................................... ...........................................................................................................................................................................................\...................................d.......................................................................h...............<...............P...........

C:\Windows\INF\mgtdyn.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1c70 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9532
Entropy (8bit):	3.6092016058113687
Encrypted:	false
SSDEEP:	192:Ul6cHyAHG6AxAVwdy5CmLDv/VKQtrnL1OkN6NUzzi:UlyVj2wQtrn366zu
MD5:	269C582A743B2A90F2937F212ADE6A45
SHA1:	343B7578DD7E2109CBE26282D5729673511DC6A0
SHA-256:	8185B2E651BA21AF8146C1F8F1DB08DAFAA6266365C81656C7B93E9D05FF3291
SHA-512:	19AFEA60D00315D04D91D3EDA1A83108E35BD1B68E1F72782D615B58A612F97F0B03F907BC5A19A8E51DE3C9FA546C44CCE37A06C580F4C9276D742C6C0D4B17
Malicious:	false
Preview:	....................p...Z.{......n.....................,............ ..4....#..h...............8%......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................H...................................................................................(...........................................................................................D.......................................................................................................................................................................l...............0...........`...........................,...........................................................................<.......................................................................................................................................................`.......................................................4...................(.......<.......4.......................................................................`...............4...........................

C:\Windows\INF\microsoft_bluetooth_a2dp_snk.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xf60 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5052
Entropy (8bit):	3.057659018259666
Encrypted:	false
SSDEEP:	48:25ZEleEKzhz0/N5Ss/2sRVwFrUpC0SR5DmbucSnxfc:25ZEe5z1AHesRVwh/ibuLxk
MD5:	656D0383A703EDF747384DF4A45DD2DB
SHA1:	69E6E308272EFDFFA90625A9863B6DA5EE6E8E3B
SHA-256:	C545604A3690C2FC361B1D3FC7948F5D4C399DC7398C1DECF6D97FC1E78E2B59
SHA-512:	3E290C0C7A98B4BFE4DD6CD4F5211EEF3AA7F723E7D531BE238EA9BE56AAFD826864EC0F10CEBD8A34DC15F235101D27172B702F759826EF99900C8BA524FB69
Malicious:	false
Preview:	....................`...y.%........................X...........................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................................................................x...................................................\...............4...................................................................................................................................................D...............................................H.......................................................................................................................................................x...................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\microsoft_bluetooth_a2dp_src.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xf80 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5084
Entropy (8bit):	3.0458118286439904
Encrypted:	false
SSDEEP:	48:Y+ezX+vq/c7tz0y4H5eiX7vzR8yvp0yGneucS4yp+:Y9T+C/c75B4bX77RvppuLNc
MD5:	9A5B395DCCCB9FB9767F71F8041F07E2
SHA1:	F71AB3B326B58C4F6C641F6FFCB0D0FF77F103D1
SHA-256:	6185EBE09C53BB2F55FD68A175CFECDEAF21908DA8BEE8C4256021021E4C3984
SHA-512:	21A52D02AA87E07B8CA652960B01992953D24BC9F0BE72A16F33B3B4CDB613A22E6CB98136348CD6E22C70BE92733D665C04784054E6FE7C9FF51176B8CAA204
Malicious:	false
Preview:	........................y.%.....I..................x.......0...................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................................................................\|.......................................................................................................................................................................................................d...............................................................L............................................................................................................................................................................... ...........................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\microsoft_bluetooth_hfp_ag.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x10b0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5444
Entropy (8bit):	3.1771749225405355
Encrypted:	false
SSDEEP:	48:+o8hClBOiq4g0MZL5iqtEHzRVHr0MD60bWbsWctrWdsnEl3v:D8ElIi4HByTRNrDQbXcrssEV
MD5:	60A6D91D07A945F886FB934D0F8A03E3
SHA1:	347BF0C6114182B1E946BA0B293392C936D7C907
SHA-256:	37D83DDEA1C5D6E794E4264DBDF737A676D3F9AF03B9BDF533B2A25EC2FEB535
SHA-512:	7B3BDC7FE9CC51B88AD66CAF4FF9399970EC8962C26083E9B69F6F8C3B49883499943F88D7C6FCC747E785A8F099E858375F31CFD22756980592D8DEBB7C784B
Malicious:	false
Preview:	........................y.%.....I..........................h.......P.......H...h...............@.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................................................................................................................(...................................................................................(...............................................................................................................................x.......................................................................................................................................................D...................................................................................................................................x...............................................................................................................................................................................................................

C:\Windows\INF\microsoft_bluetooth_hfp_hf.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1088 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5404
Entropy (8bit):	3.145484262396944
Encrypted:	false
SSDEEP:	48:+t4vx2JkJqgrRpu8u0y4ZB5acV/RVlFraAyU970yIhQEMctb2xesyXwod:ZvkJkJqi2B4NV/RVlhX97yMcb2IsIF
MD5:	D11282AB5DB5A95D417BE60ACA7091BD
SHA1:	40302AD864BE587426D8264C2E4CCDFFB30979EB
SHA-256:	D11D14D7ED763F9D264F098D87F22565AA00ABC94F6931E33B43CA3AD186F59C
SHA-512:	A259BE6BD4A39B34AC0E8D1EBE3CDD5734DFD37C7A9962A0C47A19B70AE1B9E8DF8291FCDCBFE132E9FE2BD716D6EB48EDD37743BDE5EBEBBFDDF6FAAB43BF6F
Malicious:	false
Preview:	........................y.%.....I..........................@.......(....... ...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................................................................................................................................`...................................................................................................................................................................................................p...............................................d........................................................................................................................................................................................................... .......................................................P.......................................................................................................................................................................................

C:\Windows\INF\miradisp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x21b8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	12236
Entropy (8bit):	3.7044600515502717
Encrypted:	false
SSDEEP:	192:PNQoRF1zTYrySanyMl+aEjWwdzmjsqk2lhqvuiaWWwg2T28q6:PNNMsyM0agWwdzmjsqtlDi+jQ
MD5:	C8F9719845A1C46810864FFFB77E2BE8
SHA1:	4C67F9782562D4967BD886B18C053857A2784757
SHA-256:	656914E8EBF65E108D901EF8AE115FC396F1A09447D8576C03F9546624A32183
SHA-512:	F5A94CD33B7A6C3653F708F6E9596CD326D8A4EB83B0095055147DD226DE0B086A657C814CB4B4AB92B3FC47D733F98C1F0440D908EE5B1BDD3A046E78477577
Malicious:	false
Preview:	.....................!...W./...-...........$!......."......h$.......'.......+..h................/......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S............................ ....... ......................................................................$....................................................................... ...\|...........................,...........................................................................................................................x...................................p...............X...............$...........................x...................`.......................................................................t...........................................t...............................D...................................\|................ ......p...................................................................................T...........................................................T...@...........P...............$............ ..............

C:\Windows\INF\modemcsa.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x29a0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	15676
Entropy (8bit):	3.8536079304602975
Encrypted:	false
SSDEEP:	384:9JllL8zrZhgzvVNNuAarKwAT0UO6hX2/VdzXeQqq+tcccccccccccct:958z12zvVNNuAarKwAT0UO6hX2/uQq7n
MD5:	4DEA3188A1A899771295A312B05C445E
SHA1:	751E1C3144A36301C8865570F272CAA0C719413C
SHA-256:	BABCDE638249871E54E44FA9C2D16DA7741A2CE51744D70CD65278488C07050A
SHA-512:	B6AC0A76F2CED5E0458B43DBA672FBBA68B10396AB00FBD8F0519635479ABB464E3E070AC0E59E7A469A823A5CD05872C13FEB92ADE226D6F4058B6698D13330
Malicious:	false
Preview:	.....................)...\|../....#...........).......*.......,......h1......P7..h...............8=......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......P...........T...............P...@%..........................8#..........L...........................D...........x$..........................................................l(..4(......8.......\...........L...L........................................&..................................................P...8....................&..8...............................h............%..........P(......<&...&...$.......'..............................................l.......D$..............0...................................0...............0.......................x...T............&..................................................P"..h!..................................................t'.......................#..................H............"...!..................................................x&..................(...........................................

C:\Windows\INF\mrvlpcie8897.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3080 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	21388
Entropy (8bit):	3.8833641602463898
Encrypted:	false
SSDEEP:	384:klI6/2Pb6Syj57tdCZ0fY3arDT1RPhC4AI6X:G/2PbxyjZCZ0fYKrDT1Rg4q
MD5:	E2C6849D0C81A6F24339176A85C8636A
SHA1:	F38BDF085524A8A30C4E291CC86DABEF11D9F2D8
SHA-256:	7AAFB25E16D5D20E68DD6498516AE32DD2EACB0A2FD675BD60B772D43067D4B1
SHA-512:	98FBF9DF72EB7C95FB8D2BEB7A431C4545399670EA548AC3570A3A7111F488A039DDED8907A21EEB134858ABB1DCDCB4847BDABAA4B91521AFDCD10BEB01E63E
Malicious:	false
Preview:	.....................0...].......{........../.......1..X....3..p...X<.......G..h................S......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............,..................8............................'...)......................................h.......T(..........h........................!......4...(...x...........h...8................ ..P...............t....#......................."..................D.......................x%..............l...............8.......................(................).......'..........h+..........P)...,..h...&..........h...$....)........... ..L'.......................................................,.............................................................................................................. (......................................................................t-......p(...................!...............................'...........................-.............................................../..8/.......(......................$.......

C:\Windows\INF\msclmd.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1188 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5844
Entropy (8bit):	3.24522328440018
Encrypted:	false
SSDEEP:	48:TeIYfoT/3uD6DN75SqWgBr+2fXDV352sI5dAIhv4Efcs9gnq1UCMagb7XIYoYA:TeIYf3mhxBr+4lPIpHfmnq1UCM5EYoYA
MD5:	44B8DC557C89F03F13FD58F69CB0E9E4
SHA1:	36B7FEB2C0C5DB6DA35443F87546FAC264BF354F
SHA-256:	284759F7124895CF8A3BD25F44084D593DA7E68F409AE799351438A07E521465
SHA-512:	165267FDEE874C9360B9DCBA1D301363B88531A4D396FFBD9F392ED2AA36F4405FA9FC6902740C05F496FE5A214C378A851ED81BCC26A41C91D50ACDC8002B04
Malicious:	false
Preview:	.........................+....yl..........................P... ...p...0.......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................................,...........................8...t.......................................................................................................P.......................................................................................................t.......................................................................................................................................................................................................................................................................................................................<...............................................................................................`...............................\|...........D...............................................................P...........................

C:\Windows\INF\msdri.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1390 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6948
Entropy (8bit):	3.3716156255402607
Encrypted:	false
SSDEEP:	48:ZoQN6ymXAaAXQtkgyd7gQHbVjL5qmAgN+nF2H7GMz9EagnCrxe2peeL7+YUhzQ9p:6VyzanRyd7gQbVsTYHieT4z6oC8Ixj1
MD5:	2BB2B1C24EC0AC8D1054E317090C9F4F
SHA1:	C587181D40B99D0525D048F2EB0535DC0F041C37
SHA-256:	25AA319E525E8F50E0F687DB297C8A71061816B3DF64D469B9A8D19291770BDB
SHA-512:	30BF0C64B80D82F9CFC30FBBDFDAD3FE56CD581EE50D48D3B87E8FAB5570AE5FFD295AF7DA798844464EE3BC0726BE582B8CACBEDB40D6DC4A0E05D9D0D1EB36
Malicious:	false
Preview:	...............................T......................@...........`.......@...h............... .......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......0...................................................................................................P...........................................................................\...................................(.......................................................................x............................................................................... ...........................................x...................................................p...................................................................................................................L...........................................................................................................(...........................................x.......................................................................................................X.......................

C:\Windows\INF\msdv.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x7378 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	46044
Entropy (8bit):	4.057185861275702
Encrypted:	false
SSDEEP:	384:PO6x1IkA5vE/y2KKWKpG16RBM29W6vbi4bX/3:PO6bIdiq2KKWKY16RSGv5f
MD5:	BDC8D983CD5DC299F7078ED4A0129F70
SHA1:	9BA4EC9D417B24E41093A304BFE8B6F784347864
SHA-256:	43BCD16141D3AA154136E3F4012F3DD9665839DA50AA8E5E23EA26B7BDB3F43F
SHA-512:	71A072A5EDD760233884BF0401F9D6F0AF7F0282D87F0B13DDC1BD7C2F99AD27180EEC1FA717AF5906126E94389392917786A86523262A5A5A69D1EDB131832D
Malicious:	false
Preview:	....................xs.........HR...........r..E...pt..d....y................h......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......p;...\..................`W...0......l...............<.......0...8........7..............LG.........../...?......<C..@'...........<.......................c...P.. D.......1..@9...=...<...Q.......7..d...8.......\.......8H...L...................i......._...........b..(...................\|U...F......dd..l................7...............Z..4d.......r...=... ...A......./...2...M..........pf...4..x4...k.......,...........k...i...$.. \...@.......4...........I...........9..............0..../......._..@n..dr..La.......W...2.......... e..\|f...Q...g.......*...............R..TH..............0L..To......80..`k...i..h...lk.. A...l...a...p...........4.......D...........:...............9...;...................a.......-...........&......D)...k...q...p......d....b..<B...........6...U..<>...n...J......8Z......4... j.......2...1.......`...1..H[..h....T..............

C:\Windows\INF\mstape.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x49e8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	28804
Entropy (8bit):	3.9789891066320644
Encrypted:	false
SSDEEP:	384:LNvkfugK1SN+yTIlzkAGSQ3LfWT5UnnrcB0D1ACOQKWows/Kgi0nYw:6fugK1SN+rzkAGSQ7fWT5UnrcB0DyC7E
MD5:	D6080426AA3953FFE7CE9F21591C1FBF
SHA1:	E2BBEA256BB1E518BCD216B38563BFBAB3DC2620
SHA-256:	63909AC8564C93E2DCC7125D868980B2B33794AFD97E0EC0418D61A5898DDA55
SHA-512:	A5A50DE34B9A2ACCAD7022E85A3581AAD6A1C9BE4E94CA72286604DA6EC2348B8CD71FDADC69C84EB2B9BC3165D31F587DF3A4DC6AAF1AD3423AFD5D659C0E17
Malicious:	false
Preview:	.....................I.........HR..........TI..-....J......hN..T....W..`... d..h................p......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......d)..h,...2..p................/...1......................................H%...............".......)..\4..........x:..0!..............,...................................!.......5...+...3......X%......8.......\...............0...........@...>......................................\|..............p........%..............D...........................................0........0...........<..l:...#...@...6...>..........$@..T>...%......09..8A..........\...X.......P5...'..`;......T.......d........6...B...................".......... ,..<........7......................................@...>...C.../...>...?..x>...>...?......DA..dF...E...........>...5.......................8.......&...)...............$..................................0@...F...E...=...........................2...>...B..................`....>.......!... ........... ..........4...........\...

C:\Windows\INF\msux64w10.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4900 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	35804
Entropy (8bit):	3.9683644750258775
Encrypted:	false
SSDEEP:	768:hJVahWCM3AF09vnLNAxFt/4yxtREtURMyo74EruMp73GMZ1yM7PZMFXqkDlqQ3tz:h9AF09vnsREr74EruMp73GMZ1yMahqkr
MD5:	09D670ABFAE247784372E78D10A036E8
SHA1:	F9713604F0A80714AA515CBD182309FF33BC4BCF
SHA-256:	D331E3D057FE7A367B9CAC8EC9F9EBB31F91CB31AD3E045FB40CCCFE26116BDA
SHA-512:	15BF7BF334DEC9A0A48866646BB2147EEC890DD12CD525B33AD9B646A2C04B359ED08A73C048213C18D33DD8E580A50CA69B0E262E171191696ECF1789566FE9
Malicious:	false
Preview:	.....................I...........b.........lH..(....I.. ....M.......].......t..h......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........-...................1....... ...;......`2......\3.......5..............(@..........................X....$.......................(.......,.......E......48..40...8.......!..........@F...........'...+...(.../..\-.......'...G...........)......t9...........B......\=......l+.......&...8..P0..........................................d-...............A..........T...............tG...................G...A.......A..$'......P........$.....................................................,...h...............X....................<......................t...................................................................X.......d(..P..PC..................<)..p....>.......>..`...(?..........d....................F..(........"....... ...............C...........E.......'.......1..............4A..h?...........>...:..,...0H...G......h...T...........@?..x>...+......

C:\Windows\INF\multiprt.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xdb0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4412
Entropy (8bit):	2.8613794088268314
Encrypted:	false
SSDEEP:	48:HvVcWli5R5u5fCjq2oBcdd8oDbqxbUBPqknib:HtNYf1jq2eckOqtGqkg
MD5:	A4DE2DD3D533996A6C66B40183C40A2A
SHA1:	9052C191AC900CF44E76C3D467D2D420F5BC50F6
SHA-256:	7BADDE6A9B91208973EE540CF2AFAA583C90FFCCF891595CD0AE5FAAC7E9048C
SHA-512:	C3122494509275378B910762E7A574F846E63D1E305482AE6D8EBCEB8AD332F61BC62E94FD0BFE0A6D4B6220460D071FA89E4C26601F2DC50E1FF0E74F5818BC
Malicious:	false
Preview:	.........................#b....T.......... ...........d...(...................h...............8.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......4...............................................................................................................................,.......................................................................................................................................................................................d...........................................................................................................................................................................,...............................................................................................................................................................................................................................................................................................................................<...................................................

C:\Windows\INF\mvumis.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2348 "signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	13148
Entropy (8bit):	3.7539024223284176
Encrypted:	false
SSDEEP:	384:41OCGWpx6kXz3HEpgJaqNnxola/k+lanZrZQOlELDK0sSw47vk4L2:4ACGWr6kXz3HEpgJaqxxola/k+lanZrv
MD5:	C288051A1C89EC8D5B0CC7F0470F2BC4
SHA1:	A6EC0314DC146FEB925E43D6B31B7E13F0E8BD07
SHA-256:	DD5F4F21A35B890F3EB4C337A62F2CFC5D9500E6248AC9E966732AA906E87603
SHA-512:	4AAA353B2B824AD9AB35F1F8F3FC80FD3E9CC7E9C186AF6ADDAB6409EB10B9ED76805DD97CA00118F101B8F4889321F05B2FBD4FC2C0171840AF81644688F017
Malicious:	false
Preview:	....................H#..M%......R..........."......X$......(&......(*..........h...............X3......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......$...................................................L!..............................................T...........................................(!..............................X...............t............"..0....!......h!..........T"......h...........................\|...........................................................L...................................$.......L...............................................t...(...................4...............................................\|...........................................................................\|...................................."......d...........................................................P.......l.......................@ ......................................................................................................................................................

C:\Windows\INF\mwlu97w8x64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2a98 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	18340
Entropy (8bit):	3.8309978043408313
Encrypted:	false
SSDEEP:	384:Y/NRU2ys2JOJBhw+cn4XbYgRRbePLChc4GlWVNDNx7bRVmZMT:aXU2ys2JQ3w+c4XbVbejChczA7bRVmZQ
MD5:	BF4C83EF5DEC6E2C880884CFEF6A9F9C
SHA1:	CFFB2298888F3FF741FF77B979A4DECC6A160214
SHA-256:	A1B454951A038F4114591FDF7B5922A157D821F704321D3B91FBF45BFE36602F
SHA-512:	0B5B0C1285101727AB5CC44D151217D1E1ACAA9702ED952E44216C0149759BCEF2A63A018D0C20409A628A3E6771C3D1EB46726F450802806220A434C59DCF40
Malicious:	false
Preview:	.......................M%......R..................+.......-.......4..x...(>..h................G......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................0...........h#...................%..............................................................@......................., ..................................t...8....... ........... ....!..x(......l ...............(... ........... ...#......................$%...........#......................................................................t........(..p"..............d... "......($...(..................H....%......,...L'..........................................,"......`.......4...........................................................t$...........................&...............................$..........."...........#..................................H...................L........................$..........................P.......................................................d)...)...........!...!......................

C:\Windows\INF\ndiscap.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1130 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5868
Entropy (8bit):	3.209011750682111
Encrypted:	false
SSDEEP:	96:Ax7i0tAF6yTiD3AL9G4TBN7V9Xd8/Nv6I2C9Nn:AsK3wJG4TBN7k12C9l
MD5:	ACE6791D4D507FDB0A9228CCEC4A1538
SHA1:	C89216218F01D6F0E61B6910A7DCAAD640E1A91C
SHA-256:	E9084A68A8AACD76EE5997A5A3378C34C5FEB82FCC1E0B506B33EF8B107FA0E4
SHA-512:	743090C314378EDCFF6EB1340B26F986FA32A7291A24C1244553D38401AE5AB2244B32218D724498BCBD1933469FE5F1985797CE88A4C912917FA237A6D06BB8
Malicious:	false
Preview:	....................0....+....yl..................8........... .......\|...h...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......h...........<.......................................................................................4...................................................................................................\...............................................D...d.......................H...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H.......................................................................

C:\Windows\INF\ndisimplatform.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1088 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5444
Entropy (8bit):	3.1608028216813486
Encrypted:	false
SSDEEP:	48:p98froxcQeL+eqr8+I7D1E5fvjacVHSiCtH7bI+iXM7xgEC/TPoOCQd:P8froveq4+IYjn19M/MXWNuQOl
MD5:	C36C67E566448DF46F4674102A2AB5CF
SHA1:	4428849C3BE4DC70CD46D80C34E9341727AF3A04
SHA-256:	082F3AC8C3A2AB6ABD060366670E80D4DF29F6D93A58B2271273DA9127DD0014
SHA-512:	2AABB6DD73F5C807813E874BB8DD09E65F85478C51BCAA363B3DB442FE78274A8C44B74AE8E17B9B6E0C8E77494050FA68CC0EA255784318726F4663825B0355
Malicious:	false
Preview:	....................................................................... ... ...h...............@.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................................d...........................\...........................................................................................t...........................................................................................................................\|...............................................,...........................................................p.......(...........................................................................................................................h...........................@...h...........................................................................................................................................................................................................................................................................

C:\Windows\INF\ndisimplatformmp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x32f8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	21852
Entropy (8bit):	3.875781364417888
Encrypted:	false
SSDEEP:	384:9DsqZP1B1keUNVsz4/oJCoSrCK4AKZiKXcKeKjhKYKL/PK7K9jKbboxYB15a0Lmf:9DsqZP1B1b+oJtS+9Apycf6hVc/PW4jj
MD5:	3A5459FD53B17F82888471FFBF4F8580
SHA1:	25246E37401E71D3AF850AF9CD4C4E7CD0DD9A09
SHA-256:	4175A10206936AFE32B5A4D705ED28D758EF55B98CE4745F6DAD960EAF1D3C33
SHA-512:	9C644BD7C875B709ACB0DEBF7BBB4EF4C71EC165E909DB1F9CED86B5F6CCDCB0B42F29C3140426D16E1CDED56D950D468595A901D5313E268931513F87C75419
Malicious:	false
Preview:	........(T...........2...........b.........h2.......3.......4..L....=.......H..h...............XU......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......4"......(..................................................d..........................\*..........\...............................................d...H'.......'..........0........................"...#..4#.......$...................'......D(..........,!...............!......l........(..................................`....................................'.......(..............................t"......h........................................-......................\)...!...............................................)..................................h........................................ ..........t...L........... ...0/......D............................................1.............................. 1......................T-..T0...................................................#.......................-......0...................t.......d...

C:\Windows\INF\ndisuio.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xf08 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5244
Entropy (8bit):	3.049747200805533
Encrypted:	false
SSDEEP:	48:UrTojcel8aqJHuuM5/0Ij/uUFSN7mhurNC+sAFq7KpDl:UrsJPqJOudIj/bFSF2urNCcFX
MD5:	B91A2A2295EBF26AE81CE8BAFA9CABE0
SHA1:	EE3914D2C34C7449644334B59E52944A4705DBE5
SHA-256:	6F85F5135717F834831B20E96EB036E3198F614DC29CED4B409F15F60B79567A
SHA-512:	AC3D4B1E8A5B4F13FCD02D4C4AA6B3C6FE6F58319122731EF5793A7653BEE8F362A240C1C7EB84965668CC8473756203366CD907655ADA79E27F51FEB1E61D43
Malicious:	false
Preview:	.............................../.g.........x...........................H...0...h...............x.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......x...............................................................L...................................<...................................................................................................................................................................................................................x.......................................................................................................................,.......................................................h...................................................................................,...........................................................................................................................................................................................................................................................................................

C:\Windows\INF\net1yx64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5520 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	39012
Entropy (8bit):	4.02197949660466
Encrypted:	false
SSDEEP:	768:o9oOMM90a62gcQRBHc2PnL/VKhInYVhZFQnPNs49s6WcU9itdpyLE:mMa62gcQ75LmVhZFQnPNsnitdSE
MD5:	63348868F8FD102AE7903C0C0B5031B8
SHA1:	E02A3E1892B5D1B80A2125919E20C73F601478F9
SHA-256:	E05C65032F4D4D83EC2C9B262306D0FD985406C7F146E37C53FE55C4CB33ECFE
SHA-512:	C614694A84DEEB4243713E787142FAB2B35E90AF201A8417E15BD24AAF58216A1D8478EAF78D434CBDB1526ADD4CEC9E065467844CB81B123FA847BB82472143
Malicious:	false
Preview:	.................... U..w..................T..!....V.......X..\|...0j......H...h...............`.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........?.......K..............<&...&..........t........=..p...d>..........d$...6...............L...........%..........\9..........$....5..........(;..lS......DG.......G.......F.......M...R...........4..T9...5...8...I..H3...M...S...........G...............-...7.../......X0..X!.......2..T6..................,...\F..............8............................A...............%.......S...............:...T...................A......l'..d3......,.......HI...........6..............dD..................................x3.......:......................tI..4.......$....A..........X2...................C.......C......P.......l:..............\7...N...7...K..t........ ..."..."...#..8$..........L....2.......... I...........Q......D:..X...........X.......\|M...O......$....J.......4..........X....C...................K......dC......TT...T...................... D..............

C:\Windows\INF\net44amd.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x59d8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	45092
Entropy (8bit):	4.058178519151499
Encrypted:	false
SSDEEP:	768:IkDxqAWQkftpgZ0vLxTfvYV1tDms7Bc0jkseDiz01:FDxqAivYV1tDV8P
MD5:	3A95A5FFB3BFCF82F8C1E8DBF9614056
SHA1:	45AE42BE766D2CE4E1651B41BBBE5C2809FAF535
SHA-256:	85EDB01D70E0A693716F782E1AC0337D45970AA3A4889EEFBFF5330F4C623103
SHA-512:	FBCD0A302B1CAA9628112AE277420A1689035ECD0872286920D870FC9F234BF74D22D4C65A281C0661FFA2DE3D36730CD82FF908BDA022C66D02214554A0C1B5
Malicious:	false
Preview:	.....................Y..L.......R..........DY..3....Z.......^.......t......p...h............... .......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......$1..t1...1...2..d2...7..d..../..L6..x...$....................................T...................................................?...A...R......hJ..................PL...........;..,<..<5...5..T...4....<..T3...0..l:...>...J.................. U...........T...............O......d.......,................9......d;.......................4...................................L...U......`7...H...........P.......?...................=......................xL...........N.......V..P.......................tG.......................M...................O......4A......X................R.......Q...F.......G.......................E..L........W..............................h...................<7.......................H...N...............................W...................>...................................................V..4V......P....D..........................

C:\Windows\INF\net7400-x64-n650.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5bc0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	43844
Entropy (8bit):	4.001785354351323
Encrypted:	false
SSDEEP:	768:4AhvEkn0n4m6jrcbVxyLNgqj6LjNnZJJLRHxZ0H7FhICvkZmIl6:4ovXn0qrcbVxyLNgA6LjNnZJJLRHxmHl
MD5:	763DBDD7F915667DE3D7060F8D4E787E
SHA1:	3DC5676D3466AEFFDA088E4238A9FBD0270C3EE7
SHA-256:	07EB9E89BF9CBDE8EC48C1FFE6925885F9FF81BF5240C2553AABD4BF48BAED3F
SHA-512:	895D978E7B4881D4BD50B1AAF69C60852B37B13C1A70041AA9AB8E520E07E8195B43CAD801E93DFE6254805FE0A9ED07144EDFB86CBE933A8B4EA09CC789D3C0
Malicious:	false
Preview:	................x....[...........b.........,[......8]..\|....^.......s......x...h...............@.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........9.......E...........M.......M.......7...J..........0*...................S...........,...R...%..4...d&..........\|................7............... ..8K...K.......(...............'..h9..........x5...:...7......\<..d6......\>.......K...L.......L......LB...9......."...............6...G...F...........Q...;...............................................F..8!......p2...........Z.......F.......>...>...?..4?..X?.......@..x....@...6..............tD...........B..................8C..0........................)..........(.... ...,..0.......8....................B...I.......2...3..............$A..LA..tA...A..\|... =.......3..,............................!.......!..........41..`'...................+......................0<......................\Y...T...S..............$5......,...\.......\4..........................42...Z..\|Z..$....&...4...........E..............

C:\Windows\INF\net7500-x64-n650f.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x47c8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	33036
Entropy (8bit):	3.966602801439201
Encrypted:	false
SSDEEP:	768:FLvIMRhFUFz4uASUeRJfpyHwMN1vRfnOd:5vI6hFUFz4ujUeRJfpyHwW1vR0
MD5:	A582A12E38AC9EF5C63222820659AE4C
SHA1:	E3E7FC39154ADC91E2883CE92633CD3A19796454
SHA-256:	3A44FF3E616306B1A63CDC915BDA8EF777D76BE57515C98B7FAAA333CC531DD5
SHA-512:	4BD7AEA3EF5D12228E2028E122A3977B139871C168130F5D8CC3EEA4D53A226F94AA225D57388FED55FE2EC75837730138872F8433DFF9FBC6B6B41BFC9A0E71
Malicious:	false
Preview:	.....................G...........b.........4G......hI..h....J.......Y......Hm..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......T......<3..........h;..D!...+...........)........................................... .......... 2..............0................)..............p...h&..t9.......:...........?..L....D..\,.......&...+..(+..(@..@/...........+..4...89...9..\|8..X:.. ...............................'..d5..04...A......h?...........................C..................tE...3...........$... .......F.......4...+...1.......G...-..\'..........,........(...............1...............................(......................................(...X...\ ..................................87..........................................0...H%..................8&...A..\...........l.......D.......................L....................#......\|D..H..../...........................A.......@...........&...................................?..........X$...F..xF......p................1..............

C:\Windows\INF\net7800-x64-n650f.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x6198 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	46140
Entropy (8bit):	4.01534392940912
Encrypted:	false
SSDEEP:	768:rJKagWpqe3ZLkQPrjf13Mwd4Y4G63JIOnHGYXeJYEA8Il:rJKxWpjzPrjf13Bd4Y4G63JIOnHGouY
MD5:	6E91DA90F25818B4A70E03D21CCA41F0
SHA1:	3F70E998D1D16EB9FC1B964130E79B4E2FB4E703
SHA-256:	E5A56D1E5028F125D3B3FA8064765E5D464F3D29039EBF377CDFDE75B7748BFF
SHA-512:	771C26C3C867A490F58760EDD4EBDA4FE9AB1E2402BF8A220D7E0B9E96F1D33BFB0BA1696A74064FE43D30EDBE54A03921EFD21F62DDC93CE57DB0BD28D1F477
Malicious:	false
Preview:	................\|....a...........b..........a.......c..h....d......hz......P...h...............8.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........K.......L.......Y...T...1..d=...........Q...........,.............................../.......(..,....(..........t............6..H;............... .. R...R......08...........Y..@*...^...........8..$>..x;.......A...<.......K..x...tR...=.......S... ...F...<..x....$..............T9...N...L...........X...Z...................................]...........M...#..\_...4...0.......`.......M...=..\|C...C...C...C...D......,E..p...\|E...9...............I... .......F.. #..............H:..(........................+..........(....!..T/..(.......$G...................G..tP...........................E...E...F..DF..t....A..........\|5..........h[.......8...........K..8$...............)..................\|....3..........d^...3...@...........................[...................Z..........T........................Y...........4...`..X`......d)...............I..............

C:\Windows\INF\net8185.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2890 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	14428
Entropy (8bit):	3.782170672559321
Encrypted:	false
SSDEEP:	192:HOZCYRyIRNRhV/u/cQWfCle5HoECAbKVReQvSHGSGcWsx:HOZdv8EaxElbOewk
MD5:	DDD57004DA34909D4FF5DCD5263AC14A
SHA1:	E6D4EAF6568B831F397061C8D577650DF3DD09D4
SHA-256:	C7C8EEEF379DB7FBF86CAEEBB9328EC4D75E9F9B10DB8FE024A652B672BF6A0B
SHA-512:	CE03DC73D0D35D354DA3F7213E2346F4E062BB696F6593411185D98EFB9A684690A8EC97F95042B5CC7ACDB81A24B14327291AA29A9A5753D1CCD343785F9D74
Malicious:	false
Preview:	.....................(...].......{..........'.......)..T....*...............3..h...............X8......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......L%......................................................D...........................................8.......<...................$...p........ ..4&......................D'..`.......\|%........... ..P!..@"..H#......@.......t&..................l...........@ ..................l................................................'..............................H...................d'...............!...'...'..l...........X...................................................(................................................ ......................p...............................................................................@............"..,................&...........$..............\|...........................T%......."...........................".......................................................................'...&......................l...............

C:\Windows\INF\net8187bv64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3290 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	20988
Entropy (8bit):	3.8893006058168895
Encrypted:	false
SSDEEP:	384:PTZh7ZEdmHOt3kO8i429WCEMvii86fkxPNl:PTZh273kO8i5WiviiHf2Pf
MD5:	A95146D28E31A7629FD873FFD9712B35
SHA1:	3837819C091088DD9AB5E3F4730D80E3F2B144F6
SHA-256:	855530318E8FC5C8EDE335135AC88E4D5384B370C5EC3836B56A0C7AD978FA34
SHA-512:	C3ACDF2800CD2069202DA47E4113EB925D49891FAB404119CEF7AE66DE6D15DA893314948F3A38F6E3736832F6E2C7DDC8A9937A087917FC39DA1AFC84E2CC84
Malicious:	false
Preview:	.....................2...p/......{..........1.......3.......5..\|....=..,....G..h................Q......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......0.......................x...................................t...........H"..........................,.......`%...............1...$..............4+..<....................".......+..\|...............(...$..8(..8...........t+..................&...........&......................."......................................................................x.......0................0......T........,..D1..P1...0..80..T0..p0..........h!.................../...........................,.............../...................................................................................$.......0..............................................h'.../...........'......D$..................................................T*..<-..................L........,...'...................#..................................................\1...1...........-..........................

C:\Windows\INF\net8187se64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4058 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	25588
Entropy (8bit):	3.9797866111816695
Encrypted:	false
SSDEEP:	384:J0/ZjcDyCr8M9WaiXU3OmiChTeItiH7JZsexV3JZsW:K96yCr8M9WaizmigTJSIbW
MD5:	96B0B5FEF0A84A932BA34786A9CBC45B
SHA1:	718674417EFED39DDC27D18FB63B34205D32580A
SHA-256:	F3A0D9775D6E13551CC3BACDA35AAF5AE07A7B1804E82DB074B2D9DC5F7492A4
SHA-512:	FD051B0F2B5915F3C9FF9E376F60F59680F24294165628C15DA17A53D149C80A313270069CC1BC2E04107CE6640846AE8EA866AC9270D78D17F4859D91287BAB
Malicious:	false
Preview:	....................X@...p/......{..........?......PA.......B.......L......`X..h................c......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......<.......................@$...$.......................=......$....................*...........6...+...#......................X3...2......$........8.......;...........(..........89..............@...X5..<2...5..4;..P0.......8.......1.......&...4...........3......................./..................<(...'...............................................................#.......>..........l&...:...?...?...=...>.. >..<>...0......D/..........\,......p:.......'...............8...:..........D=...<.................................................. ........................................2..............P?...........%...................4...<......................,........-..............T...................l7...7......................d...........<5...................0..............P...................................(?..p?..@#..................................

C:\Windows\INF\net8192se64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x8f88 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	60932
Entropy (8bit):	4.13104024119203
Encrypted:	false
SSDEEP:	768:r0U2VezcNrGtfrZcCV/CLVPXdiN+YQ2MGnTu7M//m:oU2kINrGtrZcCV/CL9XdiNw29nO/
MD5:	3DA5518A5053B49ED12FDE96D3E9DD5B
SHA1:	2ADF34743D53F1C912F7EBF11EC334B02F883D7A
SHA-256:	03B82278C2E1592FEFDD470613008AF548AF90D0D646A7ECC60CD4752B37A980
SHA-512:	C3B888D570B3054A515674DA042FD11405F2C0515AF294AC0B628576DFD8B60BC18066E5202BF6EE484FB0AC5AF216764CD040FC7090A03C298CFEB623E4B383
Malicious:	false
Preview:	.........................p/......{............$...........P.......p...H ......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........S..hU..................<4...U.......@...$...............................s.......E..,....y...........3.......}..$....&..x'..."...v......@.......\........h..............xs.......U..."...<...@.......A...v..l....K...`...\..(o...l..Xl.......l...g...g..8...8~...d...x..Xe...f......t...........P......(.......................................<.......\|....................3...Z..\....1..DO...6...S...S..@T...\...............+.......Q...........7.......{...........".........................T...............T........................}..............................<%......Dw..........................}..........z...5..82...................y..P...`........y..........<........$.....xx......8...................\|...,$...)...)...........................A..............`u..........p...............D6......................4..................../..00...{...... B... ..

C:\Windows\INF\net8192su64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xbc10 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	74020
Entropy (8bit):	4.158253155635826
Encrypted:	false
SSDEEP:	768:FZR6/PTNHm9UzQkWxAqG0vPzYUAcd+B5kJX+g4hQkeKLxtLC+l:F3mPxG9UkkWWd0X8UAjPkJX+gsQkLp
MD5:	B98416A10885C52DDC52904902F37B8A
SHA1:	59ABE54D5AE951A9A3728F428F1EA203FC578CA3
SHA-256:	557090CAD7664C0A8F30EB774E80D339A3BB687095D035A52C19EAD0BCE2BA45
SHA-512:	B9D60C458D2B737310850CE6153756BE7FF999ADD6DCBDC27283368B23F25A0AC1C6EB61A64241570AEB36413CF30198773522A97A9DB66C7EA131B9187A80DE
Malicious:	false
Preview:	..........................\....:.}.........\|...;.......................8!......h............... !......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......x....................x...`...q.......P..@Q...........m......$...............l........................`.......8.......@...A...C..X.......\|E..4>..h?..(D...,.......g.............X...............w.. .......X...<.............................xW...............6.......U..\F..<G..h...pH.......)......x...`p......0........................................k..........Hf.........X....1.......i..$......$.......x...........T........%..............$...............R..........................H...I..\...........n..`t...............r...O...P...l..T............[......,.......Lc..........p...........................?...A..DB...........D..d=...>..lC......@-......,.......................T....q......D.......X.......\m...T.......w.......3.............$\...............E...F...Z...G...c.................<..................$....#......d...XR......p{.......N...r..

C:\Windows\INF\net819xp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5900 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	35284
Entropy (8bit):	4.043356526820034
Encrypted:	false
SSDEEP:	768:Ci6pt6PtUwghWnX+su6YDOxwa9x0bo0axrC71Tc3SX08aT1LLMrl9PbM2LLIcIFr:dmtstUwghWnX+su6YDOxwa9x0bo0axrF
MD5:	A6DFACC7FAB987C793946B585B2A8B85
SHA1:	E441D88B58D259E013E4E3B041E8719203D8ED6E
SHA-256:	5AC9E0F77A5924994E2DFEBC251CD76399D2000ADB5925F346280EDF84A0D0FA
SHA-512:	942414B6D2C8C8F7BB204783682A90CCD3FC3BAE91946A458EAF3773D71537FB5B7F0D213FAD3AA04652DE43958061E08496B6151F7BE0D6B5A3E44AFBC60161
Malicious:	false
Preview:	.....................Y...p/....:.}.........lX.......Y.......[.......i.. ....y..h......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......8O......<>.............../.../...........................B......t........G.......$......$$.......................... D..(........J..............LV..\....P...M...)......H).......V..T............... N...J..XS...P...H...F...V...O...5..l....9...4...6......hL.......<...0..........LH......................pG...............V...............&..........H........ ..P............&...W..h%...>..p,...Q...?...@..4Q..L(..lQ...Q...I.......H...........C......HW..........p............................P...O..........0................0...E..0.......................,U...............................M..........<P..p=..........P0...................R......@M..,.......LC..............`;......`:.......................B...>..lU...................................S..................pI..........0M..........,G..`+..\3...................W..hW...................*..................

C:\Windows\INF\net9500-x64-n650f.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5f48 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	41428
Entropy (8bit):	4.009801426765698
Encrypted:	false
SSDEEP:	384:6wENv/dH2op8YAUPhbXv/yArb8ImjPcVuI2rv0l5vcOjuKDOpzDUv9YWb3gjL5Wi:t4v/dH2shrv/xrbdVXN74kGSSz
MD5:	0A016C23183CC1E17A40D434AA8E7053
SHA1:	4E3209967A1A95385857845284299F644521596D
SHA-256:	A3BC3CC14A764397E296135AAAA87A4F3C9E006CBA711722C68A0E000D333EE7
SHA-512:	8B5AF5EB97FC4194A80FA4F727B76C26DB3689409D4153934D940B22CFB27E055EBCD61B14EE66D13B5E1C93B6AEAB3DD2330859A6C1D248311E042D063D6669
Malicious:	false
Preview:	....................H_...........b..........^.."....`.......c..X....t..x...X...h......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........A..H....Q.......... ^..4&..DC...........U......$>... ...............................%...........P...&...........................?..............h............:...............S..4A..$\...........K..pC..8>..DW...B...V..@....".......G..tH...H..\I.. J...J..`B.......................;.......R...........X...L..............................l...0...........\|...P........,...%..."..p^......(S...C...F.......^...D..`E..<................<...............O..............p...............$<..................................@...(...4...L%..t........T...................................E..........LT..............................0-...........8...Y..\2..(3......H....5..p ...........................I..x(..t$..8....+..h)...)...)...)......X*..HF..............tY..............HX...:..8.......h.......................tV..........H,..H^...]...................7..$P..............

C:\Windows\INF\netathr10x.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x16aa8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	190068
Entropy (8bit):	4.149964238639783
Encrypted:	false
SSDEEP:	1536:s3AyiF4FA6KIur21g0FoNfg/5kB4NHjwvtE3F2HAUTQek6:s3AyiFIA6KIur2S0Foy0OXsAU8f6
MD5:	3B045B7824A8CA5E0F24E3EDAF027D68
SHA1:	A5D5854ECC58F3F2787AD449405EC1EDC32A1113
SHA-256:	583940169C4221E3B3DC00E590D682717CAE3C971D39C693F306AEF793A9B721
SHA-512:	EB3DB5E54A8892DA10434A7780F0F5B12D48E2AF82DF807077BC4A994AB4E6F49DF5C09508BC1C3073D293FE5489453DF2988CBF0D9E38DDEA0DB8B6F9D7DD78
Malicious:	false
Preview:	.....................j...p/....:.}..........j.......k..........xW.. ...(...Hd..h...............p.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............T?......p..................0b..\|b.......7..X3...................s..4...\|... q......."..0...........H...t................t..<........t..`.......H................s......@....u..l..............(W..0X...W...:...<..t8...<..x=...#..T,......T.......p.......`....S...`..$p..._...s..P........O..H........c..P...8................#...V......hv......tX..<a..(.......h........i...z..0........~.............. .......8....7..l...L...HV...Y..0....F..$\..\|\...\..0....]...]..4^...^..PR..P!...L......................(...\|K..................................p...............(................................M..h[..pf..H.......pm..H...P....O..........x............]..........(....I..............\|[.......U......l...4.......d........$..X....a..x=...........................a......P...\G...G...H..........<....X...Y..`Y..$0..<F...E..........P.. ......................

C:\Windows\INF\netathrx.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2e6e8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	379012
Entropy (8bit):	4.459056964173866
Encrypted:	false
SSDEEP:	3072:f1bVN1v6QOi+L4pBAC9WXWIw9KxPv0p58IbBH3SffasnX2vzkW0zn:lxbPzIwU3W+AH3Sm0zn
MD5:	AFDC36F4EBCEDEE03CB72E3217244126
SHA1:	B19BBCB59F7789361EF774D1CBA41E8B04F09C76
SHA-256:	D7E485843917CCCAB98DAE8ECC302973A5F77AE307EC6D230CD0421B42902489
SHA-512:	6A32112B66372C2BAA8CE01964704DB205E469C1B130140584ECD49AC86E7A942B8EC941290A5947AD9331AD461401CD138BF005C6E0EC6016AE51E8F6D31E14
Malicious:	false
Preview:	..........................8................d............7..............@...@...h.......................C.:.\.W.i.n.d.o.w.s.....4....n..\|...........;..@........0.......j..............t....f...{...$............... ...[..............0..t......x...`.......=..........$...\|...d.... .. ...xI...q..\|....p... ..d...(O..H........r......h....e..d7..p8..........................th..\...Dj...d..,Y...f..Tq.......'......hH...........,..........H.......t'..h...,.......4.......$...p.......T........p...5...0.............. ..................................D...t...............$.......(....,...o.......T........4p...x...2..pD......@...4.......@...`...x...................1..X...0...............4&..T....>..\|...0................/..0........4..,.......\|........(..........L....v..............U..D...........8...T~......h...x....9...&..hK..h...t...8...x..........h?...$...A..........\|....b.......Q.......Y..l;..L.......3......\|...(.......\...............\|r...A...O.......(...................:..4%..d.......

C:\Windows\INF\netax88179_178a.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4470 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	32148
Entropy (8bit):	3.922078649025287
Encrypted:	false
SSDEEP:	768:e1a0Mq/fVdpGsaTxw2ChOup0f1auNAsyMiQv70KCt:e1a0Mq/fVdpGsaTxw2ChOup0f1auNAs0
MD5:	2F21A6261C83A902C3127E82DF2A17B3
SHA1:	54479641687462EA1D6E42D874399499DE286959
SHA-256:	7C20778EF6C8E6D0742344A2838FDA8A70EC692F53E83E38C911B2A522F17472
SHA-512:	96CC60780E73CFB1B1F6720533CB131C165FB3775D87EC201CFEB3F6F8C41A5A8124EB75B10F9BBA2F8DC56DAE81C866C75A947C28F0EEBF189473CBFD3177DE
Malicious:	false
Preview:	....................pD...........b..........C......hE..\|....F.......U.......i..h................}......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........+......4............-.......-..................@:...............?..............................................`"...2..........P...2...........@...8..............................t...............0......<1..<,..h3..X)...3......89.......<...>..4/..(0..D>...............,..H...x(.......1...................................2..................................................,C...............=...........2...)...<...............(......H .......9...............:...........5..D,...........7... ...#..............................4................&..............................................`#..............................x;.......>..................(............:..............................l'...........A..................................0?......(....@......D)..x...............................D0...........*...C..PC...>..................l4.......$......

C:\Windows\INF\netax88772.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4358 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	32284
Entropy (8bit):	3.9506674746243586
Encrypted:	false
SSDEEP:	768:Ht2VQILT3MxShGiEQSxA7HP28aC8Arpzx1yjNAN2MNdu:Ht2VQILT3MxShGiEQSxA7HP28aC8Arpy
MD5:	F5390F36403ED0C449C191651AA2C337
SHA1:	5CF356C4047B07ABF41F2AC053A236A92FBE1CBE
SHA-256:	B7446C265BA7D0CEDBB21343EC8419AEF96C0747F0000F921DCD159CEF737DFF
SHA-512:	5AE07CCC3ABABB8782812A9CB0BD0FE81608253AAC6B9521309C19F93247C7BCFE096CC9972670D8E86A4BCAFA155499E814D2C5912778EB0AFB73D3C1477837
Malicious:	false
Preview:	....................XC...........b..........B......PD......HF......(U..x....i..h................~......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........)...................-..d....-...................8...................................*.......................).......:...........(..............p?...9......8+.. .......@...<...................T'..T+..<(...0...+...3...'...;..............43...=..........<=..............<,..<...4&...;...0......\+..............................................H...........,.......h<...........B...............3......t,...;...'...3..............<%...<..........88..............X9..........04...%...5......................................................H?..................................................L........................)...................=..............................(9......$....................>...............?..................................(>...........?......\|)..........................................l/......\|B..(B...=..\....2...........1..............

C:\Windows\INF\netbc63a.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xc618 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	93836
Entropy (8bit):	4.154185257768812
Encrypted:	false
SSDEEP:	1536:pv0vR9v/38OvdeH/izD81iXYs3CGEuXxrhrZXXXmXXBFXXXtzXXXXXXX+aUZ6:pCP/38OvYH/3S3CGvXXXmXXBFXXXtzXR
MD5:	A4C1DDFE3BB6E9947C274C665B520FC1
SHA1:	459754153A9834F7ED5723D38AC0F2C724E46546
SHA-256:	F35C29992C3AF0414EA43D1CC57C6D34D580B625F768979E2EFAFB046A208775
SHA-512:	B8B78D647E314834D63CF9D2853A5B7E5DF84B20E38746BD60BB6D3049CE7D7E2450A6748C39C3A05044522CEF304CA1F63F7A12C5A571DC8A27DC5EF57FBD35
Malicious:	false
Preview:	........................V8;....................J...............,+......<;..H3..h................n......C.:.\.W.i.n.d.o.w.s.....p... D...C...C..HC..x....H...C..4...ln..T&..p...........xX...........F...F......h...TG......T....G..(F.......G...0.............h...........T...<.......K.......\..........@...hD.........l...4....E......(...<....4...O...P...............h....6......4...<........_..0c...........0...............1..d0.................................. J......H(..........h...............\...................F..t....P..8Q......P...(...<...t...ld...G.........$....k..L7..h.......7...7.......7...&...8...c..........X...0....0...I.......(..`8...8.../..\9......X...........L............=..\|?...'..p...............:..t:...$......D....z...... A..L...,...(0...........(...............R..4...lg..........<..........t...X.......dV..............,...t.......<F...........................J...#..........p....p..............@7..X7..p7..p........7..84....................n..8...x.......(....2..

C:\Windows\INF\netbc64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x6e50 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	62220
Entropy (8bit):	3.987509372920844
Encrypted:	false
SSDEEP:	1536:FbY9LqrcCPYfrIHPtY4LLPLjPRQdpFzyaUz01NFKReYb2W8qoOYaBsMreBOufZf1:m1qrTPYfrI1PRQdpFz+01NFKR5foOYaw
MD5:	C765FCE767AD652F3433E73BDE467A66
SHA1:	B3BADF06434E528B4D2BD2953C2AA649A02971E0
SHA-256:	3B40AEADD638C05BD070D3A4DB6DA4C22B7D3BC45E1099C152A2A9A80D01D0C3
SHA-512:	B1D5362563340987DD5B3D4CDB25F7A371167F1E522F49AD7A303232057F23969097B73A0D5DD27712E5F3070D58F91281135F22EEEC8AB914FE3BFC1E09CC0E
Malicious:	false
Preview:	....................Pn..V8;....:.}..........m..8...Ho..`....s...!..8....... ...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......XF...........$..`........(..$C..........$........l..d=.......i.......B..@/..<P.......g...8...j.......(...........#...............1...$...2..`M...;..........t9.......h.../..lk...H..49......@j...;..P>...Q...Q...Q..8...p........B..L0...G......xK..P...0m...:...a...L..........d...x0...#...1.......F..................`T..x........a...a..D5.. ...7..."......\|P...b...)...7..4N..XA...Q...........U...A...A.......O..@X...W.../..8b.......X...P..LQ...e..Db..........dB...F...f......T3...T... ..,U......dU..<2...U...7...2...L...R...#...............U...B..h2...W...2..LX...6...H...^...8..@"...3..l]..LY...X..`8...+......0B...R.. Z...^.. ,...=...d......(H...j...#..HZ.......................].......1......X#......@_..<<..DE..........4Q......xO.......a..4>..D........<......./..............H...G...i..L....................f.......A...........M...M..8...tQ..............

C:\Windows\INF\netbrdg.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1058 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	5500
Entropy (8bit):	3.07575376752822
Encrypted:	false
SSDEEP:	48:4r29FiM/EES6XE1X5fzi8HztkMBbkocEUqvq7oaQQe:4r923S6XE1A8Tt2Dqv1x
MD5:	042511CBD4696DA08BE2D55377A7E59D
SHA1:	7B12D6A90BAF3E90EC72BC3D0CCBDC8AEA1A6A96
SHA-256:	C796FF9567CA9A8738780873661E8A130C2E67899AB5880A489978A491A773F4
SHA-512:	452308522DDE40F25F2036DC11BA864DE59614F37E7E29B3DDF5CF7962659D31FB304301BEF5F1C957C751A33A6E9F4FB594939AA7B9EC71086F7C41571773F5
Malicious:	false
Preview:	....................X....-.........................`...x...............P...(...h...............x.......C.:.\.W.i.n.d.o.w.s.....@...............................x...............................................................................................................................................\|...............................................................\|.......,...L....................... ...............................................................................................................................................................................\.......................................................................................................................................................................................................................................................................................................\...........................................................................................................................

C:\Windows\INF\netbxnda.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x27528 "signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	403700
Entropy (8bit):	4.3154075171507245
Encrypted:	false
SSDEEP:	3072:V+yiPVFEsNr611rOjp9uFAgZ8tqqCST+4yPreeWIXXWBZdLyaO4f6tP:VR7AgZ8xT+/LP
MD5:	44D5B9C02F9B2B5310CF38F1D007789E
SHA1:	B94E97B0F2AF3D37BC3304EC99ABE9A0DCA50362
SHA-256:	D1F83711A7BBB4A58FEE7F3B63672578FC451178A39E6A40117B6D07DB1D3E8A
SHA-512:	7922A528C99EFD48033CBE4C71945F0F32125CCC14B134BA73B2E653157C78AD2D231A3AF4B3450843DCADD7EB1C56517876BCB909A3F9FD59B620B917AD7744
Malicious:	false
Preview:	....................(u........yl...........t......8v..@8..x.......0{...V......h................(......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........*..,....... ...,...D...H...4/..D0......,.......\|o..lT..._..L`..`4...p..........hn.......h.......p..t............f...)......l...$y..Xr..........xS..,l...s..p....e..\"...\|..@[...z......@...<...........8....a.../..P....I..`...........hs..._..Hf...q...v...Q..x...L.......L.......H........b.......................4..8m.. ...X............................A..............X>..(@..H........\|.............\|...........t...8...l...................h...D....l..te...d..lj..`g......h..TY..$)......./.. ....j...............b...b...Z..8....v...!...................F...K..8c...l...Q...D...C..8....M.......3...2..(....4..t... .......................P....c...r..D........f.........,d...\.....@b...m...3......4.......0v...Q..h......................t>...o...O...F...]...m...%...x......T`..\|........s.......+...k..\|&.......~......<t...s..`m..<..........P`..hX.........4...

C:\Windows\INF\nete1e3e.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x9120 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	66444
Entropy (8bit):	4.078211221061942
Encrypted:	false
SSDEEP:	1536:NHgyfAJLdoice/hPaTnTOEXbHzACuWRZBzYQoH4rWb9yPeQWARKKq:BgyfAJJoice/hPaTnTOEXbHzfBxKKq
MD5:	1F593ABD2F15EA882DFEB52A02F56F87
SHA1:	38CB7FA5DC2421E52C1F93E2E58B73717A998846
SHA-256:	B709225F83B9721A8A23B7EAA8E1177D6BD656A91F29882549396F06BE46FDA4
SHA-512:	C7435F2C2822CD449477765A7ADA3C2B8479BEF3B0CA7C865D5C0C7CF6701D9B3E8890991BE133C9888B614FD1357D9AB9125703F06236B4137B92926BC55E71
Malicious:	false
Preview:	........x........... ............b.............L...............l...x....&......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........C.......K...............7...7...................=..P...DA.......c.......n...J..LI......X.......\|....6..........Dv......Dq..\....n.. ........x......... ................8..........p....`.......k..<v..D_..._..._..4`.......... .......l.......$g..tg...^...t...]....... ..\|r.......q.......q...$......d)....... ......T.......................D.......<....~..<............6.......................w..l...\|...........hM..h~......L8...l...r...(...s..`........1..HX...2..P3...,...-..01......l.......@#..p%...&...5.../...(...w.......................................~.......M..............8...........................[..Tw..Dt...t......`s..........H...T....4......H.......p0...q...............n..........P...........H....O..,w...M......,N.............. ................d...m..D....f......t........;...A.. D..0j...]..L.......D.......tq..@....q..................X.......

C:\Windows\INF\nete1g3e.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xab88 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	79100
Entropy (8bit):	4.135295167122562
Encrypted:	false
SSDEEP:	1536:tKiyp3KyUN5cKnpIOcaNx417fNvf0ueFcaBOOIPmN:xyp3vUN5cKnptcaT417fNvf0ueFckIP+
MD5:	7335F647DDBE6C0FB6ADEB4AEFC76F32
SHA1:	0F4350FD288052AFD300F03F929E100A488E1A52
SHA-256:	5F6E146B0EB146C926C074165F00889188C53BD8B13A7FDE2A65671CCB2DCBD3
SHA-512:	854EA65C440B77E35530161A99DC6F8686883255483D4E055E5043BE0EDC8EB04E5F6E39BD4950161F03AC113B7FA17B35347DFB911AF6B8B647F73A05447401
Malicious:	false
Preview:	........................L.......R..............T................%..............h................4......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......\|...DQ...............q..TD...D...K......$...............`...............$...............pF...........D..<...................\............H..`..........................t................;.................(........(.......'...).............`...X+...0...........'..T)..........T......... 1...0..x1.......1..(2...;..<<...2.......#.......7......T....................C......4.......................T.......4..............0.......p5..........S......T........ ...........3..x.......P....G.......4.......M..dk...8...9...9......x...(...........t:..$...........Ph...............l..P... n......X...........p...t~...........}......p.......\...H...l...................$e..TB...?..T?.......Y...B..\@...A...<...<...v...y...z.......~..@%..t....... ...0...........,...............l...h...,...<..................................X.......$F......D.......................

C:\Windows\INF\netefe3e.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xd820 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	91644
Entropy (8bit):	4.195301301853285
Encrypted:	false
SSDEEP:	1536:S8j4MoNjMWen1qYJQmbjHMKeXYxhhcXGIJ3F+chnAW:S8kMoNjMgZmbjHMKeXjvZF+cF
MD5:	7E84E7DB9F2C9BEDA6443D4854530409
SHA1:	0862B4BD272E518C46803E0332DF25DD88922DBE
SHA-256:	5E5F2AF6939264088D72AAEC152A9FDA345E5D169E4B3EF2227F5DF720C91362
SHA-512:	71E14788A769FF6219E3E12F0A03319A1BDEF5412DD354DBC1D455B9E3CDE400224486326E61A9AD78AEF90AFCB21B62A02E5A3EB45A6F7FD9BF14654A515956
Malicious:	false
Preview:	.................... ............b.............U................%...... 0...5..h................e......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......,...lL..........4........E...............S.......D...........a..................L...........XS......\|E.. k......\|d..........\...D...T.......d................G....... ...I..........................t...p....B..........P...P....n..........\|8......."......,....o.......H..........<...............d!......................Q..................0W..0...............h....:..LE......X...0....H......d.......................T........F..,...$Z...........[..................@R......8...................0...1...1..h2.. 3...3..4`...4..$5..........h...........Hi..............t...........d.......,........X..................(...........(....e..................8....C.........x............z.......5...6...}...}..4...d..........L....Y..87......dn......<...T............7......D%..<....................+.............. ...4...P.......\|........I...K...`.......J...H..p?......

C:\Windows\INF\netelx.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5dfe0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	484876
Entropy (8bit):	4.259888599610386
Encrypted:	false
SSDEEP:	3072:0ri/ElhB8T/sKAlEhucVLoipXcRn+bskUcSpbVs0ssqi9s2p/X4pf/Oo7rLqimPq:0gYe0/sjuUnIP7lmZFxF
MD5:	3989CB9E8D6FDF16F628ED701E995F6F
SHA1:	1C2EBB6C3C15DB9C284758529D535920D51A0B47
SHA-256:	4FCA0E285F8DC7CAADC84BFF5C895846C56C2E49E2188CBA01B2D031F51797DE
SHA-512:	290B10B8D8CD4A4A750B8282AE1C4AC4E311FE7C12907958839F4F674B770C99B23F6E6FDBB7621BCF48EE747F07E37E577EC474952BB5A01FD3EA248E69466F
Malicious:	false
Preview:	.........................+....yl..........P...=...............Xq...V..........h................f......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........t........1......2.........`V..............j...........Z.......5...6.. [...q...c...d...f..,g..pB...D..to...p..@?...@......\|....b..pT...U...V...-...u.......v...7...}...q..,x...l...E...... u..\...8........m...\|...z...~......,........y..H.......<Q..l]...>.....L.......<^...Z..l...H.......\|...$f..Pn..h...x....(.../...`......`...$K..,.......\|s...........o...r..4n.............H...0.......<....W..................Xn.......o.....@....I.......[...................X...~......l....f..,....g..TG...h......03.......:..Ds...t..\L..0E...O..8}...8...$.......t................h...$r.............\|....Z.....0a.......~..0...4q..d~..........\|=......`z......<...(...Lb......Hy...c..(\|...c..h...d........J......,.......d....M..............x...XP...........r...s..hs...s...t..dt...t...u..`u...u...7.......8..h...\|...........l.......Hg...... .......$...............

C:\Windows\INF\netg664.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4988 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	34140
Entropy (8bit):	3.9615628397148166
Encrypted:	false
SSDEEP:	768:wb8I2P1PaNXfVkOtteURMNimwfne6ApwHuUeK/5PeIbG000WCCCG:wLfVkOttoimwfne3Uen000K
MD5:	60ED311C32F1240540E38A51093E994F
SHA1:	F1E959956347BCD40541D2C44473761884C44413
SHA-256:	70CAC4089E5FCD3DD3503F052923D5E362B146F58057EB8EF8831BACA72F9B77
SHA-512:	3CD02DC02814A8C067D62413F5BE3C09CA8ACC6933F7FF1C514D55F3FEDB908619130026BA322AD5550ACA7745E8A6AC01EE3D6EF5A70F6A7A6C5F3D13CAADEC
Malicious:	false
Preview:	.....................I..L.......R...........H.. ....J.......M..`...x\..p....p..h...............X.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......p,...!...........%..$'..P............B..L3......................................................................................./......x3.......E...4... ..H6...........!...........F..H........... .../...3...3..p-......<A.......!...3......PC..........$C...............8.......-......................\............................3..................D...D/...>..............hH...............9...H...8......8/...........:.......-...........................................................C.......................... 9...!..,3....... ..........`...........80.. 1..t1...1......D.......................X?...........@..........`:.......C..........................`$..."..........`...(...`....................:..lF..................................8D.......0..0F.......=.......,..4....;..............@.......DA..........$H...G......P...............l=......$.......

C:\Windows\INF\netimm.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1028 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5548
Entropy (8bit):	3.1235724286898052
Encrypted:	false
SSDEEP:	48:Q+mlXqXoNn0OYNfhHU5S4YayBFpjkejTKCAf22DwIa7T7+qDHEUBQr:Q+mYXotgNf+CTpziCpu2M
MD5:	751041CA005306D938BBC96E3F8D1DE4
SHA1:	5FA35169E3B3F4FD96DD8CD6AEE8CB44C96DFABD
SHA-256:	62EC697D4DFB84671BC0E717EDE7FC328E817F297170B6E5F30FB42F3239BB64
SHA-512:	A5B3AAB31C69B6F7A710062D989EBD12EE8852FF875C7E974A08583C23ADB109215D613B93F9C1947F2459888251773BA1B976361EDD05080E1570F743AECDE4
Malicious:	false
Preview:	....................(...L.......R.................. ...........,.......H...`...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................H.......................................................................x...x...........................$...................................8.......................T...........................................................................................................................................................................H.......................................................................................................................................................P.......................................................................................................................................................P...................................................................................................................................................................t...D...................

C:\Windows\INF\netip6.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1718 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	7916
Entropy (8bit):	3.4523872518420826
Encrypted:	false
SSDEEP:	96:RhkfVN1wizHnC8/VynEhzwO3Dj5041e2ZoO6SJhPXKh2ZZ/M98Y6BGBx:y1HC8Pt5z9ek6ChP6hwZ0z
MD5:	E7853C9CC8DA79CFD26084BF7049545F
SHA1:	267DE91D04B8F293D9BB88DF396F5891EFD81342
SHA-256:	5407EF396DA6F5F1FED4578B844BA08799C049C75BD80F47847F54B46D6BFB6A
SHA-512:	2B4583263801C28D2CEE528B220434ADE6E4DBBF42D65BAA1B57C309D3FC7D2800589FEA66F6D1FAF631169F7AAD5760924596656EC3D2171F1B4973AFE73290
Malicious:	false
Preview:	.........................b.................................0...................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......`.......................................................................P...........................D...........@...............................................................................4...........................................................\|...................................................................h.......$...........................<...................................................\|...........................................................................................................................d.......................................................,...................................l...........................................................................................................................................................T...........................................................................

C:\Windows\INF\netirda.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x25e8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	13876
Entropy (8bit):	3.7385868589119076
Encrypted:	false
SSDEEP:	192:yd2PNeAIQzSMVtbQ6qhEOhNNsTFETyUN68sXM4h:txHzSMV23hEOhvsTFETy26J84h
MD5:	82E4283A38D65EF737EC058C308BA0AA
SHA1:	7AA306189C14948A49D26282DBF80B50BFE2C186
SHA-256:	5DBD6D7FFF3871CAB6C693EEE5DC5213A29CE338487A6C1AE2D4C37B5864419D
SHA-512:	1B0F8AAC108D484405434639E372168424BAC4ADBE5E5AB7D37E16D63399087EE237DFF41F039F7C393E42BB6F7A398ECD9DD288193E155ED425B1EF01BE64AB
Malicious:	false
Preview:	.....................%...5Z....:.}.........X%.......&..T...@(.......+..0....1..h...............06......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........................................................................................................................................................ ...........................!......h...........\.......$...L...X...........0 ..................P........... ...............................................................................................................t...........................................4...............................t...........P...........................................@...............................................................................................................................................................................................................d ............... ......................................................p...............@...................X...........................................

C:\Windows\INF\netjme.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x47c0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	33700
Entropy (8bit):	3.9454299715565364
Encrypted:	false
SSDEEP:	768:sDFDM4Hu9AHfAaf2Je0AURM/gQC2TwDaL0G1aPgW0Mjhcto:sJS9AHfAaf2JevgQC2TwDaL0G1aPgW0k
MD5:	D660EE2D3CCAA9F7FB82B0BE3472D524
SHA1:	C4CC3597FAE828761D0ED8033BF1EAB3A825966E
SHA-256:	53638292517B0678F2FF538B3FF582F320F70D3131586F78EB07B965F2EAF1BE
SHA-512:	844BE67EE5F36B72D3E21406A14E98BEDB9AF4A46B41EBB8A95BCF28F9C0ED8D52116725BA81BECF0579F448CC5FCB7A45C70F3307B34B6CCBBE365DEF63CB10
Malicious:	false
Preview:	.....................G..L.......R..........0G..!....H......PK......`Z.......o..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............>.......7......d ... ..........................................4................F.......:... ...........%..\|)...........)...............E.......7.......<......t"...........E..t...0B...2..<...t....D..<0...%.......E..pA.......8.......<...........A...............-......P%..X4...4..........................................D0.......5..............H........4.......;...F..............d+...G..,........(......................\|"......................................`,...%......(...............................\.......................)...5..\...l...........................@........B..............T....................6......pB......T...........xD..................................$....................D...............-......45...........B...................'..D1......D...<;.......1......41...........1...5..DF...E...2...................,......p0......

C:\Windows\INF\netk57a.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xc088 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	91292
Entropy (8bit):	4.174695266412339
Encrypted:	false
SSDEEP:	1536:XnHmXdcmt8e6eqEhyiSsiqrSDK1AyjABIbe74N:XnHmXdcE8e6eqEhyiSsiqrUWud4N
MD5:	6515689051FEDDFA77E717494413802A
SHA1:	3C75E92A5CBC4A5525BB55A384C115712E852C08
SHA-256:	97833ED6AA044043953CD198924D2C7D806EAC994B0589B60A67DBF0639D4FFD
SHA-512:	E1489C76C921EE5FCC20EFCBEFED0D9441AB16C77EEBA53AD62BC5AE62CA50B8976DFD863634CCA31F6FF6920FCA4E50CFF572E44C1350CECEA6D72ADD544D2A
Malicious:	false
Preview:	........................L.......R..............n...........0....'......`9..8+..h................d......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......(...p............}...o...%..d&......$b.. p.......p.......;..............<...............?...?...m......d...............B......P.......(....'...........&............h...p..........\|...\.......,&..`.......... ...d......P .. (...........k......`q......L.......,B..,...t ..........D.......................................8......................(............"..$%.....................\........q..x...t...\F......\|.............................H........k..l.......................................,..............(...\...............................@................t...... ... .......X...T....!..L..............................x...........4...x...\$..\|...........8.......T..................................p.....................................................p.......................`.......................<.......<.......0..................4...

C:\Windows\INF\netl160a.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2e78 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	22028
Entropy (8bit):	3.8020729440552232
Encrypted:	false
SSDEEP:	384:C6DPHf+Zfgz2lVJVdyBnGy7nznJ+z5abaR3MaG:rD/f+Zfgz2ZVdyQynJ+MbB9
MD5:	F4E3A3121CF098A695813AFEA200010B
SHA1:	F3275041DC5A9973C92973B423F891D20D061814
SHA-256:	CA404D66293A23A49B7B2F9C4B571AC7D06251CEDBAF04EB320C05C4E565CD7A
SHA-512:	E2F0DDC32AB660BDF2B73912D0B4D27E34D16466E067D225C2997AD545B086CB2BAC1AD34E66A52409D13804B7B004D8F2BA464F1D4C03FDD9E39066AFCEFD52
Malicious:	false
Preview:	....................x..........HR...........-......p/......@1......(;..l....H..h................V......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......@)......................(................................................%.......)...&......l&.............. ...................0................ ...................................!..........x...D...`...\|....&......8...."..L........,..........<.......................................................l........................................................%..............P-...............$...-..t-.............0$......h#..8........................(......................."...................................................................&..........................X...................................................................$...............@.................... ...................,..........d!..............$...................(...........0!..............\...`,...............%......h'......0......(-...,.......'..........t....+..............

C:\Windows\INF\netl1c63x64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x20300 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	267668
Entropy (8bit):	4.401830048783764
Encrypted:	false
SSDEEP:	6144:QZRRkbp78gkmAkmVbo36Y+q8fkoiCZbiNDBK51BK5YBK5yBK5tBK5LBK5GBK5e:2RR+p78gkmAkmVbo36Y+q8fkoiCZbiNG
MD5:	096851080F7F220943E78F685D232E9C
SHA1:	D2439826A6448F9EAB77E5E0B3BC4601CD04A74D
SHA-256:	426A51C02137AF0741AD3F893FDF2CA8F15253CCDFE7B8A8D5F8CC4A1952285F
SHA-512:	D28F87D11A1CC3552E59148D3C399F7C537CF3DEAF89017A5F2D4A42193CE9284C0B0CA9181334D9E8E4B1E7872736C967BF2B3289AE432D32DB574FF9E32BF4
Malicious:	false
Preview:	........................,.......R..........p...........$... ..............Y..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................$..P.......,..............,...........X...............................l.......\...H................B..0........T..h...L...\|....Y..\|&...........\..........,...............@...X.......T....p..............4................................... H.....D...L...X...,...........HW...W...R..p......X....................... ...L...........l...t...............d...........\...L........"...................+.. ...........D...............X...<...................H..........H...0...,.......L%......D...,...x...........<.......\|........E......................l...................8^..............T........................]..h...x...P.....................<0...0..P...........x...........@Y..........0.......................p... ...D...........................t...........h...D...........................T.......................<...8...L.......

C:\Windows\INF\netl1e64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4e68 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	39684
Entropy (8bit):	4.008227218805248
Encrypted:	false
SSDEEP:	768:Upx7C2yjoWHn5DKsNOr/WswN5zcDJ9tzMR1hGfdCJXAI5:k7C2yjoWHn5DKsNOr/WswN5zcDJ9tzMn
MD5:	AB205954BCB8F605977AAB3BFBBF9A48
SHA1:	E0939B4B7F48E397F8DEC43556089449FEFBB839
SHA-256:	62484EED3A4F7D63E9499E1D5E15FA9487FFF4A05F6E1A30F08D2FD1F669AC54
SHA-512:	C20FE18FC8195CDBA5DE1C88607953D3853424EE7DF63F289E8064F6AE639C0B0A69CB10A7185F217FF625540B4D74FD6CDB9D088DF3508E42EFDDA38040815E
Malicious:	false
Preview:	....................hN..,.......R...........M..<...`O.......T..P...`g......0...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......8J..........................<6..........8(.......+.......K.......)......./..X).......!.......A......`........................2..\|0..`.......$....;...I.......9...................7...<...............8...0......@9..L-......\|=.......I... ... ...5...........6.......................,.../.......3..t5......d.......d............1..................................$...`...........LM..............4@...M..\G......T/..<"... ..h....#..h-...C.......C...,...6......d6..............X,...F..........8...t...........(.......d....A.......................... 2..........................P............4...........................B...........B.......9.......................>...?..4?..\?...?......\..................../..\|...X<......pB..........................(:..........$<..................L@...............@..........$?...K.......M...L...8......L?...........G...>..........

C:\Windows\INF\netl260a.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x27e0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	17500
Entropy (8bit):	3.7731400950139005
Encrypted:	false
SSDEEP:	384:3iR078R3S5b0gPw1R9SJGkETcqpOJqicLzf:SR078R3U0gPGSJGkz4iYzf
MD5:	2AC3D133ED97D1F9F031BAFB99542978
SHA1:	E4EA82DAE5E1F4E26E36184658E71ACD3CBA70AB
SHA-256:	6F335EAB84AD589EA2C4FCCC55F40A133ECA4892DDC26BD19BC2FA6F5EE1F770
SHA-512:	CD4BEC752CE39D8D30B3612C6AEB3CD0DBB610A67DA04F5C6089561F0D074D63FCEC2AA1FC2FD447F0F52506CB14253545999EF2251053F39128A842471FAC7F
Malicious:	false
Preview:	.....................'.........HR..........P'.......(..T...0*..8...h1..x....:..h...............XD......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........!..........................\...........................................p........"...$.......#..................................p...............@............................... ................................"..................................................................@...............................................................................t#......\........&..............0!..0'...&..p"...........$..........................................................,...........................................,........................$......................................................h........................%...... ...............@...............................l...................................................................................\|...........H!...............!......\%.......".......&..H&......(...............................

C:\Windows\INF\netlldp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xfc0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5300
Entropy (8bit):	3.095711096207264
Encrypted:	false
SSDEEP:	48:wiLKGSGZ/4WamnQ5/9W7N8wkDwViK1Wtodc1i7hoU/L4rh:NLAgwWVnGW76wkDwYK1KycYolh
MD5:	1775631FE74B3DC8E03DCDCDC585324E
SHA1:	9C8957609B8C36662925DAAC13C1F953710B8985
SHA-256:	3183A3EEA0B069A888B191564A9A22777E677D6F883805F88ECA56A2789ABD0D
SHA-512:	D5BD483E91D9EF0D07AA58AFE5B90010C53AC2EAEB2231BE1F7A0DC52854B3D88E3823DE5A5FD414B36709DE2ADC0C2222044A361F3082137B2E877F323D5F70
Malicious:	false
Preview:	.........................-......#..........,...............P.......@...4...x...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................................................................<...........................................................................................p...................................................................................L...................................x.......................................................................................................................................................................................................................................................................h.......................................................................................................................................................................................................................................................................................

C:\Windows\INF\netloop.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1950 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9316
Entropy (8bit):	3.5479757693362375
Encrypted:	false
SSDEEP:	96:ZwK8MutZW0+HtnEvZCGlyhNhlyh0yhCBVQfqRPnt0LOB55wr0+OgjvY4GwtZ166G:26Ht1GlIhlnhVHPUO3nGvYUAu4l
MD5:	127801C0D2A461E04BFAA089BCF7CE7C
SHA1:	36A34AB61AFC6304DA9C175CBE100225CE740F2F
SHA-256:	70AD7B3378E3A1BBBF051001A061B8D911119BB0C65FD715BFBEB0323400E06F
SHA-512:	62C8B2DEAE4A8568B830F68E4E579D55981DF669091338880A3E8FD2D9988C01365BA05690727F53350EA0CC82089BB3CC0CBE2535A82C21889A6A11FD2D834E
Malicious:	false
Preview:	....................P...*......4Ne.................`...\|.......\|...`.......`!..h...............`$......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........\|.......................X.......................................................................\|...........................P.......................................................................l...................................................................L...............................................................................................L.......4...................................................T...........................................................................H...............\|...........`...................................................................\|...................................................................................................................................h...........t...............................................p...................................................................

C:\Windows\INF\netmlx4eth63.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xc290 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	91252
Entropy (8bit):	4.118050226423042
Encrypted:	false
SSDEEP:	1536:CnUQoKZGD95qohoNFLWQTyOjTIN5IOj4LXhWJ1j4sRoQROWcWDzNKAjoSHSuQFwW:QUQoKZGD95qohoNFLWQTyOjTIN5IOj4R
MD5:	6914B3E7E7180551C0EDAFD3F088EA3D
SHA1:	F6A83323A16557C3DF8B0DBE34F36B28A7C49FB0
SHA-256:	8C774714B20F3C818ED5E96D0D91FB720B4133D21FCFE2117AAAF885B46D8B07
SHA-512:	6C1F725D1739721A8BF22CCB43813E3490FDE60C1E72DBC6BF4543E0534B855E4B235BC8EE6C098EB45B9EBB0618E00FFA59D948589AABF3BBBF5196033433FC
Malicious:	false
Preview:	........................w...................../...........P....)..p....:..p*..h...............pd......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......`....h..................LS..<.......................0V..<X......@....!...............c..x............S.......#...................Q...t...#.......j..pP...T..$......T.......`....P.....8z...........{..........0M.......(..h........&..............Q......l............................5.......N.....p!......................x.......,..................$....M..p...d'..@...................pT...........O..........d...L....N...(..........M.....xN..,...P.......h...P....z...t..............4......................,.......... ...,-...Z......................$_.........\R..8...<%..................\...................L....v..8...<...h............Y..$...<............'......p...............P%......Le..........H......<).............(...@..............d...5....... ......D.......P...........\................[..........p....u..(...\|3......DK..d ......dg..`]..

C:\Windows\INF\netmlx5.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x10f90 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	114740
Entropy (8bit):	4.212268760494697
Encrypted:	false
SSDEEP:	3072:SXYR/ZaDuDDETbRXaf6PAbRL4jXB76NuqqtS3KjItqWAELHHHSHFAUgbD8t/QDDj:SX+EmRaIt/gt/Q7
MD5:	1C3DC387915CB0BB410C38BC351D0DCD
SHA1:	D930273D6E5A751F681393F12F45ADA59BABDE67
SHA-256:	D557E48F4DB28D9DCE3DAED0913202A47EF8423159FA0BD214306496514D319B
SHA-512:	BC86F99F780C11635D6CD1410576996E7454FC3EB9F954C24E3F04A9844B894C39AB5E1880D2CADBF48B9E2409E882437C4F0D01E513E610F84859B2707D4CCB
Malicious:	false
Preview:	........................QZ.....................#...........`........A..$?......h...............0.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S..............D...\...l.......PJ...... .....................;...;......'...................4...5......p<......@!.......*..`/......DI..$6..."..D........K...K..LM...d..............,B...B..x....H...C..............i.......&..p...............L...hi...H..D....................$...........&...-...F..........4................... ............T...... .......tK..<D..8....%...N...c......,...........(..............0...........$F..,&...........D.......E..........DQ......<.......t...0...t.......T...d...............L.......t...P...t...................................p........H.............. b..........................d...................L...............d................%...........P.......................... ...t...........................................P...@...............`...D...............x........N..................t....a..D...................h...........

C:\Windows\INF\netmscli.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xfb8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5292
Entropy (8bit):	3.058519076902835
Encrypted:	false
SSDEEP:	96:wi+hJ6r1CwAcZH1LJT15QXjeZdrWdcnf2:dZzZHt515QXSfmMf2
MD5:	ADBC552DB42FB6591FA8051D8D7DE119
SHA1:	1AA1E598BBC5B91C6CD87B1F9CE1339F92344347
SHA-256:	A50DEA5818BA6DD1801187B02271EB66DF87B16DCDF4CAF320D078D88623CAAB
SHA-512:	EC946C30ADD2E60C363FE91F176993B4D677775BED517064B4076B25D073716C854B00F3EAA905ED4397FE2A0C5C507E397FBAB7D91024A81551EBFB204E218E
Malicious:	false
Preview:	.................................b.........$...............H.......8...8...p...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................................................................@...................................................................................................................................................................................................................\|...............................................................................................................$...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\netmyk64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x20c40 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	194572
Entropy (8bit):	4.3661832673665035
Encrypted:	false
SSDEEP:	3072:jmVKYe/cP/01xYsLhjUgMBXJ7fb+WiSDQ20Gqb50wVavZ9g9UpG:Ib1u9UpG
MD5:	EE8806DAD59808B121F8947942B32AFE
SHA1:	313C098EBB07D7ABA45CDDC5A234AC15E1BB39B7
SHA-256:	89A0A01EB114FA3F33D13E0031D71B595F9CABE0A1E3D90B0BE7CFF5BC8E90B5
SHA-512:	F4A8B61A97FE055F38CFA70C39CFC097CCB6D1B6E53AD4AE219B0538987C99CC4012AC91B7C0303153C85E1E96662657A746300C866ECE9A198E820E3D913A24
Malicious:	false
Preview:	....................@...,.......R..............0...8............@...Q..@S.....h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......4.......<........@..\....r......\d..........N...N..h....1...j....................................<...........0X...a...i...k...l...m...n..\|o..tp...?..\|.......\..........@...........,...<...........,...\|...........l...........\............u..P....@..........................d..................l...l....Y...b...j..Xd..De...]...^..0f...g...h...h...P..........`.......@...............l...........\........z......p...P...T....z.......t..`............................................................... .......X........W...)..............XD.....(......p...l.......8y.......v......\q..........................h...<...`.......................t.......t.......0...........................t7......H.......H............W..........................................+.../...........y...5...0...2...3.......\|.......5..l.......d............6.......9...;...<..........

C:\Windows\INF\netnb.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xf50 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5308
Entropy (8bit):	3.0588032321059506
Encrypted:	false
SSDEEP:	48:jdMoJ8dfuATdWMX5D5zGj1aceRAQDNDS2N9Nt8t7kR7K8b/1oJ/Avvv6:jdMc0fuOWMJA1neRPMa9NtnNyAvvv6
MD5:	EFC30A3169914D1F7BD7F8651D50F125
SHA1:	774D92AA0014F79D8A0E9C1EF486FE48290C078F
SHA-256:	E9288AEC068860E4DEC0F4E75D5256815C4D2B6E892936975806BF211496E7BB
SHA-512:	2771C94904A758EB14F33BBE8B7DD93413AA9701A7325EB1D36ADD07E472A72815C3C704D720E10207F308F7DF2A57CAFA587716DEAC7EA6BC7526E8917D85F6
Malicious:	false
Preview:	....................P..............................X.......8.......8...@...x...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................................................................(...........................................................................................................................................\|.......8...L.......................P...................................h.......................................................................................................................`...................................................................................................................................................................................................................................................................................................................................................................................................h...................................

C:\Windows\INF\netnvm64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x6ac8 "Class", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	51716
Entropy (8bit):	4.006683549267467
Encrypted:	false
SSDEEP:	1536:5TxaO+xjVW3HVx10kXExc9fOJfXcjS56koqR0J11ITZTNIWeNTSvA/b//dOt1DRy:5TxaO+xjVW3HVx10kXExc9fOJfXcjS5c
MD5:	3B8D14CEDEA8F03D21464A91E4BA85C2
SHA1:	B09B4E2BD8A27C37001A5B4CF44EFED74303A3B2
SHA-256:	A67E1E70907C36ACD039C0570E1363B340F0BD2F54E4785E8F53C43D9B2E118F
SHA-512:	369BF677F65676E2B31BE3E6BAB4A33AF43274DA3E7A118860A2ADB7C1A323FA568504A9D2626494AB7842F6F3B454E7A3541B52B80A175E7C363D697DAD5000
Malicious:	false
Preview:	.....................j..,.......R..........4j..U....k.......r..@....... .....h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........@.......R...............'..LI...........O..............(................7...............R...........R...........@..............<A......l7..l8...8...:...'......x>...=..\2.......?.......@..d....7...'...@...M..tT...3..(f..DI...L..D`...Q.......a...........I..........TL..hi.......2...7..(d......,T......x...`M...................D..................($...............e...'......\G..........h...._...........h...*...+..............03.........../......l....1...................U...:...X...#..@\..................`...........P........................................(..........d...........................h@......................(........i.......`..Lc..d............T...............T..P....@...A...A..lB..\_......xC...B......8C...C.......C..8D......(E......D....G..h%...6...%...........b..4S...N......,O.......(.......G..4G...F..........PW......hY.......]..........

C:\Windows\INF\netnvma.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4bf8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	33028
Entropy (8bit):	3.962910335653081
Encrypted:	false
SSDEEP:	768:LsLa2Fbr/g31Of/fd9hG6U4KRFRKV3fOwJXxB89sLoYjknZNT4TDaKxrq+X/B/UL:gLa2Fbr/g31Of/fd9hG6U4KRFRKV3fOT
MD5:	C46DCA50323487C7C80B3D2A258823BC
SHA1:	4C6B11F32BCD9DF6A3060B7470790E9743AD3156
SHA-256:	7558E80D68B279F882E5FE9E2750CB9A8C74235E69BF53F4E4AAC1DF428F8FEC
SHA-512:	A59FB3F05C25FD4530FED1E9442C617F5C09FD72E32D4C0F16041B681A1BA9E31E6C4B6E2364ED341FF0B2BB8A939F8DF8F6B40C31DF57CD3A1D09C70AB9F631
Malicious:	false
Preview:	.....................K...........b.........hK..(....L.. ....P..\...p]......8o..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........5......................P$...$...........<...........................................................$..........................h1..............t6..HH...H.......I...... &..0....5..(...@<..D....-..H,...1...;...>.......-..,8..........<I.......I...........8..............d9.......+.......;..,...T>...... ...........................................D#..<)...............#.......6...........'...'..(.......!..L................!..d,......................................d=..t?..h#..PA..8"......d...............`............%...................................................................)..\|8......@6..............................p3..........,K...............>...........1...1..l....2..........,>...G.......7...................................3...........6.......-...............&...'...<.....d<.......%...........5...5......................h.......`.......

C:\Windows\INF\netnwifi.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1160 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6148
Entropy (8bit):	3.2150708082896937
Encrypted:	false
SSDEEP:	48:HfoxJk/P/Aa3uz5T1XVVcWDshzzM9YT7Pssycr7QhrTi/Ayh:HfoxJGP/Awu/FWWDshz4mnPseJn
MD5:	FA3EE9B0EAFE05251864C1AE56485CD1
SHA1:	E97FB05B4110B8AA4B46A7B104A8DAC10BC83094
SHA-256:	535482EE4AC3D17E647892322A7A3AC988A519F3BD3EEAFB25B5F9115BAC9474
SHA-512:	FD420EA90100769365F3A3C904D6B4817A97048BE386572BE2424A56F4CEEF3702A136440BEB1AABDAAB8B2863F97FCC27094493A793564A91B406402AAC6CBC
Malicious:	false
Preview:	....................`...<.(....yl..................h.......H...D...........H...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......................H...................................................................................H...............................................,...............................\|...........................................................T.......X...$...........................................................p...............................................................................................................X.......d...........................................................................................................................................<...........................................................................................................................................................................................................................................................................................

C:\Windows\INF\netpacer.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1528 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	7484
Entropy (8bit):	3.436253626211727
Encrypted:	false
SSDEEP:	96:XBNDXEc/SUbp89a7X7gnFP4iLLFiugQk6SmhG0hetLKmf7:t/eeGJN4Othnh8LK87
MD5:	1C7BC8E483F839B6EE6C4CB6F1E9AC05
SHA1:	1207A8C50E44729D19BC408E2409F9BD057919DD
SHA-256:	8599403C1F1C5F3B4907896590E88FE90E5E76008E0677A9E717506F62A356B0
SHA-512:	4EF9675373C48DB569383D94171BF94D38FED03663D2878F3871C0A44906C6500C3224D0A9E898F5C5CB253B6826EB68433421550E1D65C33A51DCB083E0FE21
Malicious:	false
Preview:	....................(..............................0...,...`............... ...h...............8.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......................................................................$...................................(...............................................................................t........................................................... .......8.......................................................`.......X...............................................................................................................................................................................@...h...........................................................................................................l...............................................8...............................`.......................................................................................................P.......................................................................

C:\Windows\INF\netpgm.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1ff0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	11036
Entropy (8bit):	3.6841661296763526
Encrypted:	false
SSDEEP:	96:8XcG8paHh0JaMHBKb+iMd7aV1rdrmQ6QVH07GVzgSCpmoovXQm6SfhGhdPUYXis6:MQHBKP47c5XKCh6MhCEsn6fXqtd9y
MD5:	BE07363394B759AA9531537A79CD6B25
SHA1:	7116F2FF9566AC60EC97BAAC2D6D99210AB45F97
SHA-256:	C0BAD4F7BE55280B8B2C9AC32C8F01A0A163E4EC83EFD10AE83AB2653DA301DE
SHA-512:	EA41F8247490FF79DFD67DDF9574D5FF2F1B1AF644EC72D9D8710075B0F08B2A27CFEC25C04C40DE057290DD2034267B92C593587BCF572819B666EBAD5BB392
Malicious:	false
Preview:	.........+...............-......#..........\........ ..h...X".......$.......(..h................+......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................................................................................t.......@...........................X...........$...$...........................8.......l...............0...h...................d...............................X.......................l....................... ...........\|.......................................P...............................................................................................................................................................................................................h.......................................................\|...........8...................................................$.......................D...............................................................l.......................................................................................

C:\Windows\INF\netr28ux.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x28fb8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	278348
Entropy (8bit):	4.370170102576879
Encrypted:	false
SSDEEP:	3072:Sst3r3xKEjhVFTD2ZzDPRBm6dvNuZFbqwGFbE:Sst3lvcDmG1uZFbqPFbE
MD5:	2E2E8E77F0F87E63DF57B68229505119
SHA1:	503759516A477C6B4072BC7981ADECBA86A31B93
SHA-256:	13394E300CE764B8A0C7E253A0B7F13AB8476153AF95BD1940D8D26FC0FECEDF
SHA-512:	D5AC3F729DB869DFCC16F7C13DFEB881A9B62415A9948845F07D543D078611B89DA4B6249D9A3D687B0FDAB8AA1DE77CD4A3CEAF59379E4137E0CDC51743A9F7
Malicious:	false
Preview:	..........................\....:.}.........$...Q.......T.......pt..x......`...h...............H?......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........P.......w......0................~...@..0$.......S..........0........Y.......Z..tn..$r.......m...i......`....w...i......,........:...x......PH...........$..$.......L............&... ...x..@.......\...lk......lE..Te..,...t........>..T...P............=.......b......X.......<<...?.......&...*..HN..@....}..x.......................t......H...@...d%..$J.....tR...Q...j......X...\|[...Q..d=...C...F..\|S...F......,g..LH...M..$J...J...N..(N...;...W..PX...X..0%......\|U..xz.......1......x......x......(...............H...dN..Hz..P....... .......#..@...H...........\|...l........_..h7...B..(;...K...B...>...e...L..\L...........V...'..T...$........^...d..................<c.......<..$=..4....>..H........O..........4...PP..`...<...p{..,.......<....... G..x...........t............v......T...8...TA..X=...'...C..................~..........................@F..p...

C:\Windows\INF\netr28x.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1d828 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	219084
Entropy (8bit):	4.337302402727411
Encrypted:	false
SSDEEP:	3072:3bXh688GkTAvQTzvg+dB6jbvcK1D/PLD/Rs:opFdaDv1DrDm
MD5:	FDFE824EE12FA95D74D86274B97CFC0F
SHA1:	271E8096C25188664A28462D6BD113C74E6267BA
SHA-256:	275CAC15515EA8E18C837AB879D078824A7088B376790C11E5B995E2D89573E8
SHA-512:	6EAE27A021F752539B68BA5207A1CC748C6C4F0A14490BF220BB3425425431E36CC5C29BF8DC0A96301D87B8F7B774D06F5E69ABD266B36D72508E4DE7366E07
Malicious:	false
Preview:	....................(.....\....:.}.............4... .......0....f...X..........h................W......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......\...H...X....#..PU...U.................8........r.........<............n...K..........X..p....L......8u......d....y......80..x.................... ...q..............xn......H{.......V.. ....]...2..\|...,.......d...............q...T....................(...4...............U.......~..8!...k......pu.........\z...z.......\|...\|...}..$....~.....h ..\|#......t...H...4...4............4...5..<$..8'..........x&...%...p...a..................#......\l...l..,m...$...........h...k..........t[...S..`....v..@M..........P....m..Tn......Hm..Di..t...(................A..................0...........T...t....(..$I...I......PX..`C...X..\Y...\|...Z..D[..T...X.......h.......$...........\|...........x...........P........2..P3..d.......`...H.......@...T...H`..,...L...0...h...........0...hR...J.......O...Q...R...L...M..............@...T......H....c..................

C:\Windows\INF\netr7364.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xa820 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	66980
Entropy (8bit):	4.116873773369783
Encrypted:	false
SSDEEP:	768:iyn//tJ7/yk6ACiAEfbMMC8d2ELCV1yuwfbZhxHHwupH4vmeHxY6KfE0bN:iAj/yk6ubMMC8Lz9bZhxHHwKH4+eEh
MD5:	8486F73E01005E08BCF5F8C44783B8B0
SHA1:	B3DA75787AE1DAD0251110665F8739F8AC60A0F5
SHA-256:	A66B33D6104CA6D82FC2853BDD06A7B953E24743C711CE38074E2ADAD7B026E3
SHA-512:	AC1519BAC07145D35B10718A40CF7529C6555A6927BC7A6555AA3477E8BAE766A131255638A3155DCBDE81D75992064EB766CD67084B9723A27741BD3747B049
Malicious:	false
Preview:	.................... ...<.^....:.}.............L.......................h...8...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......0~...W..h...`...........4G...Z...u..@...............8.......... ...D...............................F.................4...$................J.. ...........d...d..........X...d<...C..............\|r.........tp......T........w..t....c...b......8>...............(..t....)...*.................\|s...........`...e..0l.. ..........Xe......8f......TM...f.../...........F......\...............X....#..p........$..,......<q..h...........k.......9..,"...... r..PL.............. _......P...U.. ........C.......................!..........,........x.......M..8...8....Q..8w..<O.......................%.......x..........@........q.......................i...~.......j...M......$F...>.......N.......\...c...e..h................k..@....d..(....[......\........L..x...Ln...}..............48..L:...\...O...:...........#......4......8?...,..@m...@..$,...A...B...B...B..

C:\Windows\INF\netrass.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x15a0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	8012
Entropy (8bit):	3.398231792798112
Encrypted:	false
SSDEEP:	96:eLigt3qBwOmys//RswlEUxFH3YaeYCNYfegb+tXS6WS6NS6fOuZB+FKAUW4W4h4A:qaBu5/WwlDFH3vedHlCuNIOYLWd61
MD5:	98C44F5B6360329BCA22398A4A0C4429
SHA1:	8F7943073FCA23797014C595F7E8D388691B5526
SHA-256:	FD25C4416AB0A551838F71EEA66ED9DB1037A6F812E57B23AE22B9B97ADF4EC7
SHA-512:	62E2BDE8E7BED115F90828B008FB73E0A8E1DCA5413FFB1E7E95C5334ECEC7F2D6607FD491636F1F9461D951DBB8775E58F9A32712A736A6BD49A469FD1F9387
Malicious:	false
Preview:	...............................................................................h...............H.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......P...................................p.......................h.......................................,...........................................................................................p...............................................x.......<...H...........................................................l...............l...<...........................................................................................0...................................................................................@.......................x.......................t...........................................................................................................................................................................................................................................................................................................

C:\Windows\INF\netrast.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1cf8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	11028
Entropy (8bit):	3.5923648789992257
Encrypted:	false
SSDEEP:	192:FkumB04sHBRN3qJHYpd/BB23ys3OheheaeceYeye0dkl:Fkf04sHBRQJ4pd/BBwy0clzPdvl
MD5:	89012A627797B461CE937A423B94F276
SHA1:	094EBF0586919F384D3C286A1DBEA89D0B5D5565
SHA-256:	01861998CF481B70E2241282648FBBE5DB1B652B34B1B7F6933CA705BE8AD6B2
SHA-512:	71B2CADEF4040F786D991B5AC5503729301FA354D988ADE22B47E9510453F1866ADAA077CA47F2189D53E6052E2030F997D6F5549CE81EAD0D296FCC075B9C4D
Malicious:	false
Preview:	...........................................h...........h...`...0...."..<....&..h................+......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......,...........................`.......................................................................................................................................................................................$...............................................................d...................................................................................`...............................$...................................0...............................................................................0.......t...............................................................................................................L.......................................<.......................l...........................................................D.......................................................................................................

C:\Windows\INF\netrndis.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1b88 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	10196
Entropy (8bit):	3.5280221125345594
Encrypted:	false
SSDEEP:	96:DikIUNgdIa1X3hGloWFp1AQOSX6AKd4dzqNPaGmkIq99GlYcTBvdS47fUjEfuset:DghG2WKzAg4BzGgBvRAjYeyO
MD5:	A7956FF3990E6DEEDADC9CFD1136D10A
SHA1:	4A8E5960F8A4622DD05AC6A69C16FBAA37596FD6
SHA-256:	92E83DBC417AD0D9985E2CFE85F4333A67F46D49FA033B73F57212D5231E3B92
SHA-512:	03EAD375E5A699189ED6BC6C24E85ED2AB6E8C4D9B7694C8E19E9338D3488E4C03A347C66B3B80B160173CAA8433BF1C48E038CA4706204D55ED517A7A560F08
Malicious:	false
Preview:	.........................\|../....#..........................(........ ..p...`$..h................'......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......`.......................\|...0...........................................\|...........................0...........................x....... .......................................,...........\|...................................................d...................................................................................................................................X...................................................D...........................................................................................D...........................................................................l...........0...............................................................\|.......................................................................................................`...................@...............8.......................(.......................

C:\Windows\INF\netrtl64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x76a8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	42548
Entropy (8bit):	4.078698319747899
Encrypted:	false
SSDEEP:	768:khp3AQXx+N2Znk+ns8+TZ73SD8PpH1X9Ba/4uKZ+W86Mkzp:khpkNink+ns8+d3SD8P/v5+lI
MD5:	BA8D85EC3249551632C519F040B31A3C
SHA1:	02D146926D3934D4E2EFCDE69AE76BC53FD03491
SHA-256:	2E657D539D0B5B42686ED8B48F1D03B5648ABFFC6D107BA9A09CA920ED7D8F56
SHA-512:	928FEE2F5AB648673C549476A12C496AA528500E3491BE5E1093F43149BE318CB02493C7E107755571A4831FBAC1FEECCA9463DC67F25EA534FCC60CE0FE4CCB
Malicious:	false
Preview:	.....................v..,.......R...........v.......w..\|... y..............h...h...............0.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........1...=...................7.. 8.......................P...........L...U..\|=..0....................H..$ ......H6.......u...........i......$U.......r...P...............S...9.......2...s......X#..8i...k..(j...3..`^..._...h..@........ ......,B..4p......$W...'...(...D..............T....+.......[.......a..........................0.......................d...p...h............&...t...........Y.......B..PZ......L-...............e..............................T........o...........;...D..@...\|...........0...l...............09...............................V..$X.......f...............[......\|....b......4d......................,l.......p...............:...u...............U..........X.......................8]...s..............\a..........p:...8..Dq...k......Ps.......h..................tV...W..............h............u..lu..........................$...........

C:\Windows\INF\netrtwlane.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xc8b0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	120452
Entropy (8bit):	4.067924352168956
Encrypted:	false
SSDEEP:	1536:vJYedRLJ1YisAj5hbJ0oaqSF+Coe5O/dcH:vZdRLJ1YisAj5hbJ0oaqST50dcH
MD5:	1C4B87FD7E4A4443863D81D44A4E2695
SHA1:	999F9FCE805E712B137409496C5277350CAE61CA
SHA-256:	85DB3BC594B55B61CFD3988D0D79706CE11D31D6AFCCB2CBE8FA34F82E13ACAA
SHA-512:	ABCADB302D8182FF4CB9F1363E379FDEA04618138F43CD542BCA6F05CD0FA48DB500409293941583F0C0A93DF0CBC494EFFC969D0676FC6DDD2B97D1A6066495
Malicious:	false
Preview:	........................r.=....:.}..............................B......T]..(y..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........~......Xs...z...........7..T...D.......\|%.......B......P...X...$.......xd..........0.......x....v..........................4....g.........4................)..........(.......4....$..4.......t......p...p...x_..4e..$J...........^..........D............0...6..(...........@...................\...........d...X...p...8L......0....................................Q..(T...;..0...P.......<n..l...........\..li......$E...!...D..._......p.......xl.. ...........4...................x......d.......{...g..<y.. ...............8.......P......., ..H...h~...D...:...z..\|....=..HU...K......(...<.......4............'.. ......,...\.......0...............i..P...4Z..`...............0..........................................................l...(-.......5..$6...........e..H...P...................t...P.......+...q...........................9..,...............X"..

C:\Windows\INF\netrtwlane01.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xeff0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	137868
Entropy (8bit):	4.163942374603351
Encrypted:	false
SSDEEP:	1536:rBnYwgY+1MIGn/1Jq9lH80D6Ps6Bvpo2xsvC8DnUVT4uoLW72x/hWB9iQBrpbqi5:rqwgYiqsvC8umQBrpbqiTk6ezLtzZLY
MD5:	4C73E0B7A81B35DD4324D2D02490F51B
SHA1:	D391E1CB6DBFE021E05C145D73B562459AA3460F
SHA-256:	68360EC7A9012DA18251E0500E7AB527017978A74E37EE32B91EB5725575F11D
SHA-512:	87AE5BA079652B96E4AE16A28A39276C9EA2B2B3504F1F15007CB903823EE8403387BE965842FCD717A6B60857D40D62B5E3F4DC8FA5DD7A054E9FD3EDD89A3D
Malicious:	false
Preview:	........................NS@....:.}.........`....................I...N...e......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........h...\|...............hA..Dz..........\|%......\|...\|...`...X...0...tj......\:...>..0.......<........4..l...................\|#..L.......l...............$....)..D..............@....$..4.......t....w..HU..................@...,....l.......a...s...x......H...d...Lv...z..\|.......d...........(...4...........d...................p........3...............W...{......hs...0..41..h............k...S.......H..<X..(.......XT...!...F.......L..L....\|..ta...V..\|o..h...,$..H.......................h.......L.......................d..................., ..H.......0....D...S..........\....N.......K.......................'..T.......H...........4...l...............4...8u..`...............43...........V..............,........%..........\...............h@..T........I...p...6..4.......P...............q.....\|........+...[......$.......h...P<..h=..8C...<..8...........X"..

C:\Windows\INF\netrtwlane_13.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xc078 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	89732
Entropy (8bit):	4.179892902999329
Encrypted:	false
SSDEEP:	1536:EKBcTtbkQW8V0KuAfPFyrq6FPtJcBgjVbLSQbI3R:v8tbkQW7KuAfPFyrq6FPtJrkQbIB
MD5:	78BB7FF58944D06DB7207A5784DAD66F
SHA1:	054039832CDAA7E7F52FEEF0277DA6CC9A7FA850
SHA-256:	472332E4AEEFFB10D5A48CFEFF5F2E36AA86DCBD190B33BDCFC76D40CC919FDD
SHA-512:	90AE002C443D515D297AC00B9E609F1B0FD30B9081EE06FE5E152AB2231DE026814FAFEC8557859EAB534BE641C03CEC9A2D8AFB4E9DCA37D8B4B3C6D374FDC5
Malicious:	false
Preview:	....................x...u]B....:.}............j...p...H.......d).. ....5...(..h................^......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......`5..d4......D[..p...,^...?..p@.......*...%.......\......................t........r...........[.......?..........t:...Z..`...HM......9..`....B..`n.. .......).......2..xK...........#.......d......P.......`...P.......8..............8.......<....F..X...\|...l...\|F..,F...k..\|......hE.. L...G......H....M...................n...............................b......0....~..8...T.......8....... ...@C.....x...x..........d!..Lr.....`............^..(............#..,........w......,{..8......`..................................t............................................w..(y.......................z......h'..0A..t........A......\.......p...\|...................X...<....&.................D...............,...<%.....................................................8.........T....s..0J..,........H..................h.......<............................!..

C:\Windows\INF\netrtwlans.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x7668 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	67796
Entropy (8bit):	3.962311125732295
Encrypted:	false
SSDEEP:	1536:6uLl8hAfRJK4LPqXerbsIEtxhPww5o9+Rl5D5dZ9Odv7rGziy2mq:6w8hAVHrchPww5o9+e5
MD5:	8BA80A9F70042C250B9DEEE842134524
SHA1:	9F1B73C9A18B6BE20466BEB239259C0E77FCBDDC
SHA-256:	17ADCC184D71498E399A4B369C23B0C4729881C3EE62D58721119753C38ECE06
SHA-512:	512FABE1482AB12373339B3323166574FA6FF6B24CF94B4BF0306F5AF8C0C8FB4DE9E7255291BF151E99E271B6CDFA6723C576C1B3286568C46E8D9B9909CC20
Malicious:	false
Preview:	....................hv..<.^....:.}..........u..a...`w.......~...$.......2..8...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........W.......H..................L/..\m...................[..........\|J.......C......lh...G..............\|...\.......X.......TQ...s...E......t........X..(...Hd..............dC......tn...W......\|Z...T...U...F...o...Z...........X...c...E...........e...........T..._...............e...C.......p.......e...............................l..................4................j...4..X....t..._..h4...4...k...t...3...3...5...2...4..h3...l...q..0j...8...7...r......,2......P6..p<...........c..@k...............L..du..8...........,u......`r...^...........Y.......M.......R.......S...O...f...........Z...L...P...^..pg......p....0...@...j..._...<..`G..pt...T..p........h..........t....Q...n..@q...l..............\\......$c...W..0f.......2..........d...........lU...:......\1.......?..T9..4&.......... m..8$.......+.......-...%...&...u...u......."...)..........Lc..TH..........

C:\Windows\INF\netrtwlanu.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1cab8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	246276
Entropy (8bit):	4.3255352429456675
Encrypted:	false
SSDEEP:	3072:OLI3B2dR1Hw2f76rFvLS+pHmyRfTDDb9do:OLhdHw2x4fTDDA
MD5:	011464A7B67A2DFE8D2424C33660F366
SHA1:	967FD36657235986FFEF17FC749B8FA6604662D0
SHA-256:	9D1093612041293B7783BAC9D7DBEA4CE394945BE0C50FB5A65CFAF7AB145900
SHA-512:	134E972D22860C7A66D34204FA04DC8CC2290D26CF3E1127ABC0334037458687D9665597F9885A733C3C436BB2E965C7D97A90344EEF80A7DDC7A4FFBBC7B650
Malicious:	false
Preview:	........................<.^....:.}.........$...............8....~...\......p...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......h.......,....p......t.......pl......f...u...............l.......^..........X....P...*......,......X...........4s.................8....h...1...4..........\Y..H...4x...N...P..`Q..\|........................f..0...........\....#...U...........!... .. ...T+.......2......D_.....,T...9...........[..$...lc..he...Q......H"......0........]...e..._..l..............(...\.......`........U...T..T....e..<...t........3...Z.......s..h....v.....01...@..P.......pf..............8...H..............G...(...........A......l...............r...............{...\...d...9...r.......z.....$k.......:.............H<...&......(... ......l...$~...............\|...2...I..Dw..L...DO...P.......?... ...^..pA...:...e..Pa.........................!..X........}.....@$..................$........m..H.......,u..\|M...8..$...h%...d..........T-..T........?...=..4....#......`G..

C:\Windows\INF\netserv.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xfe8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5348
Entropy (8bit):	3.053792683729635
Encrypted:	false
SSDEEP:	48:LnpMv5r6KZNOmO0zV5GkKzNRV3qkDtBezm/7tWK9n:Lnpwr6Kam9cDtjei8o
MD5:	C3A652C8A4AA5DCADB6EE324054386BF
SHA1:	0FB7096AA6946685095B2433BC4998D662B6CD77
SHA-256:	C3D8A15E3DCCE4F943A72A8617CF8FE457AD45A97B6CF533BD16ECDF0584FBD0
SHA-512:	504114BABFC0F7F7E305769DFBF3B2D4DB7F828F3F4EE03B658F1CA6BEF585B7E694254A1CAC93AB3420847B7B3238CD893F89858B3D2768B8E0D732421F0823
Malicious:	false
Preview:	................................b.........X.......................p...4.......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................................D...........................d...........................................................................................T...............................x.......................t...................................................................................................................4...........................................4...............d.......4................................................................................... ...................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\nett4x64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x69b0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	57236
Entropy (8bit):	3.949705246893213
Encrypted:	false
SSDEEP:	1536:ZLw4Aiey0YVGOLfSEJvc4m+iFfUH6zv6nA1Y+O/hq2z+f0xCmLSXuavyI3KfMogG:ZLw4Aiey0YVGOLfSEJvc4m+iFfUH6zkR
MD5:	F179DA2A71E52B3C4BF8EB10D4803619
SHA1:	E6D4623DD84AA9ADCEE06B2C40A81810231EA644
SHA-256:	C8018AD6FA58EF5877C2E768D47BB018C630935B39478FB17DBC725F49CB925C
SHA-512:	F186E37A98093D088C927A4E45339F710077FA2730D5B626EEFC808CF852517071E7F0415A1DBFF3B2AFD5F2EF1FD859D8D7C07568F628DD2672D1F7E84B3DE6
Malicious:	false
Preview:	.....................i..QZ................. i..0....j......hn...........)......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........,9..8...........lZ...-...8.......a.......... ,...c..................\N..T............,...........-...!..$[......P1.......0...6......p0...Y...g...Y..xL......XM.. Z...&...!.......;......X`...4..H4.. 7...E..,D...\......4Z...C.......b.......*...........:...S.. 2......Da.......3.......D.......\...G..X:.......B...... "..0V...........8..PZ.......d......\|f..........t-......(h...?......t....@..D=.. ........=.......V......pX...5..........................0M...@..pS...Y...>...[..(...................$...........L'...b..x.......D...t`..lP...<.........../...3...(.......:...............@...................(......P%..."......(.......`d...c...............c...............................Q..\|........E...........g...R.......=...............]...P...d......p7..........d4......0........`...N...1...E..,E..xT...............h...h....... ...........X..4>..LC..PB......

C:\Windows\INF\nettcpip.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1e48 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	10828
Entropy (8bit):	3.658004421574635
Encrypted:	false
SSDEEP:	96:MK6qjvMf80mYm8O/hPC8If2e6jbR5dDPIkrRjgBv2XLyP2txriTk3N61fwEov:zx/0S6ee6jbLlpvbP9ip74
MD5:	F140A8C713893460A18183B2D9AB2ED8
SHA1:	E3B1790FEC50385BD5B0455277FC13796E5309CD
SHA-256:	D5966015A0F012BB18C867A01DA2559EFDE4F4A36464E026AEEEBF920651C91C
SHA-512:	6FA051FCF7ADCC13F7001F644A9711683D21D09F21156E03D62B7023786402BD7C5FE11275E249D6C5A2E4A1DEDE8E57AC141C54CFDC30DFBBF1D69ABB8F7959
Malicious:	false
Preview:	....................H....b.........................H...@.... ......8#.......&..h...............H*......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......(...........................`.......$.......................................................................P...................................................................<...l...........\|...............................................T...........t...........................................................................................................................p...............................................................................................................0...........................t.......................................................................................................p...........................................0.......................................................................................0.......................................................................................................

C:\Windows\INF\netv1x64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x36d0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	25700
Entropy (8bit):	3.879814222820967
Encrypted:	false
SSDEEP:	384:Y+hk0LlSjSJSpSSVSILaGutjzKBKnKCKqK3lKyK2KAK5KnsnrYudt1U+ACEVBUZR:PK0LlC0lktaNnUGbDIlnLNQCir3XUpKn
MD5:	07A300799C40B33E09D9CA7365566781
SHA1:	00285181620A736291B518B167A09E1813318E43
SHA-256:	735D2D0FE4A22816500A5CB982D3754E29D22A7E2F0D3010C700EF099157A4AF
SHA-512:	21540BB24A08C0BBA0706DD6DF3F64E1047AD17F5E6C2A7513134A90CF971A035E04CC7C5DFBCAFE9A8D6ECE5E29EAB2E89CD1215C25FBE6324EEEC486915994
Malicious:	false
Preview:	.....................6...+....yl..........<6.......7..X... :.......E..D....U..h...............`d......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......<1..............(2......H................%......L'.......(............... ..................................................8................$...2......\,.......,......<.......(0...#..........$....%... ..D%.........../...2...........,......H....!......`"..........................t ..................................\................................#.......................5..............4$.......5...........)..D*.......... ...........................\!.......!.......+..........................................\$..........h...p......../..........................."..................l+.. 1..........................4 ..8.......,3..(+......................H+.................. .......D...................D1.......#..............X......../...3......T... ........................+...........!.......................6...5......@...d............+...$..........

C:\Windows\INF\netvchannel.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xf78 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5220
Entropy (8bit):	3.0286571126481814
Encrypted:	false
SSDEEP:	96:QGMMOFM/lpO1J1e7KRuc1MO1Z8OTCYOhOxOPAkOPgvU:9/LiCGSiWEU8EYgvU
MD5:	56CA4126C3FC85CB809EF796F0E23493
SHA1:	DC16EEB5481FC917126ED5C99947E97D85B074A9
SHA-256:	0B5627A01DF6525D5995AA9DD04316752F239CD7B33FCF9E07E98317D799BBEE
SHA-512:	E25AC57833C32101C5F9C33230B6B14D23247A3087B6104526A7BF5ED3FFA4CAE01F0C3CC752E3884850694822A0D7BA588008075921666092585BCA16020453
Malicious:	false
Preview:	....................x...<.(......&.................p.......P.......P.......X...h...............`.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................................$...........................\|...........................................................................................................\|...........................................................................................................................................................L...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\netvf63a.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe6f0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	96092
Entropy (8bit):	4.146629308713821
Encrypted:	false
SSDEEP:	1536:nfAMgUT84tKF9fJomjP99LYwjjMRSIu+GRwIj+9s0nWXpw:nfAMgUTZ89fJomjP99LYwPMRSIu+GRwD
MD5:	80CBA9A77FC936CE73AB2DC69C717E68
SHA1:	5A6350D78447C6BBF5DB8A2A6DCBE2F6ED1CCF25
SHA-256:	84102B4D9CCA9586992562453952BF7436B5AB0A6DB59B0049C4A82CA6AA6C42
SHA-512:	FF389DCFEC7480E213C86A57AFDB4FFC2A28E59336DD9AE49F8CE9C69B187B0253E4E7116D5CAA095D5DFED20F9C2C61831A71894CC1BF5C03CEC7B59AEB5D3A
Malicious:	false
Preview:	........................,.......R..........`...-...............L&.......2...D..h...............Xw......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S..............P....g.......8...!...-..........t...........................................................h!..<...................h........(.......... #......h"..........pK.......................... ....".....................\|...P... ...........`...........H............#.......,..X.......0....+..........8................... ...................4...............T.......8!..................................,............$..........d.......................................H....... ...................................................t...................X...........................................................................................P&..D.......X...T'...........+......................................\............................)......D............................................................*..H$..,...............................d...\|....$......

C:\Windows\INF\netvg63a.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3bf8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	27724
Entropy (8bit):	3.94649433258814
Encrypted:	false
SSDEEP:	768:t3a+e0oymk8em1wbhgpJAg5+GRwIHle1Ep+:BHepym1eKwbhiJAg5+GRwIHle1EQ
MD5:	CB5BD304B0C0392078972D1C8683499B
SHA1:	BD614ED06D9C0ADD51B2E76ACFCEA064275E4D8F
SHA-256:	9E7E2F51F0512BFB6DE868080B62E750EA3600D5A60C548B715F515ACAAA9BCC
SHA-512:	675395752217B1E8687FCF38AC1D63C9B2C4292DB087FC90ACE655410FB927E35FF22A42AC3504558820A204F09A0E829C5AD00BB397AF683EC2A68FE4725FC8
Malicious:	false
Preview:	.....................;..,.......R..........h;.......<.......>.......J......p[..h...............Hl......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........&..........l.... ......(...........................................................................................................8;..........L:..H4..................P........................$..\....%......\|+...#..t$...'...(...4......./..t&...........&...........+..........."......@5..............\|.......,1......`/.../...................-...............................:...........&..........'...'.........../.......0..x#...............................'......P,......4#...........................)...........+..x.......`........................................-..........0........)...................+.......................6...'......'......./..,...............................................<&..l9..............................d'..T7..................`$......H1..................................4...p....:...:......P............1..$...T...........

C:\Windows\INF\netvwifibus.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x14f8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	7044
Entropy (8bit):	3.380322757183488
Encrypted:	false
SSDEEP:	96:Zsz6ZkSLv0Lm2hOMxowwPsHQV8ctpvsOcs8aueytUFzbg0z:ZXd2hxxsPAY8IvIq
MD5:	D145D7411B9FB02E318BC1E58E1CEB65
SHA1:	6282C14442F5B6766E56EBAF0E1C9B5130113594
SHA-256:	95E1E225683FB426E5A07BEC6862354DAC1FD719D88038FE7141E6742A754C61
SHA-512:	6BF20113311EF66CC23AAED3DF2451FE51DD2758BA3A705499AE145B74937E4A1EAB99FF552C21C7D99D1FD790E18B15B28A7142BC69E020AD31AD461BADC783
Malicious:	false
Preview:	........................<.(....yl..........d...........T...P...P.......l.......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................P...........................................L...................,.......x...................................................................8.......p...............................................................................................................................................................................................@...........................p...............................................................................................@...............................................................................................................0.......................................\.......................................................................................................................................................................................

C:\Windows\INF\netvwififlt.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1158 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6212
Entropy (8bit):	3.2370706442158226
Encrypted:	false
SSDEEP:	96:TSUBrX2aHCMhrHYzcjeHxPadZAatJWWWWZ:OmdHFhrjeRP651
MD5:	5EEED7994875AAEB98B85CEB47D5FF74
SHA1:	7E770FDF1F8573D8A1D249DAFDC9AC773582B4C1
SHA-256:	BC4E2FAAAA1BA1B5BAE2CEC19E7420403E97B6EA956C92F7BDBC5C09272A4F12
SHA-512:	3D2612E21883A938DC070ED93A30AC11521ACCCA8217F13ACBE6D013E7F6B0EFBF41EB1F3882F9E68BB9381545840D437ACB69B0C7A25BD7FD98C596145ABEB0
Malicious:	false
Preview:	....................X...<.(....yl..................`.......@...\...........p...h...............@.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......................p...........$...................................................................................................................................................................................................................4...................................`...................................l...................................................\.......................................................................................................................................................l...........................................................................................................................................................................................................................................................................d.......................................................................

C:\Windows\INF\netvwifimp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1bf0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	10036
Entropy (8bit):	3.575509374010311
Encrypted:	false
SSDEEP:	192:tKxAZnm7uOtu5h1kfjow10FvVGlw9svuL:tKxAgaz5EvyvVGQsvuL
MD5:	E47E776496D6F23216700766C6D2B73F
SHA1:	67E410D2F6DD3286FE2FFAB4D2F59F603400C423
SHA-256:	D6C3D749615DFA8A45599F66AD4D5B36A658352DC4DE248B36C6278692C0DA75
SHA-512:	813B514F41743C4E04F6AEFAF2AE9DD386B0A2E8C4A45975BD9246AF49959B3EAEB05769E7D446447A50F14B67F99DC91223BB32F995AD78FFBED3888FBC8A64
Malicious:	false
Preview:	........................<.(....yl..........\...........T...@........ .......$..h...............0'......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......4.......................x...`...................................................L...........8.......,...........................................................................................T...x...H...........................,...............................................X...................................\...........................................................................................................................................l...............................................................................................................................................................................4...............................................................................................................\...................p...............................................................................................

C:\Windows\INF\netvwwanmp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x10e0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5676
Entropy (8bit):	3.1762989142343985
Encrypted:	false
SSDEEP:	48:0PuY9X+g7ilW1q2mU2v4p5ugMBR4RXsBdIAWo6H7Q+sRE7+Ex3ZxE1qMZ:0PD9X+0it2mU2v48BRYXsBd5RAluZ
MD5:	0BA7750D90128790642CC4F45FC7B7A7
SHA1:	3929C638B0A5F9D63263F3B0505C6915BA4BB85D
SHA-256:	CA3EDD8D6DC7E23BBA740AD6B39C9A3CEB3F0EA2A0213F5B1F9471E023DAE627
SHA-512:	FDFA2E382F81247337E1AE3E32071DFE04A5E19BB8C32B69CA2CEDBB0B17648A9D8E643164E9B5B369BE04430A2B12F825150D828A88E4734A966F8B1A8281AF
Malicious:	false
Preview:	........................<.(......&.........P...........................@.......h...............(.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......P...........................................................................................\.......l...........................................................................................p...................................\.......................................................................................................................................<...........................................................,...............................................................................................(...............................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\netwbw02.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x18dc8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	237404
Entropy (8bit):	4.189218736380077
Encrypted:	false
SSDEEP:	1536:zCAgrUhY9UrBY6Ju5Wg1Pmb6C6ehbFPAORPFwQKZqCcDr9gK5:z3oUrBb6C60PTIbcHn
MD5:	596E92224F3275ADCDBFC63C3484E13B
SHA1:	2A64C620BA73BAA55EF97B6CA0167A06A4B65597
SHA-256:	70EA6FBC6E7F82C5276438ECBF954DC8AA2ADC97FD52F416973F1E47251DEFF3
SHA-512:	244B9B9175EFEE1C29EFA3578C7E30C4332D1AD88BA70EA7AFD64A4D3749A86EF54798BA1420AAD2A968CC49EB2380B7AE3677B41761C9ED1B1077DE04579B34
Malicious:	false
Preview:	.......................u]B....:.}.........4...........#..x.......8>..........h...............X.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........N...*......D2...........,..0....x...................u..P....P..x...........\.......pI..t....U..(_...,......L...t............0.....(...........B......X,...&......H[......`c...v.......H...3...E..X}..._..Dp... ..<....X..(...........(........$...... .......l&..Px...............x...s......$........[..dh.....(...............4......T...T....t..<u..............`t......4 ...J......p!...........i...........T......8b..$N.......\|..... 9..p>......H........z......x+...t..hR..d...............x...l...............P...............`....!..(X...K..0g......8"...D......h............c..................Xu......$G...:..........\...........tu..............P ......h...........dI...b......t$..\.......@.......H%..<....'..8...............H.......\....v..X'..........\|....j..(x..xd.......d.......g.......u..t...................@...........T"...A..<<......x...Dh..@8...=..

C:\Windows\INF\netwew00.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x98b8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	89092
Entropy (8bit):	3.9878657440186465
Encrypted:	false
SSDEEP:	1536:DJ6SbpgE9y3bW3jIcght4SK5G1VuHS4BIkCHWEYlm11aPkQ3ApGsfr:DHK3bW3jI/4SK5G1VuHS4BIOm11aPkQY
MD5:	5A4967FF706CEA3AE50F815C78A7D854
SHA1:	BB4DA1A2522E0AD5726A270533AFD1454B5D7647
SHA-256:	6B2DB8EFCA58F98AFB644C22455F1DD6235097960B768B29A8182C67EF34EE2A
SHA-512:	DF2B30EDD755A8563EF312F517E5FA8DD09E3681835F1919865DDC422FFB0272F3112A6034C58612CDFFD1C4380DD836643A7CAFB8D49A3AA9371BB14F0BBCC6
Malicious:	false
Preview:	........................u]B................4...q..................P...XE......h................\......C.:.\.W.i.n.d.o.w.s..............w..............P,...)..........h.......P...<u.......k...{.......?.......j...k...............,..........@h...........t...^..Xq..........D........+..xt.......e..X?..p...Ld..............`{......Ti..<\|..,r...q..l...h....!...C...}.......%........... ..('.......%..x4.......B..................8....9..........H~..$.................... ..4r......H`..........X....+..d............h..........$o..(... R..lp.....Tk.......r..........g..........\|U...f..P}...".....DI.............$...0............t..............................Ht..................h!..............\|.......0l...C...o..x..........................L{..............P........................a...{.......k...k......0%... ..............&..X%...(..4................................(.......$..0*..@p.....(_.......m..........P[..............L...........T....................I..H....P...v......h....p.......d..pe..

C:\Windows\INF\netwew01.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xf730 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	182812
Entropy (8bit):	4.067317424611976
Encrypted:	false
SSDEEP:	3072:2v9KB1tc1Y+K5+N/W/AdKT2kETAlKbPdNK766Ej6RO7ridYeIMc:956VzMc
MD5:	A91FA038C15B46483A4F3DACF477856C
SHA1:	13909C10DB2431D025794CDA9A5A4A0338795986
SHA-256:	C0D508ED7476015EEE346A61646E6E372CD5BBFB441EF5E103EA610A14D0A6E4
SHA-512:	E645AD46F371709183382A6D17F2192169B0519EF00899FC58EE0501D9F7BAD55E6F78694EC684AFB49633561064596030B3B9EBAACE82356CA2B31C46F410C0
Malicious:	false
Preview:	....................0....6G....:.}.................@...<.......hp...\|.......#..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........ ......................T....+..x...................$...8...... ........Y..@...pI..PD......\|0..0?......(i..................P..........\................-...)..........dY..........\.......$z......Hq..............L...X........#...]..\........'..........."..,)..................x....:... .. .......l...`...............(...................."...........................-..h!..........`m.........................@........]......0Z......P...........p...........L....,..x...............x...X............................... ...........$.......0...........l#..................................\|...............@..................p....................!...!...i..<...0.......p...D.......4'......@............(..\'.....8......................................<...4,.................P...........8...............................`...............`......................

C:\Windows\INF\netwlv64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x29320 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	525196
Entropy (8bit):	4.267775203366188
Encrypted:	false
SSDEEP:	3072:V+kLWuBsSHp2NIoE47etlvR3ouFF9uO7bLfnzaa0Ec/07OYqfyTptY9vDpVHT9sa:dV3QaBKfehkb8Qm7O
MD5:	45DD31C7DB5C93C6AA62D9375015C8F9
SHA1:	C63E2080CA3C858E64F9F41116B20C3C31A5E834
SHA-256:	1537B8645F71B95DA382F6C428C6A29238263C1CC5AD9BE0111E8E63B51325DE
SHA-512:	977F1E9C977C328D50AB1244417E47EE9985A5A61A0A068139C4696B7B389D6C9663055F77696B44A95AE38D3C04D9F663AE16EF1E99F5A730330235D6C4ECAF
Malicious:	false
Preview:	.................... .....I....:.}.................0....M.......?...!..........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......\|W...Z...].......D.......u..<%..........0............/..H...\|...H...Da..Dl..xl..$k..Xk..PP...z...Y......h........%...E...s..........l...l@..H....X...I..(..../...Y...q..40.. s...l......j...........W..........t......I..La..l0..,........... s...I.......m..,_..d9.....D8...3...:..l)..hl......du...y.................\|i...K...`..........L...<G........._..@R..<>...<...l...N...............W...:..l........D...U...'......\\...C..$<...5...S...G...m...I...D...R..\|s...}..<-...2.......V..tA..<S..............0....d..\f..x............/...Y.......r...-.....$q......Xp..8...x...`U..4A..........\...X....@......P`...b..tr..p8......Lu..H....H..........4...Pb..@,..X0...^...&...A.......r...@..d7...8.......-...^..t~..L....b.......B.......?..H..PJ..l........d...V..4)..t7..d^.......R..0.......d...........,/...~......t=.........,...........TI...V......<;...4...V..

C:\Windows\INF\netwmbclass.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1c60 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	10492
Entropy (8bit):	3.574947416160159
Encrypted:	false
SSDEEP:	96:aVFFzOkn0maOBh76Mf3AQU65XOSMX0e2U68GXNT0wyLgvsAn4ZVl/YxnDTHaqZx:axumtD76Mfw0Afkc6XbvT4MDTHaK
MD5:	DA67B6186041AD47A4E2FC6031BA4CAB
SHA1:	584AFF955F0A0E77CD14E9C9DD572E99902901E2
SHA-256:	D7EF991BEED8F86D33BD0784CD7EE8F1BC677F8D719D9335AC5ABD5290AD8504
SHA-512:	F206EA23F740BE43604964220BEA30D742D241998356D210366CC885BA56169F45BB73CC02E90661C7CA9A5F310F10FDCE2A24B105F3691A8C9421ADCEBB9912
Malicious:	false
Preview:	....................`...gi../...(km.................X...T............!......P%..h................(......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................x...........\|.......................T...........................@...............................................................................................H...........................X...................L...............................\...............................................................................................4.......................X...................h.......x.......................................d...............................................................................................................................................0...........0...........................................................0...........................................................`...........................................P...p...................................8...\|...........................

C:\Windows\INF\netwns64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x12018 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	177060
Entropy (8bit):	4.131994890691655
Encrypted:	false
SSDEEP:	3072:WdMStlIP8WNhtA+Esd5+ENVKWXqgz9I3+DrkkO8PP8CQ2NiiSDpp6zrejoD5OevS:WdMSnwoKF2F
MD5:	A2E447925A7F34D5E2824502A6003152
SHA1:	BE974E8E3DC59A1E78BE59E2474342E7E9731A79
SHA-256:	95E7B7348B40AB3EAEB6B72DB21F07886FB02B0E5AE48A9B75172D1F16D1B6E5
SHA-512:	6F07B23CC1D244CC18B45CD0C2CAB10AC8856FADA7A4E18722742DA960802C0454FCEF50E731057DB152AD0E2761AE6B650BB95F30F890AC3D144DDC88B258C2
Malicious:	false
Preview:	..................... ....I....:.}.................(!..L...x/...c..0...8...h#..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......x...H............f.........................................8...0...........\...........\...DQ...u..\|...........H............a...........e...............o..........DT..@...4f..H....p...U......0$.......h..T(..........X...tb...;..d...........h....]..L........r.......5..\|...........................p....................\|......T....%..............p..........L...........0.......`.......L...........d...............................Y...................%..........<...$...8...H...............H... ...........4........y......d!..............\...........4...4...._.......w......(...$i......@...........D............$..x...............................L........6..p*...........U..........D.......0...........$...............<9.......{.......4..@...D................... ...0B..$%......@?..........d..........8.......T.......h........{..............................

C:\Windows\INF\netwsw00.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x10c10 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	161044
Entropy (8bit):	4.10293065047107
Encrypted:	false
SSDEEP:	3072:9ogzN37yz7ic9NZls+H8Ptu/m0KI11689US6B/2mqqX+c9Bs:P7+Us
MD5:	4B473EDD3D84B81A330AF679BD55846E
SHA1:	329318034E9A8D6B1936F40E6DA38B2E3E69A62E
SHA-256:	868E135149BBA7E9E89FC1511960AD64F24157A93B9D707F34A43A53AA68CF78
SHA-512:	97A1EE02F447AF27C899901865D8E32B396A85D92EC55E1069365CDEFBD03F4655BD466D7E538949421917F946EF37E02B207A7ABB52AA653110B886E9B3D010
Malicious:	false
Preview:	........................F.K........................ ...t.... ...U...v..<.......h................u......C.:.\.W.i.n.d.o.w.s.............D.......4.......8T..................P...4.......h...............@~..`h......X...\|............S..4...........................0...............................4....~......(...(.......h...D...........t...................l...`............P..........PK...t......\...Pc.............. J.......... ...P...............`F...................K..........................\|S...J..................\...................8...............................8.......t.......DM...R..h...D...........T...........................p...@C..<...........4...D...(*......(F..................................4...D...............D....R......\...............4...........PJ...J......l...0...p.......t.......lP...L......L....$..@Q...P..........T...........@E......<.......`...4...........................l,..d...@-...)..\|...(....... .......................E......\|...........T......................X...

C:\Windows\INF\netwtw02.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2d860 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	413292
Entropy (8bit):	4.1786835785007925
Encrypted:	false
SSDEEP:	1536:f9f1E31frUgZIdcteGVsWBKaGnrPSrR+LjGey3l1Bd8eOsMe8KcBqqSfXkH2rK3W:Po9GFG0nrKSjGekfdFtqSPT2ZHBl3oX
MD5:	5C3F4CAC06F5539CE2EEB33EBC9B46DA
SHA1:	6590A9C85451E06F61707723625B250F5551BC3D
SHA-256:	5D9E61A8EB8C57CEACFC7D0999A06DE091FDBA3AB80543BC60806995426BB572
SHA-512:	03FB43E1AFD79379BF5ACB91C3EAF46D6CB7445436E728DAE73D3F28971199ED67DAD4EC5250AC09C98815B8EECCFA1EF9773FF9F2E4727C45E09C18EA026E1F
Malicious:	false
Preview:	....................`....[N....:.}.................p....;..H...<.......l'...&..h...............hN......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......T^..........`6..@....,..,"..\..../......@\|......0...L.......}..lZ..PU......(........$...W..p...@...................4/..x....S..(K......,...........l#..............8...p...........`...<m...n...j...+..`-...(......k..........z.......G..`I..4.......h.......0a..............T...<.......0....... ...L...........................$..................$..,....c..Le..x`..p!......dp...h...b...&..p'..(....2......H(................. .......(....g..._..8... ...h...`.... ..................................(...........x...........t.......T...........f..(....9.......6......(-...;...............\|..............8l...m...i..(...l,...'..............\...t).. ...........................................................<...$...................?...7..............h...4............v...w...r..p_...I...2..`o...t...a.......F.. ...........<'..........8.......$..............

C:\Windows\INF\netwtw04.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x188c8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	217836
Entropy (8bit):	4.219298256344949
Encrypted:	false
SSDEEP:	3072:Hzd4vIO3lJUNPXavY3dmYmIYAPN4uUP1fBmPr2bHOA7vIs4hu:IethN1UP1fBmPr2bHOA7viu
MD5:	43D56DF861F1B978A459989B8E812C29
SHA1:	519263FB3CE56262A28C279ABCA4CF555829F9AA
SHA-256:	625C75E60DEE21E6B4CD3C1293F79525A6AC143E2A470E971545B0037F641FB3
SHA-512:	53CD602601E7442BB24D187AA201EDC06CA0A54177053A4C9F29053991D24F8092D0052129E14CB5728EBBF85E32F620E70AEEF5BB53A478E749F361AF184D2A
Malicious:	false
Preview:	.......................[.P....:.}.........8...a..........p....v......d.......h................R......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........%..`#......\|q......<M...'...!..................0....t..._..l+...z..........86..X_...G...z..l$..........4...................l$...&......p.......0...P...0...............\...dk.../..pS..........dR.......4...m......$....D..\...l....:..........x........t..<............v.........h...`q..d....-...x..$................o..4...........x...D...........\..<I.......(...q...............f..L...........8...XY.......i......(`..l...l!..(.......T...$}.......z...1..d%.......&...]...,.........................8O..........x...@....R..........Xt...8..Di...#.......................6.......b..t...\.......D....s..l....A...+..............8........s.......P..4...........T....e......._...7..........D.......H%......$...0... ...@...............?..(...........0 .../......L"......4y...c.......K..........HT..8t......@...@~......0.....................`...........\|...(.......

C:\Windows\INF\netwtw06.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x12d70 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	165348
Entropy (8bit):	4.1553809398806765
Encrypted:	false
SSDEEP:	3072:NO8YrWgP7+/ZH8dY3trm+lkCSiCSCiCiySiSiyCiyCysSiyCzyCSyCSiiiiSCSif:9gyrm+Ff
MD5:	A09962E2F36D3D5833C134F86F2C4720
SHA1:	7630389FB435D5C5869537630B3259B1C55C519B
SHA-256:	D6C382E2A6D77DA5C17A34A8AE942611CB3F47DC685E9FFA706E51A7BB0AF758
SHA-512:	8833CBE8C8E350D298E3DABCB68661050B35328FBEA63C8E3F71117D6648E65A99F51C89954D7C56F2B1765EEEE5D7B0CCBB42C36F42F3E4BBC579A232B63987
Malicious:	false
Preview:	....................p-... T....:.}..........,...............B...X.......u..`...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......l).. '..........d....\|...+......0....................................a...h...J..............,(......d+..................@........n..........L..........0+..`#.......x...h......8...........D%..............8.......d...@"...~.......l..........8...\.......T...........\|...D..............$...pb......4....w..........D.......,s......./.........T...x....P...R......<....\|......H,...................,...,..`...............,l..,%...i..........................p......P*..........Hi....... ..........H...L................+..........................................\......................................................................\|'..0....}..T...................$..................(...h....).......!.. ....$...y...z...v.......................#.......!.....d.......0................{.................. "......t....+..l+..@................ ..X&..l!..........

C:\Windows\INF\netwtw08.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1b7c8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	227612
Entropy (8bit):	4.308412194661276
Encrypted:	false
SSDEEP:	3072:Yfbql5ihWxQ+YstxJ9YXij6bPMwul9B4LL:qfyEEwul9B4LL
MD5:	67E347E14B92507DEBAC0A2ECDEACDC9
SHA1:	393A6B50A1BDC424F6B1D8D7472403D4D437B2AF
SHA-256:	4208730532380C8E943CC4AF32067ECE355BDCFBA44D51B4CCF0D0B6C22DAC5C
SHA-512:	9B44815FF9BBF2BE3113B0895846F81C94AA15651C9D121377D75A14212ED026EE929D5A6A332D1A5D29CEBCF62C0F996619CA859D19C05AF90794CE44FA9CDC
Malicious:	false
Preview:	.......................}.U....:.}.........8..."...............p...?.....P...h................y......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......P0......<................4...,..........X........y..x....}..............L......4....P......./......P4...(..`V...].........<1.......;..HE...1...@...R..@...D..Pb...Y..........DY..tz...........Z...:...^......8..........t.......,...L......0...@#..8...8%......................`...H....!..4.......@Z..\%..<O.........x>......<............%...A..8........E......(v...p...$......,E..DL..............0...(............8..0...............@.......T+......T...d.......<3...Z..................P...0a......L].......I..D5..h....................a..4..............D...........8...T...P.......l...P...\|..............T....................X......( .......,...1..............8......`a......`....%......./..HS..p.......d+.............................T....*......h(...,..p...D........3......XN..........4<..........................t.......\|...........0...(.......,.......

C:\Windows\INF\netxex64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5b28 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	39292
Entropy (8bit):	4.011782138597954
Encrypted:	false
SSDEEP:	768:uyCLDYaJwPjKx153a7hgY3nzNEUgIWc39uHN2tS:uFoaJwPG147hgY3nzNEaWA/8
MD5:	4B8AABB5D8949DA5B28319F529879DCD
SHA1:	B5C5586B314A03FD9D49D4D9A6798B6449D83ABB
SHA-256:	FEA9EBC0FA4B62E589E2212FA913D75D06A33F59AE2C13714926903727E49ED6
SHA-512:	F824FC5857423A218441C17E57E656F2759134BB3E1B2188F1BF5A9B3BC67762D92DA0ED89C842FA91E054A42AEE5CB01D2CB38373E30737092985F0095C2F6A
Malicious:	false
Preview:	........h...........([..,.......R...........Z...... \.......^.......n..\.......h...............x.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........J.......T...............)...4..........T.......`H......(I...........:...>...2...........,..l/...<...(...........D...............;...Y.......?...V.......O......<P.......*..@...XU...V...........@...D..pA...C..TT...?..(U...W...........P.......P......86...B.......7...7..........h>...>..................l....................................N..........tB...............(.......Y...............E...............@...K..DL......PV...?......................D...................4O......P........A......\B...................E......................0+......(...........0>..........................lM..\V..0...............t...................PW..(M......xN..p ......$T..HM..................(............... S..........xV.......E.......................U...W..................4@..x.......DN...M..................xS...............Z...Y......\................N...........3..

C:\Windows\INF\ntprint.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2038 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	14596
Entropy (8bit):	3.7420155825787136
Encrypted:	false
SSDEEP:	192:sK4dfss/LYQuImRHpwEXm573wogKNd6YNg57JTnx+dizQQUOWdz:L4WICXmngbsg59Tnx+dwQQUBh
MD5:	F1FBE842BD35281CDE1F89B01655AAB4
SHA1:	F35995447BCCBF7207943AA3616A77C3F5D1A46F
SHA-256:	1B65EA800EE22CF9AA124B1D2D44BDBB0B8E1370FC847EDA31E0C260955CC5FA
SHA-512:	53BDA23744365066257ED11ABF7960474C126AF2A23CFBE592900CE5C3B222097BF4CD1922AC631E936CA72FB5300FEA12ADC62B3EBA83E0B63E6F2AC415F623
Malicious:	false
Preview:	................P...8 ...../....#..............0....!......H%..T....+......P2..h................9......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......4...................<....................... .......H.......4...................................................@...................................T...............\|.......................4.......................................................$.......................................................................................................................................................................H...........................................................................X.......P...................................@.......................................d.......4.......P............... ...@...........t...............................................`...`....... ...................................................................................................................................t...............................D...........

C:\Windows\INF\ntprint4.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1330 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6652
Entropy (8bit):	3.2929918987540145
Encrypted:	false
SSDEEP:	96:SKyAs8N/JCYBw/Al6EX/sRR/1O1K81Y1sB/DyyZEV:5T94EURoBFEV
MD5:	52B040A6B2378D845BA2FE65CAAFAC50
SHA1:	FDDDCF0931F349BBEB8DC89966E2B4F0083A4768
SHA-256:	E3A41F12DBCB22CB3020152684BB0F32AB1AA2C1428CD5A9AEA34AA179367E53
SHA-512:	8812C2BC999B4B30E5C0B449F99EEF4BBDDC7C3054197788A0EF3DC3CA929EC60EEAB00FFBD22CA13BB4FC881416A70D2B641377C2D6F86BF69F818B6D68CC8C
Malicious:	false
Preview:	................H...0....../....#..................x...........8...........`...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................H.......4...................................................................................................l...p...$........................................................................... ...............................................................................................................................p...........................................@........................................................................................................................................... ...........(...............X...................................................................................\...........................................................................................................................................................................................

C:\Windows\INF\nulhpopr.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x69d0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	35812
Entropy (8bit):	3.980072415273248
Encrypted:	false
SSDEEP:	192:6jz3YmNHiyTxlPkH9g4v+ZKI2Mn1DO5RcCyNF2u2+VWIxwuveKQSQ4p1U+RWAUHr:6j/qGR+viHfvYjZWLJ9s8Fzhg9
MD5:	0AA31A1716848A9E7A88F25B51C3A0A2
SHA1:	EEB55778221BD43362641E41377AC7BFC076B4F2
SHA-256:	B679CFE814B335E42D2FC9A032BB77038966833667D459AF222A60572D93444D
SHA-512:	878B2A5E34B8EC71D7AACE1E94CFE8776D14322EFD6A8E5E1FB5A40F62B103E554306F5D2AF3CFCFEB303833E0210D7B3ED99EBC1C17C366A2722591CE0A8ADE
Malicious:	false
Preview:	.....................i..._......#..........@i.......j.......k......Pu..H.......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......d%.......&..............8H.......?..p1..hA......HB..........(C...................d.................../...........................i..............\?..<@...A...=...A..H...H1...B...'..H(..............H.......@...........8....................c..........hb......4f.......................K...L..,O..(....R.......S.......0..........`K..@L...N...P..`R......@S..............\/...*...g...................h...............................h......................................`c.......I...b.......e......LV..$X...Y...Y...Z...[..4G...................U...W...X...Y...Z...[..p\...............J..x9......0g...8...E...Q...J...S...F...... 5..D4...2..h3...6...5..............x).......`...........................................H.......................................2...........3...<...>...?...T...L..\|V..TX..@Y...[...U...\..`+..........................h]..................

C:\Windows\INF\nulhprs8.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1a28 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	10140
Entropy (8bit):	3.4940560661199487
Encrypted:	false
SSDEEP:	96:49EXsodxJqVeVykLdvalB47GYCJZgd9FdFo3rtH5N:42dvqeVykRvalB47GYaid9Fo7F5N
MD5:	588050A2FF08F22B98998430DECE3F91
SHA1:	98AA21C81EEEAAC1972435CCA1A18C87AF165BBD
SHA-256:	659445105D5EE1C6A4DD4EA68C8FBB3A94F72C7BFF1F99087A8821E370218D02
SHA-512:	307CDDD3E6FB2C6C47A3CC78C18111A6328D09584025C579C539DE38D9987CEE49DCFC919C19BEA5C95FEB97843F2EA7244818C33D8ACD83B1761D5524473C7C
Malicious:	false
Preview:	....................(...._......#..............................T.......H...P#..h................'......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......t................................................................................................... ...........................X.......................................................................\|...........................................................................................................................................................................................................................................................................................................................L...........................................................................................D...........$.......h...............`...........................................................................................................................x...0.......H...........................8...t...........................................

C:\Windows\INF\nvraid.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2e28 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	20324
Entropy (8bit):	3.9445725781505048
Encrypted:	false
SSDEEP:	384:d0rPSuy07dY9q7aiELdSy57Tf8af8PaTS:d0jSuy07dY9q7aiEL0abmaTS
MD5:	50300BE43B4C5CFE74AEEFA54CE6F69D
SHA1:	415C6FD1268FF07525AD1A67DC0CD20775041E0D
SHA-256:	7E5884AF453BDE13E4E7B7B7C2EB643A7B541D658ED73A645A58C5EFD717D5DE
SHA-512:	8AF22DB49FEE88B3ACCAB0C886F1D033DA47C4B42F6CB34A222AAC39141B216B6BB724FD3DF1EB6EBFF46DFD0B20B98FCC30B89B4E662BE2616A036E22410FE5
Malicious:	false
Preview:	....................(..........R...........-..#...@/.......2..p...p:..t....D..h...............`O......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......@"..........................0*......................h'..............................................\...........X-...........+...!...............'...............................'.......+..........\|-.......'......`'......$'...........'..............P(..p...........H!..........\&......................................................................................,............................... ...........................d ..............H....................%...........-..0...........<...............(...........................................................................$...............................l........................................................................................!...................................+..."......................................................................H...........................................

C:\Windows\INF\oem0.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1158 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	5884
Entropy (8bit):	3.2371844570100414
Encrypted:	false
SSDEEP:	96:16T0jnDWLlB99JB5HaX/cC3wJRV69XNRV1wzenFWhH:sCyZTbHi/t3wJRI99azOEp
MD5:	67CFE07DB6CC22455751BDB919018122
SHA1:	D446CF5F061EBC31CDF9DBF37B5FFF4B5C947C63
SHA-256:	F6A9E3CB6922783E63B19407AD36017D467AEC77A39399F906353A87DBE6DF55
SHA-512:	33F3B726D0E234B1AF69701D238F680A23CEE4D3E7CC01997D8B8D1FCA2196B41D0753D9F5D4DB0C79E21247FA7124A33DB6570143EF052E4046C92F8A53A5CE
Malicious:	false
Preview:	................H...X....d..................................h...,.......0.......h.......................C.:.\.W.i.n.d.o.w.s.........................................................................................................\...................................................................\|.......................\|...........................................................................................................................................................................`.......H.......................................................................L...................................................................................................................@...........................................................................................................................................................h.......................t...................................................................................................................................

C:\Windows\INF\oem1.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1100 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	5740
Entropy (8bit):	3.199970379253896
Encrypted:	false
SSDEEP:	96:EHv3dP0/4NEIOCmXjmUVMiF6/XdRP1j3CncekSDzD:E1vEpr6m14/tT3CcWDzD
MD5:	83E7919076F68B695603B68087850F0D
SHA1:	CC62AC3B29FFD890EACEC17C8B4D8187B22E33BE
SHA-256:	16EB9FD7D2DED1356EC86AFC9FDFD0DCCCBE195E1998F40F90C84402B0878D27
SHA-512:	9BFC4F9A488F7983CD7DAC6C690EE7ECD119B01E90DA50126C5287ECE7D9A722F71501A1451466CE25F173E3310C3037F5AA87DFB1C3F6A4A7EE6CFDE495CCCA
Malicious:	false
Preview:	................H..................................H...............(.......H...h...............h.......C.:.\.W.i.n.d.o.w.s.....x...................................................$...............................................................................................................d...(...........................................................................................................................................................................................................................................................x...................................................................$...............................................................................................4...........................0.......................................................................................................................................................................................................p...........................................................

C:\Windows\INF\oem3.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1210 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	6284
Entropy (8bit):	3.2100983993529915
Encrypted:	false
SSDEEP:	96:f4rgQldeZTQNXS06QGz9M1w1y1OvZUuQSCUJ:8deZ5Q4dZUK/
MD5:	4044229A1A1080F0821B08C973BC50ED
SHA1:	3618F84ABFE6CD406449481D4B4DF998A805AE3C
SHA-256:	18BD25330F45288B8FDDB4F1044C41E380ED028F1028B2BC603D7E065714459F
SHA-512:	C5B7CC50A44D34A41346C3F9CC5F5C56DBBFFD8DE8EE6CD607AF6F25BD88E991DF06D83F247B1BFA84CD3F113284741A8F08F0890D83BDF71AE707C1BC4B3C43
Malicious:	false
Preview:	................X........K.}........................h.......p...D.......d... ...h.......................C.:.\.W.i.n.d.o.w.s.............................................................................................................................................................................................................H...........................................8.......................................H.......................................................................................................................................................................................................................................,.......................................................................................................................................................................................................................................................................................................h...............................................8...........

C:\Windows\INF\oem4.inf

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	4333
Entropy (8bit):	4.760587896237931
Encrypted:	false
SSDEEP:	96:I23N5XHo7pnFhdhEykjSY/BR9Ch60jelHWVx2IscstJqM1pMJM1McMrMZM9iDCZ/:pnX0hFhdxwIh60jel2Vx2TcGJqeEO9qR
MD5:	FC97A101113D88276C58400BBA7AAF77
SHA1:	814D0C9FBDEE6B3DABA6D18389536FDE536D3B2D
SHA-256:	20B44F3859A6FF1B7C644FC90CED4E7AB37CCF5CB50EC21D59A92906932A4842
SHA-512:	616AC0EB0BF54E4EFB94B9CF1A301E8AD08F13D7477256552BE616D450DB84614A3A7E5376EC7D3FC11E893C38CF578EB826FBF156B17B2CF48E5004470E5BDA
Malicious:	false
Preview:	;-------------------------------------------------------------------------------..; PANGPD.INF..;..; Palo Alto Networks GlobalProtect Virtual Ethernet Adapter..;..; Copyright (c) Palo Alto Networks. All rights reserved.....[version]..Signature = "$Windows NT$"..CatalogFile.ntx86 = pangpd.cat..CatalogFile.ntamd64 = pangpd64.cat..CatalogFile.ntarm64 = pangpdarm64.cat..Class = Net..ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}..Provider = %PAN%..DriverVer = 03/02/2023,16.15.20.869....;-------------..;For NDIS 6.x..;-------------..[ControlFlags]..ExcludeFromSelect=....[Manufacturer]..%PAN% = PAN,ntx86,ntamd64,ntarm64....[PAN.ntx86]..%PanGpd.DeviceDesc% = PanGpd.ndi, PanGpd ..[PAN.ntamd64]..%PanGpd.DeviceDesc% = PanGpd.ndi, PanGpd ..[PAN.ntarm64]..%PanGpd.DeviceDesc% = PanGpd.ndi, PanGpd....[PanGpd.ndi]..Characteristics = 0x81 ; NCF_VIRTUAL \| NCF_HAS_UI..;For NDIS 6.x..IfType = 0x6 ; IF_TYPE_ETHERNET_CSMACD..*MediaTy

C:\Windows\INF\oposdrv.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x17e0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	8260
Entropy (8bit):	3.4762251440026333
Encrypted:	false
SSDEEP:	96:h42mz1wjUwkE4cSmOAxYyhnU5Jl1hcCf2RGaA0TrwLi1WIGNudUZKMF3+p/:h5UE4c0MU5Tf2JWIGAUZK1B
MD5:	F1DF41FCE475E3453B847FF32C787121
SHA1:	8AFD1C14FC8F658DE6721C76F3FFCD7A8209F7A6
SHA-256:	0FB2C82635AA276B31ABA0500AA7E69F5D65AF4CF6F67E69F47BB292A36148EF
SHA-512:	0CF7B1AAA20BBC8BD522DFC069B9CDEC2062AA4337567A2080151660338B90CA0B425509E07DF0FF107365B6EA8C585DADB23417C337945593903C7F681CF117
Malicious:	false
Preview:	...............................h&..........P...........h...X.......0.......8...h...............@ ......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................,...................................................................T...............................................................................................................,...........................................................................................................\|.......................................................t........................... ...........................T.......p...................................................................l...................................................................8...........................................................\|.......................................................................(...............................<...........................................H...................................D...........................................

C:\Windows\INF\pcmcia.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xf368 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	90108
Entropy (8bit):	4.122536375077057
Encrypted:	false
SSDEEP:	768:BLWJnIEMpSYtGulVbAo179EgGdjupeV7EQf2ODxom2WshKbmLAj:BLinFCSYtHlVbAA9EgP3MBDemkkmLAj
MD5:	167A2FC4DC4E66FCEFB91A26349EFE37
SHA1:	8254B9413637918D57EB7999EBF40A01B3037072
SHA-256:	D58078DB4D32EDC81D82BFC350E03D40E5E3C61D5276CA6DE54350D9A53A90E2
SHA-512:	D15400296DF85E668534FC058AD44AD9DDFAABDF931D66D16DF8BA74FA1238792CBEB7CCED1C43A098AE040FD932456805A945EF58FA0F71314DD0B8301A1128
Malicious:	false
Preview:	....................h..........T..............a...h....................#..`<..h................_......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......@j..........................(.......l...p....h..................Dl..................................H...........d...@o..........(...............H......................@......................@.......L............g..t...p...................................$a..........H........l...................................i.......................o......L...........,...\|...T.......L...............d.......p.......`...l.......l...$...........................x.......$.......<...............P........................... ........j...........k...... ...............8...................................$...lp..\q..........t.......`....l..........l.......<................~..X........~..\}..........\|{..Tg..x...l\|......<\|..D...X...............T...........l................... ...t...................................,............j...i..\|........i...p..\w..................

C:\Windows\INF\percsas2i.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4ae8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	27796
Entropy (8bit):	3.994968845679463
Encrypted:	false
SSDEEP:	768:d5x/y9GDPYN2DrVDSbyURZo6jrKh+zv9A4zNmoz:s9GcgMbyUTo8NzF3pmoz
MD5:	C5DA391189FE45BC78F14BBB7EBE7462
SHA1:	850DC2FAB1EBAF4DDAC12C901A36240FC1F5237E
SHA-256:	82C2D02BFB1A30C14E1C95CEAAF3E7F0DBF4C972E873318A849CD62713E80DBF
SHA-512:	FB8D1F6E3B0E0638E13952A7CF73B506E3CA83DC400940DF2B26DF8D4DAAC42C300CC7DD05FAD02CA18B41AAFF54BE69398596113EBE3DDF7DC45CFA23A42737
Malicious:	false
Preview:	.....................J.........R..........TJ.......K..\|...`M..`....V.......a..h................l......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......P,...............................C...................$...................#...........................7.............. :...........&..............(...................<...."...3......\...............T.......,,..............d-..@...................p...(........................;......\#..........<....D...............................).. J...........+..................(........B......................."..........<...H%...........#...........&..................T2..XA......................d............0................... .......... 5..............<?..........L...............................d+.......................5..........P....?.......G......................T%...........+......................t.......X,..........4...\................(...'...E...........................%.......+.......#..........$...H8......\!...!..\1......0!......@7.......*......L:..

C:\Windows\INF\percsas3i.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3088 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	18220
Entropy (8bit):	3.947832740780104
Encrypted:	false
SSDEEP:	384:TfBuq7TfMJ5OCfnQYEG+wEo4Jg/n8WWRWG8:LAq7Tf9CfnQiuoFOv8
MD5:	7A39A9E1E774AD0D419C2A5CD1579A3D
SHA1:	FF518DB792B5604C76C7FA3E4D309DA5216E6A10
SHA-256:	4B58DC948299DA4F7AEE7EB027ED0F9CCF85680B37C624C3DD8756F458E32794
SHA-512:	F6A8BFAB514DEDCEDE76F04E5C4B85A2F020C0978D1F4916FAD6BBFF9AE20A781F3F8E35C7D88560BFBC2D6C22498D7D0769C471E9B6BC1FD9222BD74AC89C61
Malicious:	false
Preview:	.....................0.........R.........../.......1..\|....3.......9...... @..h...............(G......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........!..................l...................................................p...........................<...........................\................"......................H...........@...............8........!...............#..$.......................................................`$...+...... ......................................../........... .......)...................................................... ........................................,..............t%...#..............H........................................................................................................!...+..................L.......p-...............'..................................T!...............................!..............................D...T...............................x.......\|!..............................D...............................\| ..........

C:\Windows\INF\pnpxinternetgatewaydevices.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x12f0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6492
Entropy (8bit):	3.34031387095212
Encrypted:	false
SSDEEP:	96:YMhGZcE8u6C996z+hiu9zu7QwexBDpMNp0S7deAUi9:QB9wSiP7ex4Xz
MD5:	3E7DA33268C8EC2D960AF4D0A18B4FF2
SHA1:	E2E490818F558607730F431DCE284B91B47A2338
SHA-256:	9F5A8578816A7C1DA58F2B49EE882A9AC542B68FF3DD258615E18BF180352C7E
SHA-512:	92BD78F81C72E469448EC9C021122BC04342262B3861EA1AF59084E9909DD522B2174FE7088880DA2A1D1170C84A7052B9A3EEA74568279922943DB275D60FD8
Malicious:	false
Preview:	...............................HR..........`...................\...X...........h...............X.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......t.......................................p.......................,...................................................................................................................................\|...........................X...................l...................................................................<...........................................................\...................L...............................H...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\prnge001.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1990 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9260
Entropy (8bit):	3.611382448955265
Encrypted:	false
SSDEEP:	96:KlDqH6vBPoMVIBngVeBgP+FxeUYiAq661XesReuCtiP1G1e8191FTqlQx6/3fXzp:KRI+eVxuVq/1uGytrTqyx6/3fDXdAm
MD5:	06246993BFCC7E5B213FCF35217E05DD
SHA1:	14C4165027BA099666089C7D32ECB8E4E738FB6E
SHA-256:	05E25127E1C81AEC4D4637F9BB33303C22D23408DCDB0569963A3A6D904AA429
SHA-512:	135E1B1F4B2F7F3079491CE05EAD83630FF0CB75C16C02C00B2A512194E2DC7BF83E7EABACDF26C3026049BDE7D85B1D38C999F5D6297368FD557E53AE03D749
Malicious:	false
Preview:	.......................................................h...(...L...x.......P!..h...............($......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................H.......4...............................................H.......................................................................................@...........................................................@.......................................................t...............................................0...P...............................................................T...............................................................................................d.......................................................P.......<...............................................................................................p...........................................................................d...............................................................P...........p...................

C:\Windows\INF\prnms002.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1370 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6860
Entropy (8bit):	3.3456688007718647
Encrypted:	false
SSDEEP:	96:ussRRLK6f3l6FXUNAERP6Nefu181fk81Y1so1GBGql:76vYFkfl7o1hI
MD5:	BB33345728E00866CCBA8E3E2F5EC118
SHA1:	5424A8D0AD9C7D7CBBC2CEC5F423CB14C97B4627
SHA-256:	0A29CA2F02E5F16BDCFB4ABCA2B68E9D01391415FAB80CD75BFE22CC19ABB6EF
SHA-512:	C5EB61FF59528C5A279A36A8CF0703C7ABCD880A14F7BD30B60AF06807523700ACBF175159E55597A35C9B0709F9FA89F59C5AB0A8D456E7A4842E6C208603F5
Malicious:	false
Preview:	....................p......./...........................,.......h...8...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................H.......4...........................................................................................................H...............................`...................................p.......\.......................................................T...............................................................................................................................................................................................................................................H...........................................................................................................................................4...............................................................................P...................................................\|...........................................

C:\Windows\INF\prnms003.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x13d0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6828
Entropy (8bit):	3.3480834105363293
Encrypted:	false
SSDEEP:	96:JR9G1Zh9+MgGOfBn960XITDNWRc1ON1hY1S1F6nPTObr1:eaVf9w0wWRwnPTOH1
MD5:	8AF4067C40CE52A4F074B65C392F7BBE
SHA1:	0F92B9D5D19CB58FB4A6DA73AD4C861013E7BBAD
SHA-256:	0E0B71B04D51D68729F2984D0F218478245D962FACF63D3F0CF663C386E48C01
SHA-512:	7D205266AD40F18E552EBDA620486424974CC4EBC9B7AFF06677333A0EB72AC463343D5868DAAD75425181E8AECA142030B6AC3E15625982958B959AAFA91784
Malicious:	false
Preview:	.........................T../....#..........<...........,...0...D...x...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S....... ...................................................H.......4...................................................4...................................................................................\|...............................................................................................................................................................................................................................................................................................................................................................................................................................8...........................................D...........................................................................................................................................................T...................p.......................

C:\Windows\INF\prnms004.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x11f0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6268
Entropy (8bit):	3.2660895472802696
Encrypted:	false
SSDEEP:	96:lriW3Xdb/VHL+ieSml6O8XeuRj91i1zw171B4qBJl+:TrOSx3vhR4qw
MD5:	C44C62E4283282711F60FE1B34DECA25
SHA1:	E126EA73A53B04D6F60F32AEEA9896565F7C7CC1
SHA-256:	8128E474C0D395ADB194D4F6DF634F94C9F60C822D7EE8734803FB0721632ABC
SHA-512:	0C33D58EC1CB6C648EF9066D3B4ED811BA11E4A16E8B0D821294591E522523F8538B0B1C1F2F0C7878732607A1627F0798EF863BF132471C979FBFBEB50C6B81
Malicious:	false
Preview:	................H.......il".....#..........\.......8...,...h... .......x.......h...............x.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................H.......4.......................................................................................................4...............................................................................................................................................................................................................$...................................................................................................................................................................................................................X...........................X...........................................................................................................\|.......................................................................................................................................

C:\Windows\INF\prnms005.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1948 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9012
Entropy (8bit):	3.5670169282287203
Encrypted:	false
SSDEEP:	96:dDrFPZqWPwtBbsCS9CQ6SXx20qpW1y1JMw1y17y929fKxFkX6CI:Dxl4/s1CVSB2JpGVyMKjkX6CI
MD5:	C54450AFC23AD64E5BA0C5DFCC0A4FB0
SHA1:	12F249BE006D6E45831D1D4D34741A05108EFE2B
SHA-256:	E7A1DE16E99DE5DF0290C001D868495C47A1FE4F1B32A84EBF9F5E4EBB39C30E
SHA-512:	D6FD5686B28EA40D91D62C3F5D78250D70A0531E696425FFF8F82983F8F3C355364D46CCFBE4223C8E8F469153052600B667F93CD5E938A6CFD1FF60698A0747
Malicious:	false
Preview:	................H...H...#.#.....#......................T.................... ..h...............0#......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......,...................................................H.......$.......................................................................................................................................................................................4...................................................................................................................t...........................................................................................................................................................................................H...................................X...........................................................................$.......p...........................\|...................................................................................................................`...........................................

C:\Windows\INF\prnms007.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1690 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	7996
Entropy (8bit):	3.501149267990669
Encrypted:	false
SSDEEP:	96:NhQ1cGj+Auc5tvJ66KXrh41A1j7z1+1R4xysyifPwZmgMgc+C:ILHuc5pJ/Kbhz5xys/fPwZmJZd
MD5:	FE83C191434155267C9C18BFB72201CF
SHA1:	8A4D0B415B00C0A92784845EE84EAD5C84487A37
SHA-256:	BC7B6A7A90E422E7657B5D7C29E9099512443E41578CB9D8E3457CFDA7F58EC1
SHA-512:	AD2762588517F56785A41CB6AF864FE901C0CED29A537C285B11CB8B683F6DA3C3435D854933C572733174A62D93456653E6EC4CA3C76A96CB7F5CB471EA9FE7
Malicious:	false
Preview:	................H.......#.#.....#......................@...............8.......h...............8.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......T...................................................H.......4.......................................................................................(...........................(...................@...d...........................................................................................................................................................................h...............................X...................................................................................................................................................................................X...............................................................................................................................................................................................................................................................................

C:\Windows\INF\prnms008.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x11e8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6260
Entropy (8bit):	3.2604409028632944
Encrypted:	false
SSDEEP:	48:VCdBKW8IR92J5rhMV4ZE/IR/6M632sXZR7o1Z1fsU1Hf1bxWpXe+I42L0mB:V1uyZuIxn6msXZRk1Z1fsU1/11mus2LB
MD5:	322CE9F018288BF2DDF556C83DDFC021
SHA1:	CB7BF0427C0A4DE95594ADE597FC658BB5CD989B
SHA-256:	BD7CC83D30604DE9A9263E7EDE8D5590B01FCEE248EF615D335C06CF8524C16A
SHA-512:	0AA7E2B879AE085FF1E465F6C63D8126394572841C94482160385DB8D96C221E8EC6E5BD40B247407F7080BFD33212D760572E61FE979CA023FD848C28C1E646
Malicious:	false
Preview:	................H.......#.#.....#..........T.......0...,...`... .......x.......h...............p.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................H.......4.......................................................................................................,...................................................................................................................................................................................................................................................................................................................................................................................................................................X...........................P...........................................................................................................t.......................................................................................................................................

C:\Windows\INF\prnms010.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1298 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6612
Entropy (8bit):	3.3209989488799665
Encrypted:	false
SSDEEP:	96:m4gdRQcyi+L3ZHQ6xWsXmRV1h1WE1f1a6NGp:rcyi+L3ZHVxWsWI6Nq
MD5:	35FDBC3212DCA9C3DC1219D90E1BEC47
SHA1:	3992E0AE3B16123820780440585BFB3935A28BDA
SHA-256:	DCD1D3ECBF7E7F82417BF69EE057978DDD403715619C6755CFEEE85062E9F021
SHA-512:	69F9BCB6036EC264CBA92979DDD7601433ED917C527D216E1AD1EAE7E3A9C820CA737D039894EA5E59A7E05C161A2CFA2A7EF668A418C142B1A3DA66B18CD0BE
Malicious:	false
Preview:	................H.......#.#.....#......................@... ...\...........(...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......\|...................................................H.......4.......................................................................................................................................H...............................................................................................................................................................................h...................................................................................................................................................................................................................X.......................................................................................................................................4.......................................................................................................................................

C:\Windows\INF\prnms011.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1220 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6460
Entropy (8bit):	3.2938216204809025
Encrypted:	false
SSDEEP:	96:TzLOQxWSOcreaODhi57V6XXFRiL121mBQ121D6naYAG6N:T2beeaEhi57IX1s6nT6N
MD5:	3868E90B5CD59390B89CFDA641A58B6D
SHA1:	27BC2267C1AE28D598226EF970A95F3D393FF5E9
SHA-256:	535E6126CB608CAA15129D20D09DFF0AF98CF01921E52325677217385ACA1178
SHA-512:	CC3C8E08E0877B62920E67A27718C474261A58A3EC7EC5A192C45525DCED8366B113F7BD89D997605BF3DDE49930D38930618EBB61BEEA8F06BE0E6297265DF4
Malicious:	false
Preview:	................H... ...#.#.....#..................h...@.......P...............h...............8.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......P...................................................H.......4.......................................................................................................h...............................................................................................................T...................................................................................................................................................................................................................................................................................................................X...................................................................................L...................................................................................X...........................................................l...........................................

C:\Windows\INF\prnms012.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x11c8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6356
Entropy (8bit):	3.2799284841318608
Encrypted:	false
SSDEEP:	96:hdET1XOUUpaSA3gEKb6NX5R41617E1y1L6u9SwLxS+:vE6ASA3d3NJJ6uwwN1
MD5:	66248AE565B2D22D24660C9044EC584D
SHA1:	9B59B6CB2E40237FBE4F01CAE3266AA21A703C0C
SHA-256:	5AAF89967493D97A641670A44FEFAEBBBDF7D466B28D56FCFB3479C6D0755F13
SHA-512:	A99270739562BCADE391A666E5C0012A6B361F58228D26DCF0C751278C0985EFB07BE2C8B90C69DF1FEBDDA2B0955EECB5DF77507A5D13836F3652D27769E96B
Malicious:	false
Preview:	................H.........&.....#..........8...........@...P...P...........8...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................H.......4.......................................................................................................................................x.......................................................................................................................................................................................................................................................................................................................................................................X...........................X...........................4...................................................................................................................................................................................................................................................

C:\Windows\INF\prnms013.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1028 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5356
Entropy (8bit):	3.1031581415281924
Encrypted:	false
SSDEEP:	96:KTIVnjWfMAglr8iRp5sTMpcgCs5MAZPTmF3C+R:VWkRwiTyTuhuGPmSI
MD5:	ADE757605BDC26514FDFCFD72CC08625
SHA1:	FE080D20760BC3B2A265F87718D542555DE0EF37
SHA-256:	ED28FA528AEDD8FDEA203A4B071271687DA2936E756512A3196AE21EE6A14CFB
SHA-512:	CB4CC6084B16F297DB187998C71A8E1710327978AE87A02B8E2EF87ECB1ECA47D54B215A638C098DFA1D2ACCC5BD7F5EEF66238559205F81BAAE9799B58D38A1
Malicious:	false
Preview:	................<...(.....&.....#..................h.......H...................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................................................................\|...........................`....................................... .......................l.......\|...................................................................................................................................................................L.......................................................................................................................................................P...................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\prnms014.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1250 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6540
Entropy (8bit):	3.305052280276019
Encrypted:	false
SSDEEP:	96:xpvMqBDbMSx0rZCrdVKUT3C6QqXcRh1A1Yb1c1A6hbT4w:xFNbVKUT3nbMH6how
MD5:	9F5B8924B8F51657617C75CF101766F1
SHA1:	7BC08DE1806A7F56E7225248457008BDF770712E
SHA-256:	5C969542C8A577CD1C0E1E5725121155EE79DF8A09A1A62DB51B7E9C72DF3628
SHA-512:	09F525FB42A0497797E0E1B436FA153C9CA598ED96B8986A391B9F9EA8146F76BEBC0BC92DAA7D0A5F1F6EA3C75EE43CDBCAC6E9B9FA5630FEA1AA3B7CDABA55
Malicious:	false
Preview:	................H...P....B../....#......................@.......\...8...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................H.......4...........................................................................................................L...........................................................................@............................................................................................................................... ...................................................................................................................................................................................................................d...................................................................................\|...........................................................................................................................................................................................

C:\Windows\INF\qd3x64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2760 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	12372
Entropy (8bit):	3.791222237667742
Encrypted:	false
SSDEEP:	192:UzuN9zQhRa+IDdyJT1KrisgIjsGUuVkUm6fQiyLN2:UKN/RZiriy52
MD5:	69167936A43E1C058D3014BFF460EA05
SHA1:	DF08EB7F3AACE93A58547A573C695720E4BC18CA
SHA-256:	F0093415EE2224B446A7E13E0231837FD037A1F19506D5D376F9F99C691CC922
SHA-512:	7710125749E9DD4222C26F589DD9956F27F36D53F2EE84B0F2383B978EC7A81EC39D352445B1E6BF75DF7D92B3229FAAD6AFFDAA907EE3F32AF2575EE1DB09E1
Malicious:	false
Preview:	....................`'.........R...........&......`(.......(..L...@+.......-..h...............P0......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........&......................L.... ...................!...............................................................................&..........L&...........................................................&......."...$..P%..................................................................................................................................................d...............................................................................................................................................................................................8&............................................................................................................................................... ..8!..................l"......t...........................................................................................................................

C:\Windows\INF\rawsilo.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x17a0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	8236
Entropy (8bit):	3.513539970770105
Encrypted:	false
SSDEEP:	96:59+ZOOiYPZ6JR1WRgdQE6atURW0BNNRJKRn4ORRVLRzRqRDS2pyTeDOQMp3bAGBb:92999tKFfRtk89
MD5:	3393E89FFEDB58E94786EA732C670B0D
SHA1:	ED6F9104971712F524B0FE57CBDD9382B8D1946A
SHA-256:	0F0BD22ABF8B200D358B939694C3A6F7F149F8A0ECAD0FC98A674A03CF2D9F67
SHA-512:	D5FC99AFF03111A391D9393A5458A5880225353659BFC67650600F439E3F9FD73B2553E54BF3CAF73C9D827E6C38E9ABAC8A84E7557FD58232BB0DC7E7BCEA9B
Malicious:	false
Preview:	.........................$.....HR......................T...............0.......h...............( ......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........H.......................l.......................................................................................................................................................................D...............................................................................................P.......................................................................\...............l...............X...............................................l.......................................................................0...................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\rdcameradriver.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2678 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	13428
Entropy (8bit):	3.7849507154361266
Encrypted:	false
SSDEEP:	192:EPbAanwKplsMmRMkYk+TYTABqzGmb/dmH:W5wssMNLPIjw
MD5:	A23748D3DBAAD2D8780630D680652326
SHA1:	56176B75742FBAE41A8A14D1B68F56AE79883AD4
SHA-256:	B268608CB43EA8D4A72678711733D5D42857DCFDF94017AA1DF67FA821DD89E8
SHA-512:	DFFEEB0F244E5299C4CB78CC4A5F153C88B365C5D3DA70C2C513649E4882CAE9C83FD27FC600DF6C93D6B73D3347CAC74123D1FD2DFD569C0B636AF7BCA31A4D
Malicious:	false
Preview:	........`4..........x&..._../.....6..........%......x'......X)..T....,.......0..h...............p4......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................D$...........................................................%..................,................................... ...................................................l........!......x........ ..............................x...........@%...............................#..........................................................X...............................t...................\....................................................................................................$..........................................................................D...<...............P...............................................................H...........................................................................x%..........H ...............!..P...................................p...................P.......................................

C:\Windows\INF\rdlsbuscbs.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xec8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	4748
Entropy (8bit):	3.0134693629485003
Encrypted:	false
SSDEEP:	48:+Ec7YhBp7fZaO9l1pa3n5btQRYAJHHjS6xQ1IxXZtERnoixL:3cEDp7f8OzWIRvJezoixL
MD5:	D7D92CA079BA015180F3423095D02868
SHA1:	09DD1B72E7DBF8B21D607FBE442E3FE316A01CC0
SHA-256:	70FD42F05AEB9518048ECCB5C1BAD8FCFADD8D6E1997D2FE51E21B3B63C5F8FD
SHA-512:	B787A4353F91D40A8BD3A75860A67026D52320E4F84099403407C5A1F34AA9F638ADC7FFFACCA4115387639DAC7028568E522D5EC0E5CE66065462AC8D841534
Malicious:	false
Preview:	..........................H................H...............h...................h.......................C.:.\.W.i.n.d.o.w.s.........T...................,...........................................................................0...............................................................................................\...................................................................................................................h...................................................................................................................................................................................................................................................................T...................................................................................................@.......................................................................................................................................................................................................

C:\Windows\INF\rdpidd.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x23b0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	12476
Entropy (8bit):	3.760319643016821
Encrypted:	false
SSDEEP:	192:PypbAl6S+e6AprGSC38Cs+sOgSYpcrWXkXhI4p3Y4jdsa:qqX+eriSC3bsOgXpgWXbS3Y4t
MD5:	208DC74D0BC17EFC5FA6BE830789E1B7
SHA1:	B5D77E82E2D74FD1159D6F05ED9087122475CF84
SHA-256:	2F189D82F1810B5F3A84541CBD59EF95A705365AB379C5446F812439692F77BE
SHA-512:	4DBA7785FBF93D52FC7521267D708EBF7536933AC4B242F392E1B910F7D692381AA72A639079FC5D60223F23D034491B64DE6EB9E37B5351A8481E93E8FF107D
Malicious:	false
Preview:	................2....#...*../...............,#.......$..\|...h&......H).......-..h................0......C.:.\.W.i.n.d.o.w.s.....H...........................................................................................`................................... ................................................... .......h...........@...........l...................x...L...........................................................................................8...................................X........"..............................................................................................................................................t.......................................................<...$...........P....................................!... ..............................................................................................T...............`!..............d...................@...............................................<...............................................

C:\Windows\INF\rdvgwddmdx11.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5620 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	41684
Entropy (8bit):	3.9753870085862926
Encrypted:	false
SSDEEP:	384:AwrIF1dYcFLpvfM/QQgwkvWmBcBCB6cInhkBPB9BoBMC1AVpJFVMhArBjnB/BsAU:A1F1dYcFBE/Qo1ATJn4EsA2nkur7K+
MD5:	CAFFF79E33EEBA714FCEDFC4BC39E0B0
SHA1:	EC70A92A0177F52C87A02AC85F76B9BB4E300AC1
SHA-256:	9001A8D1A748439D4FB66135C339370B54E13620AD2EC581248BCF637D509926
SHA-512:	8486E92D0A8AAF9061CCBDD93CA782FFA7CD6FAF24D1237EEE52D67089A345A4215785C4F0560AE0D8B3060EB682A0E3B84F40BFE42C9CF3908B5194CBC25EEE
Malicious:	false
Preview:	.................... V...j./................U......8W......@Y.......h.........h......................C.:.\.W.i.n.d.o.w.s.....D...................8...@................B.......................&..............."..........@....J..x...l...............................................$ .../.. ....G......0....U......(....2..\|....0..\=.......5...............Q...D..(O..................4@...................................M..............................................p1..................................L...d=.......T..LF..$D...1......@F..4F...F...,..l,.......,...........................E......................T ...............!..................,...(........<.../...........:............................... ......(F..pF...F..\|F.......F.......!...... ............................D..................$P..........................8+...............3..........(.......................l............!...B...F......................4.......HU..........l...,....................D..xP..\................E..........

C:\Windows\INF\remoteposdrv.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x18f8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	8652
Entropy (8bit):	3.558221532079207
Encrypted:	false
SSDEEP:	96:YJgKFK7LpmQIFO409TaQt15iGDo78bgrV0/QkL3vgNW0h//9:KItIXc2EiGHbFsTr
MD5:	63666C354DC095E531F5E316121F870D
SHA1:	7E54544090E710CD1BAFB915CA7A4FA24D747F4D
SHA-256:	B51C88FE9F792FB7C93D320A9A76FF7F245BCB49CE04EABA904D862778230BA8
SHA-512:	BF216AAD0A504D5D16376E42970B45B35FA7062D0276C25491E50106726AFCCC081050EF90E63FFDC7FB4662589784BC999F3F71224CB67466A89AC37172CF1C
Malicious:	false
Preview:	........................Z.{.....3q.........h...........\|...........x...$.......h................!......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......T...........................\...............................................................D...................................h...................................................................8.......D...........................................................................................................4.......X...................................................................T.......8...................................................................................................................................................................h...........................................,...............................................................................................................................<...........................................@...............................................................................

C:\Windows\INF\rndiscmp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x11e0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6268
Entropy (8bit):	3.2483468434100207
Encrypted:	false
SSDEEP:	96:Dc+jHWWT1PRiokN9wXt59PqfeNmKeO4QXE:RVPiJs959Pqfe4yZU
MD5:	E20210B183DC605B32F5819EFA59C7CE
SHA1:	A5F617A48811E1C0289A0D8B2E9701FC9905CF67
SHA-256:	BE9BCE2FCC826AA510BC1496C2005FCA1984B593DDE9FD5957EDD906A99640CC
SHA-512:	15ACC3E0E17D1B2067CB69A03C3F9F935FC5D46000E3D1C30C2C396238E67AD719C9EEFC738BCA17AAC9049F0760737EC6C512393F618377225AB6845D23F54D
Malicious:	false
Preview:	.........................-......#..........L...................t...............h...............x.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................................4...............................................................................$...............L....................... .......(...................................................................................................................................................................\|...........x...............................................x...........................................................................................`...................................................................................`...............................................................................................................................................................................................................................................................

C:\Windows\INF\rspndr.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xed0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4900
Entropy (8bit):	2.9976090700590605
Encrypted:	false
SSDEEP:	48:pEPd1OUPWb5vx3pQ/d25vyzUNduxoaaw7+O36gS3rl:pEPzO71lpQzLx1ajO36g0l
MD5:	E999158EFCDC3510765A339FA835828B
SHA1:	54D5B8D14C69A441CF136D0C47169EFD7D2A9593
SHA-256:	6D215BF7ACEF1B5D91DF33AED2296E7661EDCF5DF0E61B825D52B143EB7F1C5C
SHA-512:	55FCAF93905B4540E8733192AF282F95C52DD87A148BEEB97A05DB2E838132EB972194E59C1EE3598B1FEEEA64C085EA691049B306AD548A293D22365C22E23F
Malicious:	false
Preview:	..............................4Ne.........<...............`.......0.......(...h............... .......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......................T...................................................................................L...............................................................................................................................................................................d...............................................................................................................................................................................................................................................................................................................................................................h...................................................................................................................................................................................................................................

C:\Windows\INF\rt640x64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x13948 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	159188
Entropy (8bit):	4.2808196139301735
Encrypted:	false
SSDEEP:	3072:EkqgAMMUDCEsJnTCesun7ICkMKTyS6UfRGUslw0Rv:/uEUWAw0Rv
MD5:	A03DD277764BC84E5FAC6A02DE3B25DB
SHA1:	CB42F95CD1B2DA38F95970DF596895E868333E5C
SHA-256:	72AD2A305E261028D10F098FFF7091834E3C60B1037E729092D94F68156FD039
SHA-512:	A98629B4547EE63500C856EB9A0325167C4AF9303561CCF1D8627EB494D8DA9468EBAD97FF40B0F8B06B4D3434B0AEED33E21AE3BF1C0A7687435E887C58E408
Malicious:	false
Preview:	....................H9........4Ne..........8......@:..p....G...P..P....j......h................m......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......0h......$...P.......H#...7...?..................$...0...'.......................$......8...........@7..........\...@.......P...................,5...%..........).......5......\|....5.......F......t...0....,......x.......,............1..$...`!...r...e..\|.......\|... 6.................P..........D...t.......P"..D..........HK...........)..l...........x6..(...d...H<.. ...,8...E...f......Pf...f...............................h%.../...t.......)...(......L\|...\|......$...X...\|...d.......t..................L...(....8..............................................8c..4...\.......................H.......X...L...$...$A..<B.......A..........p...@...\|... ...............(...H............%..$D..........l...................lD.......?..........p3...:.......5......`...P.......................@!........... ..X........8...7...........&..8d.....................

C:\Windows\INF\rtux64w10.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x8f48 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	71204
Entropy (8bit):	4.03764794015724
Encrypted:	false
SSDEEP:	1536:s+Nud5W3krjlnOPv3nJ8RAjceZCg8ubNscUQfeYe5p+hhv6r2dApYewuHa+HlCMO:5Nud5W3krjlnOPv3nJ8RcceZCg8ubNsa
MD5:	F5D9DCCA804254866760B2162FDC7A10
SHA1:	00AC175D0F97FFDA1DF2412C346EDB2FF6615923
SHA-256:	440A1B7D21CF9B6329CD01174FD1340958D051F422968C4451A3A6FE8A05B6DF
SHA-512:	F1D803AF61E7019A6E1AF612F27FE76374056A05F8FF5A6477CCC722D295914A0F3E54AB6AEC7712CFAD8F2D68093F32E67BF0111F59B3144B5F652F07E7E6B1
Malicious:	false
Preview:	....................H.........4Ne.............H...X...........(#.. ...........h............... .......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........K.......................5..l=..........H?......8C..lF..lz.......]...G..........L....S...T...U..`V..P5...b.......................f......0...............}...l...}.......7...............2.......e..l6...f...t..Lr.......e..h....%.......j......\~...m.......m......D...Xh.. p...'.......\|..8u.......k......@`.......n...2...:..........Tr..........,8..t........3..L3...3...3.../......x4...T.........,..........@f...e......H'.......b...............-...............................i......$3..`3...W...3...C..P4...4...4.......(.......!..................l'.......7...................`.......Z...k...............k..........P-......Lf...R..........\........(...i..h+..p...lm...U..X1.......!.. h..\/...........h......d... 2..`o...9.......n...6......T9..............0........e...$...L..."..............P.......$...........$...\|...8.......`0..L,..........(...`....p......

C:\Windows\INF\rtvdevx64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1178 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6076
Entropy (8bit):	3.243190190087086
Encrypted:	false
SSDEEP:	96:qSBp8u0J3sr0txx6kByERIzRRDw70uK5fQZiYLf/Z:qSQuCbkkB/8n5fdYLZ
MD5:	07AAC2C9F2BFA97F508B2F50E0EBFDF6
SHA1:	0C710232B98271FC17367CCD88AFAE3C44E7A5AE
SHA-256:	B7C50581C64472031658092183B8CAB5D62A2A06E0DCE99A714D7CBFFAEF382E
SHA-512:	2671D70F693ED616CA143D360512F7D9D39B95C923D37F33B3391BB54615BCA3F0D48604F629F5199DC625C1A7193658DC42D0545E8D0E333856E4F3A7E50979
Malicious:	false
Preview:	....................x....5Z....:.}......................... ...t...........(...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................h...........................................h...........0...................................................................................................................................................................................................<...................................................................................T...............................................................................................8.......................................................8.......................................x...........................................................................................................................................................$...............................................................................................................................................

C:\Windows\INF\rtwlanu_oldIC.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x131c8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	134220
Entropy (8bit):	4.262067785773286
Encrypted:	false
SSDEEP:	1536:V3PhuF5IUC0/3krI5S1Ca5e0DkYqMa296XR:VZdxTrI5S1zwmi2W
MD5:	26AF933658524DAF6601820DED3DF271
SHA1:	39DF546273C827785BA798DF95671A3569C5F53C
SHA-256:	DFD77AA1E9097D278572FA1384E1C1D59F1CFCD5C265EFBC7EECCDEF01F1545B
SHA-512:	79CEEC6A14F4345B0B3403F8FE66A7763DC740A8C4418709DA04568C18757A3ABDF1BB4FF9F8AF865B0E82703A86BC16293589130045A869E077F7F2979597D9
Malicious:	false
Preview:	.....................1...#b....:.}.........81..j....2..H....;...:...u..DK......h...............H.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............4k.......K..L.......4a..h...(.......................d....'..4....2...........@...$..........p.......................0h...........................%..l...........................................T... ...\...T...H... ................W...........c..,)...\..h.......8N..p...(...<....s..............................$ ...............U..,......................<.......X....0..................................-..,8......."......0L..45.........H...x...."...+..........\,.......&..('..Xr.......'..p............J..........h`...........?..............L...4v......H............B..(@.......)...........,...*...$......d............... ........]...........!...............j..............`...8...........\|...Hn..\:...i......D...............lW...X.......Z...\...............J.......g..H...p...@...<................0..dx...0...0..`...X2......................h.......

C:\Windows\INF\scmvolume.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe78 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4804
Entropy (8bit):	2.9364175568264126
Encrypted:	false
SSDEEP:	96:ftNnDPWSl+7ePWjk0eRr9h9JhKwdobzpaj:F1vPmk519bJhKwdsg
MD5:	201518131332E32F707C733C43206AD6
SHA1:	27DE141573B3B41B85118F718CC412BFD6BAB15A
SHA-256:	9F90FA1784069E76243E3596AE17DE638D9A44D47C6D95B212930359A0DE9EA3
SHA-512:	2F3EF12AA0A4B960612DA6E4AA937CB60447BE800C717C92D078C2B52AD82AE38156DE84182FAAB96156007F0DE658BDE2BD9E45156917EFE985583BA5AA159F
Malicious:	false
Preview:	....................x....!.........................x...........................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................................................................................................................................P...........................................................................\|.......................................................................................................................d...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\scrawpdo.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe40 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4604
Entropy (8bit):	2.8986463183022244
Encrypted:	false
SSDEEP:	48:X/IqRGZVK4DbJGXCpx5ahORmtcHOQkBhswpDcMqMao:X/IqRGXZMCWWLk/DUMao
MD5:	626B6DB82235C674A1ECB48BD0391CD8
SHA1:	01493DA8066597B423C66916BFDB780AF9F5F61D
SHA-256:	AA5ACA6F26062D47474EC5C3512566D0C957108F3FB9A90E7D1F43358E001B71
SHA-512:	0A7FCB0FCC25A437BBCBD6B00E30A57462052D5D64AE183549CE20DE9A2BFB8574D86EA11F2212AF91C0CD0714EF8E7764B01A114BC8821B168AF35649CB8C88
Malicious:	false
Preview:	....................@....+....yl..................P.......................P...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......t...................................................................................................`...........................X...................................................\|...........................................................................................................................................p...........................................0...............................................................................................................................................................................................(...............................................................................................................................................................................................................................................................t...........................................

C:\Windows\INF\scsidev.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xf310 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	81068
Entropy (8bit):	3.9903924660482595
Encrypted:	false
SSDEEP:	1536:A35p7AIYuScpvMd5F6qLNYmoNsgKSiPFhq8kFB:451YuSSvMdCqLNY7vtcFhhkFB
MD5:	E981EFFA4B825F15D7D37C23B419BBCD
SHA1:	B471662BA5CABAEF706651E6710FE07B0C64F050
SHA-256:	7C40F8617EE53E9E6452DFDDACE7E7CC0FA06AD38EBE9F28470A7A3D31626DE9
SHA-512:	B75914293E8C6458FE83ED44536623F56F2D12C812FC2695A3F5FA3347D0130C5F331F67DBF89CE47E807ADE3832B7E7B342C8960F3146B2487BF940CDDFF45F
Malicious:	false
Preview:	..............................4Ne.........\|...............0...H...x........$..h................<......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......(...................d........q..........8a..........`t..............,N..........................\n..p\.......................@.......................................[...u...................a...................................\...................o...........e.......................e......................R...Q..............LV......................U..................................................................p...... ...lY..db..tI..................dF...............T...................Z..._......................(...0...._......lH...................N.......j...........................n..h........................>..t...............................hp...............\..........x................................................X..........TX..................t...@_......\|...p....... e...................Z.........P...\.......4...................0...

C:\Windows\INF\scunknown.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xee0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4780
Entropy (8bit):	2.9767966098358984
Encrypted:	false
SSDEEP:	48:p3Woskj26u5Pfidi53v7gncbPWtx52utpWPs9gkYQM:p3WoYFtfit0+txkutpmJp
MD5:	BD1C4B86BB3DA547637092E52C8D339B
SHA1:	AFF1A17C719C655FBB1B19137F61CB18FE549A37
SHA-256:	FDA1ECFE7BC5EEDCDB3AC281B3645E47C3D524B9AC37226639F41499434F3158
SHA-512:	F0002A4D17B6EA1E24DA5E443FFD719710372E5EB59AE75AAB54AC7DC5333CAA8B2D7F2DB51AF5B70AC16D06005D0498ADEFBE1BEC7977925C63FEB61EC2EC82
Malicious:	false
Preview:	.........................+....yl..........L.......................(...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................................................................T...............................................................................................0.......................................................................................................................................................................$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\sdbus.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x7c18 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	51620
Entropy (8bit):	4.049096889630701
Encrypted:	false
SSDEEP:	768:V2EpNx8WlXdytOcIQZD2UCmPGxrb+l5Wvvvg5:PpNx8WlXSIQZD2FmPG0l5Wvvvk
MD5:	8392BC74B0DB6D2674659B02AA22E5C1
SHA1:	7CBDA2F98326FDF8457FF9BDB648A70BDAEB734C
SHA-256:	6FCD27C7B3F7C6C9783B0829EF207E822756833530E6C931F11D75D892864E29
SHA-512:	DCF78D15F406E06A492AA7353D1437BF0E43513D57E6BC05BDDDF996A6696F94FF52786F20D15EF344DDAA34685CEAD3314E2B4FA4518B4F6520304694E0FE0D
Malicious:	false
Preview:	.....................\|..x.o./...l..0........{..`....}..........................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......Lc..............Di..........p-..................................................lU..0n..........X*...,..................Xd...+...................g...........r......<t...2..l)...p...(.......d..$g...&...j...l..(m..........Xh...x......<d..............................tj...k...l..`;..........Hw...............u......./...X..px.......'.......................v...c...X..h,...i...f...<...<.......d..4e..Df..Pf...e...e..de..\|e..l(...b...e..@<..`<...(.......Y...q...........S.......o...^...;...........:...:...;..$+...1...;...q.......[......................................X)..D'...c.......d......Xe...f..D1.. f..,f...f.......j...k...m..\z..............4.......................$3..........\f...................;..,w......................,.......pa..\|`...,..8.......4b...1...........c.......U..t............Y..\|&..........H....-...... ?...............>...........3..

C:\Windows\INF\sensorsalsdriver.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2338 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	12740
Entropy (8bit):	3.725115035974653
Encrypted:	false
SSDEEP:	192:UaUtLSaTHSD2CGUp47NUiwfJuaFi9peUHutN1t:UaUtLrD88Ef5vUH+1t
MD5:	AF9375296D751E6E984271986314139C
SHA1:	B99B753F8D8943F2D0F9389AC4142FBCFE12233B
SHA-256:	933F93E11EC402176FBBA57E2FEE130055EB9DE26AE417AA38C40968D2FD261C
SHA-512:	86D454AF3CC6D1C1845278858DDB30DD1B83011DEDB2164E93C35DF9CE73DDC0FAF2ECF2A3071654D4070A17C490AEAE548E76FA67D2A8AF0FF85815FC5F07EF
Malicious:	false
Preview:	....................8#...v./....[..........."......P$.......&.......).......-..h................1......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................................................................................................................................................p...........`!..d.......X!..........................................................................8...............................................................................0!..........<........................................!..........P...............x...............................@............................................................................................... ...........T.......4...................."..............4...4...............$...............................................t...............................H...................................................P.......................................8.......................................

C:\Windows\INF\sensorsservicedriver.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1d20 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9708
Entropy (8bit):	3.566395757631188
Encrypted:	false
SSDEEP:	96:/uWLoSddtoRMaHosfkiQII29iZOcivAkB3g9E0gelimCQY1ZrN3hMkpnCH0vM8Xj:9SMaHosUII29iKz3dkHkMeFt
MD5:	9BE3BEEB3414F79B35BE9BDCCB9A3E59
SHA1:	8F2AEF9A31D807986ADCFD4E2F60690CE4F5F54D
SHA-256:	3182D2B4D6E63759BE459BBC569CD603AABB609E88C2397E6CBB98F688373B25
SHA-512:	CE6832B8D08AC5DFF7E8496C5155B3BF9240779C647A29F7AE882AB9B87F0E2CCAEEFC9676D51195EA40C72171E5EAD7E5AA50DE889632661CAFE1C70C81D306
Malicious:	false
Preview:	.................... ....v./....[..................8...h............!..(....#..h................%......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................H...............l...................................................................................................................................................D...................,.......\|...............................................................................................................................................................h...........................T.......................................................................P........................................................................................................................... ...........................`...................8.......................................................t...............................................0...................................D...............................................................................

C:\Windows\INF\setupapi.app.log

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Generic INItialization configuration [BeginLog]
Category:	dropped
Size (bytes):	283
Entropy (8bit):	4.829434298204819
Encrypted:	false
SSDEEP:	6:MEJbRFUEZVKNSaFjFCAxQS+FUQAJpFhCLvugH/7sWiqugv:MEJMWVKN3FlxQ3FUQA7SLvPAE
MD5:	97D925CCF8B640605120FE5579D59ECA
SHA1:	763149FE3AA54F414658044FF0A8B10F9F45531D
SHA-256:	056A181475E949C76986EAAD986CE792FFD8E41331CC1C16DBF34A4D78ECD0C2
SHA-512:	BA8DD5A9149122BA6B968CFEF3DADCC1B451EBD1985CB795D574DE284B4BF0E6409CB5C6729404B98E8769C5E0E6C5AD410C55E426DF92FB1C8BD1EF81FCD060
Malicious:	false
Preview:	[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog].. dvi: Waiting for NetSetupSvc to finish installing ROOT\PANGPD\0000.. dvi: Install finished for ROOT\PANGPD\0000..

C:\Windows\INF\setupapi.dev.log

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Generic INItialization configuration [BeginLog]
Category:	dropped
Size (bytes):	57639
Entropy (8bit):	5.265171604012814
Encrypted:	false
SSDEEP:	768:Own95cdyYloiwTyz25/EGuk7qjrNoxzrAm6:O+5cdyeoiwGe8GuuZ6
MD5:	0AC8C89A8BBBC9E6BDBD6BFC73B49CC9
SHA1:	865DFE0744EE9BA402C12258CBB369F5E032F7B4
SHA-256:	E272AEB8BFD1ECBBFA9288760403E7C2BD2F2BEA55F8389F8B3AFAB56EBA2C37
SHA-512:	27077C2F6CD1CA54AD43D62072063CC3E9A76EE60647AA97DD891DDA19BC9D1539693DEE98C01F8227A826DBFED6EDBBC0354DCCC2A9C2CA855A77DE7898A462
Malicious:	false
Preview:	[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2023/10/03 09:57:02.288]....>>> [Setup Import Driver Package - C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2023/10/03 09:57:37.904.. cmd: C:\Windows\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.19041.1806.. inf: Catalog File: prnms009.cat.. ump: Import flags: 0x0000000D.. pol: {Driver package policy check} 09:57:37.920.. pol: {Driver package policy check - exit(0x00000000)} 09:57:37.920.. sto: {Stage Driver Package: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf: {Query Configurability: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf:

C:\Windows\INF\sisraid2.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1a78 "signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9380
Entropy (8bit):	3.6246061939640084
Encrypted:	false
SSDEEP:	192:DW7tkmq7C4H+0IPFC4x/VRGXgr4HalEuS:Dytw7Cq2Cu/XGxalE
MD5:	0E665A48C0E00F468687B2AB92BF1DA0
SHA1:	66BCA069903A513D3D11B2C64E73D48274F55095
SHA-256:	ABF3C1AC201F90360DDE782E0FA09023513D91E02640D144962F5B0389A7EE60
SHA-512:	28015B712AD20F413FE5260130FC4ED18C3C63E31CC1580825B0F01DE79DB35C3616DF59F36301EEDA758F573582778110612BEDC29CFA530AE37BE6175A9FFA
Malicious:	false
Preview:	................0...x..........R......................h.......L...`........"..h................$......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......................................................................................................................$...................................................................0...............(...................P...........................................t.......................................................................................................................................4...................p...................................................................................................................................0.......................................................................................................0...`...............................................................................................................................................................P...........x...........................

C:\Windows\INF\sisraid4.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x17c0 "signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	8356
Entropy (8bit):	3.5533117750500978
Encrypted:	false
SSDEEP:	96:K5tsGuaACVs0Kys8mXv1b1X76VRbqU/XiX1tk9c0KTT4Ug8FbLhkR1:KI0v3m/1YVg6XifkYT4zh1
MD5:	3503510B5F1EEE8B35621781A05F8F7E
SHA1:	C6942DF65568714BD2AB4E61483F669293AB3187
SHA-256:	75978A0D1A054EAC25FF7C954CE7B491FB46AAF762C93EE0EE546BC449AC1FDB
SHA-512:	B4F6BA776129D4B9501FF99D97C71FEC3E8DD713116A6FEBB01F52B9DA7788F9DFCF997291AA672941D175DB2DA91D8D3468FB7A2D1DD58620E4F8EBAA1EEDCD
Malicious:	false
Preview:	................2..............R..........0...........h...`.......P...(...x...h................ ......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................X...................................................................................................p...............................................................................X....................... ...............(...............................................................................................................................................................................................h.......................................................................................................t...........................................................................................................................................................................................................................................................................................t... ...........H...........................

C:\Windows\INF\smrdisk.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe00 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4684
Entropy (8bit):	2.889534050371614
Encrypted:	false
SSDEEP:	48:pH8qUFkv1pUjjnI5iBQRRMNFrrgaaDR4UEaupaTU:pHDUFm1KjjnBQRRMNhry14UEzpaTU
MD5:	DCD6BA3F356FD083F976783693DBA3F3
SHA1:	34F99782BDFAB8DEE649B78A68125C68A70FE174
SHA-256:	79C68344332BE096284CAC7EFA4A1208D58CD93F8A61D651273024B03F2E364D
SHA-512:	25563D603A848D67E370EBAEDE694D9D48B2A01AD3AE3F7027C33CEA82AD7830EAD42B39C065E395CE71E72F5D207B59261E730D3E9FB7F6109CA2B3500DCD06
Malicious:	false
Preview:	.........................!.................p.......................x.......`...h...............H.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................`.......................................................................h................................................................... ...................................................................................................................................................................................................8...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\smrvolume.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe78 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4804
Entropy (8bit):	2.9504908302608595
Encrypted:	false
SSDEEP:	48:ftfVnT+WSlCSVt07f5WIyJR39FrCjNDgyoyKbaupaPL:ftNnT+WSlP073yJR39hCjNDBoyKbzpaj
MD5:	90EF9EF3542601E9D32BEC723903EE46
SHA1:	BDCAA38A9B14968A8FA85A588BB7B1AF1013D0DC
SHA-256:	7E537A7A42170866367F9E45F329DDD1BF01485750292C734A817E800506A603
SHA-512:	837A634F4FEF4DBD2992AAA33764A692DB9D938F73C98ACFF8AC90E1FDA6EFF2AEBF9484A6A5F3BE2F54C921A28AE03468BE9E43AC9BCD02DF68B2F415861477
Malicious:	false
Preview:	....................x....!.........................x...........................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................................................................................................................................P.......................................................................................................................................\|...........................................................d...................................................................................................................................................................................................................................................................................................................................................t.......................................................................................................................................................

C:\Windows\INF\stexstor.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3158 "signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	20532
Entropy (8bit):	3.9703452232081045
Encrypted:	false
SSDEEP:	384:wiu1aAyUPFW82XZfWd7WToo4oVTiCANO/oO//yyhXz:Ru1aAyUPFW82XZfWdWEo4oVTiCV/oQ
MD5:	387C4AE605BE0D908AE9A4A79F6E277D
SHA1:	37C1746CC3413D0EB3E7E03D1E294D98F92E2218
SHA-256:	1CED0CE3E183F04BE28AB717D5AAE7720BB314073EF1CC677A288E9C650934D1
SHA-512:	5ABBD825D7DE46252E63FC561D31EB738B8F353F08E9B53DF57533EC38EC2E237CE6A65BFC7EE018925153FE9216DA2D67B2320D0F94D66997EDEAA8B0A11BFC
Malicious:	false
Preview:	................"...X1.........R...........0.......2......P4......`<......HF..h...............0P......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........(..................................................p/..........................................................................x(...........)..L/.......0...................+...'..h....,..........$0.......0......./......$...........d0...................................................... .......................................................................................................................................p,..............0...........................................................................(....................................................................................,......................................................................................................d................................+...*......................................................T0..p.......................................................

C:\Windows\INF\sti.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x32d8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	20140
Entropy (8bit):	3.8612328812840255
Encrypted:	false
SSDEEP:	384:cpK/GXFpqwdWTfcBCLJ6S+h0pNNCY/GFhk/K:uK/GXFp5dWTf08MSpNd/GFhkS
MD5:	6C2E83BF68758A2AB5AF499397D88B86
SHA1:	A35BB0A5B3F86D731BDF7DB66CDBB598D3CC5EF0
SHA-256:	FE9C164B69A1BFA19E56948334B24B80C83C9BBBF509800AAAFA66FED731D612
SHA-512:	9F4540CE295BAFA6839E92F16AE0E6F176FF070B14892948A61BFCFB0469FB97D34E6BA4BDF543B1E3E396D56CE5DC1F0CBABDE0B0698969FB5CFD68ADEAB1A8
Malicious:	false
Preview:	.....................2....../....#..........D2......3..H....7..\...x>.......F..h................N......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........'......8....................+......................H-..X+.......&..d............+..............................................P....................................................)...-......T....&.........L(...............&..................\|+...........................................................................................................,..........H!..............."..x...T...X...............0...........,0...%......l(......`...................................................L.......0)..........H...$...........................................................$/..............$.......................D+..........\.......l................................................+...........................................................'...........+...............!.......1..........h)...............,..............................................

C:\Windows\INF\storfwupdate.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x16c0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	7724
Entropy (8bit):	3.452058436955677
Encrypted:	false
SSDEEP:	96:ymSCyPSyGBHhCf5Ktt1pN25UjN2xRUDQ2Je30s9ftPaVF9EwXstL:y2REf5kBp27H2IgvEn
MD5:	DEE88356CE6EE1C5ACD24ABBBFC0DCC7
SHA1:	918934E3DBF3392386DBE2FD0E8B00013472658D
SHA-256:	09D5014EB4D4D958E74F139FF2C049DA772F14F63F1DE5BBB0C5EB10214B1F0E
SHA-512:	FE930730ECE8919CFE696A31CA6C1226E8ABF4DEC1E16AE244E4AF0512EBC32E8DA19D91FC0B0240117932F99C0D799B9DB97E27E6F77C5B7F78679223B0D663
Malicious:	false
Preview:	................T.......x.o./....L..........,...........@...X...................h...............(.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................<.......................................................................................................................................................0...................................................................................(...............................................................................................................................................................................................................................................................................................................................................................................D.......................\|...................................................@...........................<...............................................................................4...........................................

C:\Windows\INF\tape.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xfd88 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	93652
Entropy (8bit):	4.158409959020332
Encrypted:	false
SSDEEP:	768:uHJaVdRcJrxmXuJk2JCt5fY0JYCkKGzRNDXX+gJE/EPWNGR9EO50AmF/mOKrmvvG:up6dRcJr1k/mRNzOgJEaWNwRWNLA
MD5:	3C7CFB8002084F60CC0F7694B91FCEAF
SHA1:	81FBD0364F99DAFAF7EEEF37009591B5735406FC
SHA-256:	91A7BE540B26800D20480250E4C3967EDBCC09C62EC92BB4538F00E86CD79A1A
SHA-512:	28C82C51FF110B40ECEB751FD5659718D301F666861512AA2DD16C01CD9F6AC017F96AF43EEE8F212309AEC2F4E51CD87D569017E4950A906A31F7353943F840
Malicious:	false
Preview:	........................p.......R..............m...........0........$..t$..XI..h................m......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........o.......p..................,4..D...................0v...........z...........~..........89..........P3.......g.. ....v..............0........$...v..,'......$:.........H7...........'..............d1.......s..............Lv..........h....................@..............\...................l........q..D............4..T...(6...;...1......\|a...(.......................P..(G..............h............w..........................@p...;..\|.......2...\|......................t....\|...6..............L.......`5..........T....5...................5......`...8X..........d....!..h/.......X...........:..0Z......................D6..$!...r..........D...L.......\............w...z..h~......l........Z......l............t......,[......8...@4..<>...5...>...r...?......8?..h.......x...L...\|...................... $..41..x........5...4.......8...4...........7...m..4....D..

C:\Windows\INF\termkbd.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1550 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	7524
Entropy (8bit):	3.403172260069102
Encrypted:	false
SSDEEP:	96:AtailKQhqUnzkdipeNAu6rmtiRV+Nvsa9cPR0YWZ1biyqVBNNg5:6ajuJkdipeNATKtiL+psa6EwNN+
MD5:	F98AC8F308480A7ED69CF87CADD2BEE1
SHA1:	439A9DD595DB485EFA927A8D9B765C7141FBCB1D
SHA-256:	10E722142FEE64E24CBA56E450651F65291881BF87634937EE28830CEB0C9C6E
SHA-512:	D237C4B9D5A32A4715D975F221A29A62CD04E906B72058A8FFEA3512E81F5E47E92E2E8ADD12FDFB2992EAE619B7772FB6824EE610412543259F2D0ECFD7F623
Malicious:	false
Preview:	....................P............/.................p...............`.......`...h...............`.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................p...........L...............................................................................................................................................D...........T...............................t...............\...................................................................................X...............................................T...................................$...................................................................................................................................................(...................................................t...................4...........$...........................................................................................................................................................................................D.......................................

C:\Windows\INF\tpmvsc.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1e78 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	10212
Entropy (8bit):	3.627779421798209
Encrypted:	false
SSDEEP:	96:1AtfRMiBOi3g+krvbU1kVhAeOP2hX5oFOulSHtMy8Sm/NRWsNLMsqlwdXopxQgNc:iRMiBON5VWeWOdSyIAwdXofQg+
MD5:	56CF998063FA3D5C041BDDB35B57F996
SHA1:	2F0BD0093B54F9E9BC9227DD109BF64C6F32EBA4
SHA-256:	2A3E929FD48AA69477DB4A02C96AF04ADFB08624033918A52CBDA40C29A3ED94
SHA-512:	7672D24B57811679F825079FE5D5F97558C173C54E97B8F886398FA01DC80B3CE88AFDEF66B79FDA1A4D4481A6E64E5953B780CA803C93F622A78F42702F2B82
Malicious:	false
Preview:	................(...x....+....yl..........................X!......P#..H....%..h................'......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................................................................4...........$...............0...........................H.......................................................................H...................................................................................l...................................................................................X...............................................................................................................................................................................L...............`...............p.......................................................................0...............................................................L...................................P...................................d...................\|.......................

C:\Windows\INF\transfercable.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x14b8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	7452
Entropy (8bit):	3.526582590003204
Encrypted:	false
SSDEEP:	96:4RAeghtdFL3whZYtg+25/WG443faOVKwDXXYLLLE:FTTdFbDtg+25/5faOVfDn/
MD5:	F2127B15906899857A8AFEFC1E282D97
SHA1:	0A1EC70D6807652D6F95145BD7AB39D2C0322066
SHA-256:	11090F5488B94F633E2FD5B62A3B318425F073F3B436E41DF2173A97276BDCEB
SHA-512:	7667FE5DAE1AEC9A5AD676EF13F85CD649D11AB991920771E0BE8F417075C421269B37BAFAA69F4B50D21DEE6490BF367471315DB300823EA4149286E319A201
Malicious:	false
Preview:	.........................$.....HR..........$...............p.......h...X.......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................................,...........................@...................................................................................................................................................................................................................\|...............................................................x.......................................................................................................................<................................................................................................................................................................................................................... ...........................................P...............................`.......................................................................

C:\Windows\INF\ts_generic.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1a80 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9068
Entropy (8bit):	3.580188005795204
Encrypted:	false
SSDEEP:	96:zEyuYJhZ4FzGSYKPN7vn8luPN93+TJuOmA2YZ0Suj3AKvdgszraMK07hpGpi:CBFzG7g5v8hTERA2zvdgszwg
MD5:	F7A8F6AC4D63835B2E892893AC105BD4
SHA1:	F4D7C260D5A92DC7E8E77B513EF4672CD0660F74
SHA-256:	FED87457C2ACFB295DBD456A98507BAE89D730C3087570897CD54F8340CD1166
SHA-512:	972E972D831437A5D8B5394FE35B0159579B4DDCE488EDCEEE9C3288B6C1E181787B7E86B3FE02F923AA5576431E3872E9B31CB61D121BB3D4055D70A91C627D
Malicious:	false
Preview:	..............................HR......................\|...............4...0!..h...............h#......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................................................................................................................................x...............................`...............................@.......................................................................................................................4.......................................\|...................................................................H...................................................................................l...............................................................................................................................l.......\...0.......................................................................................................................X...................l...........................................................

C:\Windows\INF\ts_wpdmtp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2260 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	13396
Entropy (8bit):	3.7994203498918324
Encrypted:	false
SSDEEP:	192:FyKeEQ3ZV6eNTGOets7OZU2O1x60vLCpV2wJ+MFnXEfCvfEdk:F2EKHaHDULCpV2K+M1E5W
MD5:	A1DD29C71C0C51BDFFC68E2AFDE00201
SHA1:	685E9DEA1A0577FE6201BDF782C9325AFDAFA813
SHA-256:	79415A9BBDE78A37B6E808DC4C956C189A6D22405CAC8D619C18A1C60A24AB4E
SHA-512:	DBD87AD2B271A0535D0DD5D96CC79FDCDC32416AC4A28539360E81E0965156F3594A957A12920472D81E96EEEC566E5A0632F8B86181D0828130B25E3C7571A9
Malicious:	false
Preview:	....................`"........HR...........!......X#......(%..t....)..X.......h...............P4......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........................... ......@.......................d.......................,...........4.......l...p...................................................................................................................X!..........................................................................................................x...................L...................D........................ ..............................................................................................................................\|.......................$...................................................................l.......................................................................................................................X...........................<...................................................................................................

C:\Windows\INF\tsprint.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1298 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6740
Entropy (8bit):	3.306650468961344
Encrypted:	false
SSDEEP:	96:oaQp/TwzPueeqpAluPeop60X1qO1f6uxIy3qkk8C:oRmeqT40dtz3DC
MD5:	32D4DBA39CC957A3B37C76A5953FDD5C
SHA1:	AC27420F9A1F894FDC6B2D7A0BA3A3B128DCA62C
SHA-256:	128C1F82CE5E69ACBE1A73C56CAC38B8ACFEDDA30AF42076D9FC504501BA533F
SHA-512:	A3A1EF532F36CFD24E6736B4FC1BB09B09544A1C433AE6D5258C387C27EF764F1DB68435FD74E2D310E093AD4848000F7DFABCEDDF83DCFC68B3EBD3C1A0B30E
Malicious:	false
Preview:	........................gi../...HR......................@...................h...h...............P.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......$...............................$...................................................................................................................................................................D...x...........................................................................................................................................................................T........................................................................................................................................................................... .......................................................................................................................................................................................\...............................t...............................................................................................

C:\Windows\INF\tsusbhubfilter.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xee0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4868
Entropy (8bit):	2.9586596754981134
Encrypted:	false
SSDEEP:	48:++wYM9Qd6t9kgYam7i52W1X078Gc9r7PNu7qm0Y2UUKYS1B/:9Puc6tKT741k78GcJP87qmfuWp
MD5:	F473DB67783E286A64E203F33D2C58F3
SHA1:	1AECA79A266C8CFFB9A27978D8D7333BE0854937
SHA-256:	B1CC9DEDD9743488D1BB14B9D4768344D61F82A2C7ABEF979623FD2AD64ABFF2
SHA-512:	0FDCA9BF965AC625FDA570E8CF8D674E1DDBA7A00060C7CF34765819D9D3037FC1DD7E8EB1CA928687E38CB0F9DAD74956F8E3CEE23CD089AFEBB1779C08D764
Malicious:	false
Preview:	........................!....../.g.........P.......................@....... ...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................L...............................l.......................................t.......................................................................................D........................... ...................................................................................................................................................D.......................................................\|...`...............................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\INF\uicciso.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x15b0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	7388
Entropy (8bit):	3.430668389363551
Encrypted:	false
SSDEEP:	96:S0mH/Km0demZnwUxMAYSbjs1bTR+P7Xo300c9QLPXMAuTb7n6prq2:4OZ5GBrsJ3D6pP
MD5:	1F7416D3B32673C32FE09F3F2A1D7DF7
SHA1:	D1D6D769DBFA985380D57241F171F419733D7DC4
SHA-256:	C2C70A47B741D13F43412290798C538F931956B8B69D6880A14E95B8B4310C14
SHA-512:	96168EC824516E993D17C452709245C4745EC7280463624DD9E61399D520BD142DAA41FFB5792C166429DD3D180C0F301980A03A3BFDBE01CD9AEB023BA6F237
Malicious:	false
Preview:	.................................&......... ...........T...................8...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......8...............................................................................................................................................................................d...........................@...............................................................................................................................................................`...........................................................................\|................................................................................................................................... ...............4...............................................................h...................................................8...........................<...............................................................................p...........................................

C:\Windows\INF\uiccspb.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1658 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	7588
Entropy (8bit):	3.443613170863419
Encrypted:	false
SSDEEP:	96:bKLRbJXzi9+fiH6O591lLdmo785D039ZL0cbn64PTew:Aa+KaOnl7Qu64Pt
MD5:	DDF1A4684740CEBDF70BB4340FDBFB82
SHA1:	05E1728C737CD82D17198A71DFD81635208CDF15
SHA-256:	CB3995F8E6A8252D8476D516D18C4CDBEDF29F2655FEB788DF10904D2CE2E055
SHA-512:	058994E90E50044DE20DCD941F2E6D51FBF9705D3A30E787662584870ABC57B36EFC7B8B9F914740B7036A3A4DB9A26E4F3FE2CAB70FF3295D22F2FE349E5EC2
Malicious:	false
Preview:	....................X...<.(....yl..................X...T...........@...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................................................................................................................................................................................................................................................................................................................................................................`.......P...........................................x...T.......................................................................................................................................................................0.......................................4...................\|...d.......D...........................................8...........................<...............................................................................l...........................................

C:\Windows\INF\unknown.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xf18 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5012
Entropy (8bit):	3.056224994135861
Encrypted:	false
SSDEEP:	48:ZcVS2nVuOnIqf6ChX5W1d50R/FF6s+u1YDAnANETJNfeT2uBUdMBuyb:ZcI1OLf6C5R/F1p1YDAnANEXfeCuBayb
MD5:	E628D6AC7AA3757D931B10F111ADFF90
SHA1:	37330D9731E4E8E35157CCA5DF598BA9A1F77394
SHA-256:	BEFF1D773F0BC8AE889F2E962B93525078665D705D902DE9E885A5B8DB8A680E
SHA-512:	A38618128275805188DB284F3141682ED0C7B3A6DD42D58C04C2C783833EE9921C47E72EC513FC2B673F45620964EAC10A6A1EAF911DD51CC54486F2E728B8D7
Malicious:	false
Preview:	..............................4Ne.............................................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......4...................................................................................................................................................................................................................................T...................................................................................8.......h.......................................................................................................................................................................................................................................................................................................d...............................................................................................................................................................................................................................................

C:\Windows\INF\usbncm.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1a00 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	9172
Entropy (8bit):	3.5682310837043403
Encrypted:	false
SSDEEP:	96:Zi+K8bG/zltv0GdHnoT0R6UVV6jCQk1ynkZMt0WKh6yk7Ia9UyYc0EN+:orJCGuVUVsfnk6ea9UcXU
MD5:	41BC2326B245F4F5D7743A3CD7D5EDAA
SHA1:	5D6D29C41173ADC1623B2723827E4905D814F617
SHA-256:	DEECF42B6877B5A169214AE0732065BC00ECA0944A12E3BD5B5FD5EBA740DB28
SHA-512:	8E721F7764DB5250A2A23D60412DFD4BBC839044E5D5087D945241818E902644694A5ECF2812617D9930E67715A2BABEEFA91EA2EEAC5EF1CF41FEDAEAF5E1AA
Malicious:	false
Preview:	................&........#b........................(.......@...@...........(!..h................#......C.:.\.W.i.n.d.o.w.s.............................4...\|...4...........................................................................(.......................................@...............................p...........d.......................$....................................................................................... .......p...............................................................................................................................................................<...........................................................................................................................................................P.......................<.......................................................................................................................................p...................................................................................

C:\Windows\INF\usbnet.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2fa8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	18604
Entropy (8bit):	3.8034162580807758
Encrypted:	false
SSDEEP:	384:lg/SF73gySVtlIJlj8J4p1TZeu6FOsAHK:lgj7slIJWJs1
MD5:	A7B66390F465337E687739CEC4A39935
SHA1:	F197698797EC88D5C7FCEDBD3A0206BE015B5D48
SHA-256:	508AC3417AC0EF0698E1B6F3156DCD65B114CC475E9D53E58E41053A6210EA07
SHA-512:	8A3A56F77B88A0A8472C08A1443CEBCBEA4B1A1A0E8A184522F667088CE80318FAE3A5F54158B511F4E11AAF2653A75F6CA9CAE30D9DD00D6BC03468BF7723F5
Malicious:	false
Preview:	................"..../...+................$/.......0..@....2.......8..P...X@..h................H......C.:.\.W.i.n.d.o.w.s.....x..........t ..............p....................................................................................#............... ...........&..\..........................t........-..$........(..."..$ ...$..........................0...X....!........... ..................................................`................)..............................0...x.......d......../.......................#......@&..d...P)......................................................\...<#.......%...&..........................@..................x&..........0...................................................$'..t#...................'...(..........................$..D%...............................................,..................h'..............(+......L...............................................0*..........................L...............0&..............................

C:\Windows\INF\usbvideo.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5338 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	29916
Entropy (8bit):	3.9971193421731037
Encrypted:	false
SSDEEP:	384:9kN/LM5SniNuhn1jfw7CBMLDnEjsRTa6Wr0VzvONrkzvet4:9uIgv1AII5Oc7
MD5:	632B02265706CECE64B194E1A68F5660
SHA1:	0EC32AA943F6D4216ED0020E7469039E738B1B1B
SHA-256:	FF7853AC864214C9BC46A3EC0913FA514BF42F33AE4E96EB6D08E4FB05B9C4B1
SHA-512:	099335AB14800B37C7FCA002EAB93F8E4D52F627C05DAAC70A8D0E308E792F77F8C77E845221F35D2201E704C2F329AFE2EAD415321A65C8762E4A2564358389
Malicious:	false
Preview:	....................8S..S.../...yl...........R......8T..D....V..4....^.......i..h................t......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................@!......................H4..<.......P...............t... ...........D.......XL..........."..0'.......................A..h........................D..l........$......HM...I..........X(..t...8.......\....K.......................:...7...........................................6...................(......4............+...........Q...........................".......%..................X8...9......p8......4L...9...F...(......` ...:...................Q..................'......8...p1......x<.......3...........&...,...................................&...#...................9..@8...=......48...9..(8...8...M.......;...C...B..85.......O..x....J...N...................... ..l*...I...........................I...H...).......'...9...,..DC..l/..(....1..43...4...5.......!..\|8..D<..................D...L8.......$...$...... G...>..............pR..........

C:\Windows\INF\v_mscdsc.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1a30 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9588
Entropy (8bit):	3.655475896073405
Encrypted:	false
SSDEEP:	192:PO+vZIJad8qMdQOLLcQKHo57vKTigiGMrb777777777V:PO+v6I7MdQOLYQx9eMrb777777777V
MD5:	021C606D4E6B1665A4BF7D9B64312F91
SHA1:	4E5BEF2E7B201B223A8E56158EAD33FC1E04B8CC
SHA-256:	C11CCBD0BC381D7BD79CA75654EA9E7BE34BABA54C1F8BD5DD35F054E24A3FC6
SHA-512:	66E0B606B4569E7CEE41995C28D8EE9B886F602B7E4EFC228A859B59756422946492775E1BD48E7F5F530C86B4ABA921F38842A5EDCD501E839B53C2BA593DF7
Malicious:	false
Preview:	....................0..........HR..................(...................L... "..h...............p%......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......,...........................L........................................... ...............................................................................................,.......l...P...........................................4...........................................................................................................................................d...........................................................d...............................................................................................................................................................................................................................p...............................................................................................................................................................................................................

C:\Windows\INF\vca.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x19f8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9068
Entropy (8bit):	3.553393257370761
Encrypted:	false
SSDEEP:	192:DUWxEzfHbFU9Te0Gcca26y6/bR5F/j3FPcXB:DUTHqxQAK85TFEXB
MD5:	9341273272B7CEBD99BC8A4D9B8765F0
SHA1:	127B2BCC3B43BFDCE3A686BAF14A4B3558FF8A4C
SHA-256:	63F17718C6DDBA1E43392B98491CB77434A94886FFCD020A6F2992EEC004B9D9
SHA-512:	07F2CE951A6DF0CC02466E286BD782CA6E84C91A47FFBCDAFA7E1BD3078398A2DCC4CAA22A3517FABD2108E42AEA8A43A860F18B04ECD5A8C961D2290E5E396F
Malicious:	false
Preview:	................,........j.....%...........d.......(.......0...X.......p.... ..h...............h#......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......\...............................................................................................................................................................................8...................p...................................................d...............................x...............................(.......t.......x...................................p...............................................................................`.......................................................................D...........................................................................................................................................................................................................................................................................................@...............H...............l.......................

C:\Windows\INF\virtualdisplayadapter.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1328 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	6164
Entropy (8bit):	3.2651809909641134
Encrypted:	false
SSDEEP:	96:zEeDSgGn6dOhr5kyIhUxVxZ9Jp3erD30nJyQREvA:Fq60rmyHxVxZ9JRer2S4
MD5:	F38DFB45336F46616ABFD178EDDAD7E6
SHA1:	AA07913E2FF1C9AEC915A392D2B7255BCBEBE312
SHA-256:	BEAB0764119E33068E998AB1845A14FABB03A9E07CAFE1E9FA3D19A571963BAD
SHA-512:	3ACF3630272E8AB7B40920C2F63CF97208209DB0D0D0101CD0E1C8A4D4CC8E17B24B72CCF812583DA7E99A75C1AE81754F4BC123F683782B5E421A660D11C941
Malicious:	false
Preview:	................H...(.....H........................p.......8....... ...........h.......................C.:.\.W.i.n.d.o.w.s.........................................................................................................\|...........................T...................................................................................................................................................................................................................................................................(...................................p.......................................................................................................................................................................p...........................................................................................................................................0...........................................................................................................................................

C:\Windows\INF\volsnap.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1008 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5164
Entropy (8bit):	3.1210149304105492
Encrypted:	false
SSDEEP:	96:t4/csoTkn/BxJ3NKf2s64RrJh7hNKJZi3ZsZ4o5OgWZ1sj9rW:tpk/bJdKf2x41JhLKJZi3ZsZk3ZOjJW
MD5:	7592BFE36BD4F9F72FE49453BF2A34F4
SHA1:	1A746457AD3CDF8C42F7BA401473CC20100EC301
SHA-256:	E9ECD86F488AB23974643C32A89683CBCEA2470635E93E35D21CBF9F7F633DC6
SHA-512:	F80A04BE067DDDA9681B0AA912498C3040B87DBBAB5729F7CB6895F3C0BF64B30EC091835B6D361A7A19114FC6F6C60CBF21BD879B293A97EBBD249719214076
Malicious:	false
Preview:	.........................!.................x...............................`...h...............(.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......T...............................................................................................................................8.......................................................................\...................................................................................................................................................................\...............................`...................................4................................................................................... .......................................................................................................p...........................................................................................................................................................................................................................................

C:\Windows\INF\vrd.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1898 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	8740
Entropy (8bit):	3.5147246646221784
Encrypted:	false
SSDEEP:	192:4ObAxEzfSbFU9Te0GLLa38pR45oWkm3zze:d1SqxQC3K+Rkofe
MD5:	2B5A8041AC070684772C5AB28DDEB43F
SHA1:	D56CD1C82FC0BB8700F58E3FE975C050A9C4A5F2
SHA-256:	99B1214F3CF8FF931B6CFA7DE02E4D2F2059BF711B63D9A92AD68C5A214E1C20
SHA-512:	F77C06C796A5147F946524A2F37F2AC45A7B42C004F7EBC675AE731F56F33ED8C7C6D4699A31011E574927C7D813C733AF4C6F133BF2F8B047F93562FE5DE1E1
Malicious:	false
Preview:	........................]w?....%...............................d... ...\|.......h............... "......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......\...................................................................................................T...........................................................................8................................................................... ...................................................................................x...........................................x.......................................................................`...................................................................................................................................l...............................................8...............................................................................................................................................................................@...........<...........................................

C:\Windows\INF\vsmraid.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1cc0 "signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	10140
Entropy (8bit):	3.6988661527092206
Encrypted:	false
SSDEEP:	192:FN4ZQzgIMjG9GEF/advLl3ykXafvj1dBnIGkWWNK4WFgFRSGLWDT:LC0MIxZadvL59KfvxdlIMWWFg+GL+
MD5:	0E5AEF39A5BAB6BD2EB0057F3BFD573F
SHA1:	C456EEA5E3BADA6F20BB1857A639279261291797
SHA-256:	428B9E5A5A0D507A5F1B6708561589C843E4FA9DFEEE27B4D1E8CFF28E28C5F1
SHA-512:	A1A7FC4292E63F7B737B50CC76D79CB82A1A9593B6253B31F30C005F9D7E17923D0CA99CF67B111FFA47F9F95260C84B6DBF671453A2BCB4A635C6A8F70FF2D4
Malicious:	false
Preview:	........................p.......R..........0...........@... ........!.......$..h................'......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......................................................................................................................................l.......................................P.......h...(...............X...............`...L...$.......................................................................................................................................................X...............................................................................................................................................D...............................................................(.......(...................................................................................................................................p...............4...,.......\|...................................................................H...........p...........................

C:\Windows\INF\wave.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1ae8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9780
Entropy (8bit):	3.6338452452278958
Encrypted:	false
SSDEEP:	192:YIwT/E4aVZ+Y9mWTIAGLSMGLrGLAw1JHSe7HSuPBykPCR7Z9z:YIo/EFVALS9LiLAw1t/+R7Z9z
MD5:	0A7A079E6B76D03F0923EF63C4B6CF78
SHA1:	3659CD6EB1ABAC071183CB6B0187F5FF66D5419E
SHA-256:	A7CD5574A139BB73D04DEB0B13007B8863EA58634D3A8BCBF12CF89404359865
SHA-512:	2CED66AFE732026C99C1274B544DB2D759E6FABDCF79A55DE77518476C1D9613446487623E249E2A5F988258DBADA715D023A322415EBBE84FA8738579FBD8C3
Malicious:	false
Preview:	.........................$.....HR..........T...........................L...."..h...............0&......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................................................................................................................................................................................D...............................................................................................X...................................................................................`...........x.......................@...............................................h...........................................................................4.......................................................0.......H.......................................................\|...................................................................................................................................................................................

C:\Windows\INF\wceisvista.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xf00 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4932
Entropy (8bit):	3.0071617525967897
Encrypted:	false
SSDEEP:	48:9F537BvhkGEcr08QKgvr5Ds5UHFlcOoAPVs1bbq5/tO7+WFjTDVRc:9F53N6GEcY3KwkU3cOoAPVebezij9Rc
MD5:	DA81DD0C34C8036788941E11EA8E8871
SHA1:	4491A1D1F0194A95B150B5151358CD7460B32330
SHA-256:	7D3E68942CC30E0A7D706B966F14CAD5CAE20BB468DD952AFFBF08746248379F
SHA-512:	2779573AC1ACF6BB8EF65E6053D89ABD4C089ADAA2C77456C525F3DA9FF302635AD56F2D84BCC569CE8ADB480C362E753C5C2A1FAD8E44AA710399571B0F1EDF
Malicious:	false
Preview:	.........................-......#..........p.......................p.......X...h...............@.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................................................................X...............................................................................................................................................................................,...........................h...........................................................(...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................(.......................

C:\Windows\INF\wdmvsc.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x12f8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6532
Entropy (8bit):	3.339081399497586
Encrypted:	false
SSDEEP:	96:W5N4Iju68O4bCehDc4GW461f/YOJqy6ZQjtfNWpW0bc/FWm2LUI2XNzD:cehD7G4r6Oj1o0PMUIC
MD5:	43DDDE60A9E3CF17F09FABD5EA0C805E
SHA1:	384EBBDFACAA7B94AEFDFD184115A818C34C8B8A
SHA-256:	5AD0722186EFE3FF367BB374BD486D049BB68B7EDF80EA2DF3E9857078B4388C
SHA-512:	5FBB6D93FBBADA001FE99DE24B9F7F36F540D1D48C76172ACE4E5389700C1CC77634027D61F07890755F7C6D9A1B71E930AA90EE3D03AB292967D1504B70BA51
Malicious:	false
Preview:	..........................A....%...........h...................h...............h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S............................................................... .......................................................................8...................................................\|.......\...............X...........................................................................................................$...................................................\|.......D...............................................................................................................................................................................................................`.......................................................................................................................................................................................................................................0...........................................

C:\Windows\INF\wfcvsc.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x19e0 "signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9116
Entropy (8bit):	3.604119982438194
Encrypted:	false
SSDEEP:	192:w4UAaUNz3atitprKdzBXAibgIxocXaY/qj/:wRAaJovYd/gI6cXp/W
MD5:	21C3023796335BB03D332582BB433143
SHA1:	A01E6B8D0F8A8A23C8C5CEDA682AB4C57DA43B49
SHA-256:	A4DA4E7D7E1172784698B0207F0A3E16D4B6B218E99B5813946360FDA845EDF1
SHA-512:	5D29A1C4876F6ED4B89DC47A32750350D9DBCCD05E33B3E104C212B1354E9A76C93119D3FD445FA043B662C29217F159813833A85D179866D2F14C68BA4B5748
Malicious:	false
Preview:	................ .......]w?....%...........P...................(.......l...(!..h................#......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......\|...........................d...........................................................................................................................................................t...............................................P...............................................................................................D...................................T...............\...........................................(.......................................................................................................................`............... ...................................................4...........P...................................................................................................................................................................L.......................d...$.......................l...............

C:\Windows\INF\wfpcapture.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1338 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6532
Entropy (8bit):	3.3218217992372314
Encrypted:	false
SSDEEP:	96:DzJfxH0QsSCvZPdyRl409B4JbD40T/nvCxDA:H6/pdlYDA
MD5:	1FA4CBDDC1EF20A7CDF140BD1CA1C2CA
SHA1:	B24856B8BAD3459558D128438216302022065CD0
SHA-256:	4F893CDA1E839FAAF241483553665AC35466E7469D688DB429B9A5FF98201346
SHA-512:	F9B54E9D567ECF14A6A1475E0DE5655B88AF046FD15045D2B519B2839B9A03BD74A2AA204228BBF01AF3C954E0DB5DFCD362370667A609936576128E95492CC5
Malicious:	false
Preview:	....................8....+....yl..................@....... ...P...p...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......p........................................................................................................................................................................................................... ...............................................T...................................p...........................................................................t...................................................................................................0...................................................\|...................................................d...........................................................\...............................................................................................................................................................................................................................d...

C:\Windows\INF\whvcrash.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1308 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6548
Entropy (8bit):	3.3521153794867704
Encrypted:	false
SSDEEP:	96:vJ7qRfBaZyCw5jAVcmpF1LGDrImU3G7UAk65iLszyaLUOO/WD3:vnw5kVGzU3G1yAUOOC
MD5:	F26F8EBB16088B7D424E4A99247B960E
SHA1:	E7D67959350DB77B00F2FD27597646C3E277F239
SHA-256:	0367855BE363EB5FA4CC2AA453DA215B1124EF6C463D3A8EA8328630DCD0008F
SHA-512:	6FDCF955131F8397830B459D71F6E6E615C110456BD656CD2277839455109C0B6C15222A4650178DF895BF8B64A7472943CE84B5407DD92B55AB2246C1FB9D3A
Malicious:	false
Preview:	..........................A....%...........t....... .......(...h...............h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................x.......................................................................................................................................................\|...........................\............................................................................................................................... ...........................p.......8...................................................................................................................................................L.......................................................................P...........................................................x...............................................................................................................................................................$...........................................

C:\Windows\INF\whyperkbd.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x13c8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6900
Entropy (8bit):	3.3746785873963687
Encrypted:	false
SSDEEP:	96:jjYtkKE1tO6UGO3KdRu6xMpe1ErLaG0mLqzvUO0gW:j0i1tUGogJW/L2vlW
MD5:	26DD0E3940E6351F4E143DB324B95B76
SHA1:	C0B5BC1D03D25275088E82CC5FCEE836BCCEBEC8
SHA-256:	0966DFF74E57A56D73718FD18E339ECFFACF6E7215D921B638E65CEAA898BA7E
SHA-512:	8297D90A3A19466508A6A3EBA9C04C810FAC3CBD38BFBFA0A2F76ED097003D0424B53D1E5A3E42A0DEF10FD643E4DD7EC84BEE6514CE48AC5ADD527C77E95109
Malicious:	false
Preview:	..........................A....%...........4...............................8...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................H...........................................D...........................l...................................................................4...........................P...............................................................................................................................................................................<...............................................................................................................................................t...........................................................................................................................................................................(...................................4...............\...................................................................................................................

C:\Windows\INF\wmbclass_wmc_union.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x21c0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	15404
Entropy (8bit):	3.7220844909306883
Encrypted:	false
SSDEEP:	192:gWwRaWE1z44Kd4tBqJE+QZSGZBZIjNyRZ/8NpXIt3EfW212UMiR93JmQdE:g9RaWSlb56ZmQdE
MD5:	05B8B3BDDB168967011BE6DA08510FD7
SHA1:	2CFBE54FE6D69F511322FBE311F71208EDDA5C67
SHA-256:	70C7D739176E04DA9714013A3D41106D2521C3EB20C127549B9F096C7BE9BE98
SHA-512:	A4F5F2E3E2BBBFB9D01199560E9D52F3D0C3E1AD5E9192D02229B859C83D916D94170884480D19C39C9A5EC5018EB11EC242FE3A6CFB60EEC67179EE7D777D12
Malicious:	false
Preview:	.....................!..<.(....yl..........0!..0...."......x&.......,......X4..h...............(<......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................................T........................................................................... ...................\|...........<...........p...l...8.......P........ ..........................................................................................(...............................................d.......................................................................................................8...............................................................................................t.......d.......0...............................D...........................h...................................................D............ ......................................0................................................... ...................................................................

C:\Windows\INF\wnetvsc.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5c08 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	42796
Entropy (8bit):	4.017565091181754
Encrypted:	false
SSDEEP:	768:eXCe43041tmXDT4ZuG5yZqKfiv99FlzpBimDNmctnYOPtKBRjp8YEDc:ej43041tmXDT4ZuG5y5c9FlzpBimDNm/
MD5:	AA273DDE5EDCE64EC9336A8FDE94FC9C
SHA1:	83A33B8CD0C6ADAC4F9387F1A567D576AB99D6DD
SHA-256:	108275864F5C42F926800CB4D4920C7EE1FA7DA588F908CDB5EDF9CC9ECB1366
SHA-512:	8CFC790644164D236FA95343F4C232337542E78FEB1D1266F843B5C015DA343C6D4A73D35D8591D167B0E60C97C60CF188EB33BC4B30D42B21E6EA6AB059250B
Malicious:	false
Preview:	.....................\...$../.......0.......t[..&....].......`.......r..........h...............(.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........#.......C...9...........!...%..xQ.......+.......6..........8....N.......................C..........l!..........................81.......5...............#..dS...................Z..\Q......,R..,0..."...=..p7..tV...:.../.......4.......F.......4...E.......9...........E..@:......P.......TG......P;..................................D....... T..............4 ...;... ...G.......#...S...*..\|Z...C..............\|B.......3...3...F..$/.......&...............5......X............-...9.......0..4P..........4............................'......$S...............3...5..H...........................................T1......\....4..t5.......F...Y..................\|H..X3...4...............O...................+..................46..........."..,Y......x...$7.................../..............................8....A...[...........#..x#...N..T........(.......C..LB...A..P-..

C:\Windows\INF\wnetvsc_vfpp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x14d0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	7156
Entropy (8bit):	3.353734536880653
Encrypted:	false
SSDEEP:	96:6arXRdRu4J6UkLUOz0AGfRrqWVkKbKQUF:/7vEytRP2r
MD5:	A8BFDFF1267F180B9D120FF5F98DB895
SHA1:	D5FDC1A5FE6C422130CBDFDFB43F7E043CA68438
SHA-256:	3FE840E7F7FC215A8861392010EC2526135B76F499565B3BD7CA6E4E88DBD5DD
SHA-512:	D9CA0AF73DCFF018589AA8776235087C99F5683115D5FD116C2CCAFA861FB547EF437F0B9FF089B5D5F11110B4E2E5930ADEB1B7102EC15BF066309BFAB948DD
Malicious:	false
Preview:	.........................MD....}...........@...................t...p.......0...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................L.......................................................................x...........................................p...............................................................................................D...............................................................................................................p...0.......H.......................................................................................................................................................p...............................................`.......................................................................................L...................................................................h.......................................................................................................................................

C:\Windows\INF\wpdcomp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x21a0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	11956
Entropy (8bit):	3.7008559171647035
Encrypted:	false
SSDEEP:	192:ZrVbnZpxTEDwt8LwqWd/tisfbaYQvwLDNznw+rKCiRNR8hRX2zqRCrCURC2RpRiB:pVbnZFdvfbfiT41EeUE2DEc75P6tt1
MD5:	1D2FF279C01ACE3CE9B6DE1D35B3A95B
SHA1:	7D9BD158E0043A3A19BFF7137827572C452085A0
SHA-256:	F59A6920D0A32920ABB72C258CB7BAA2A6292A77EC773C289ED69D38CBA15BDD
SHA-512:	40949E5D27099B6B02BDB05D5A688E5F7FC2170E77876D216C0556289DA827E19BC1635467EE369A9AA55A98C44A73AF86D327424654B0A50025946C7535C220
Malicious:	false
Preview:	.....................!....t./.....q..........!......."..l....%.......'..`...P+..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................................<...........................0.......................................................................................................................................................................................................................................................................H............................... ...................................................................................................................<...........................................8...................................................................h... ...........................................................................................<.......................................`.......................................D...........x...$...........L...........................

C:\Windows\INF\wpdfs.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1ac8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9388
Entropy (8bit):	3.5814162974150787
Encrypted:	false
SSDEEP:	96:1FHPW9W3NKeMzTJpQ7X21kFR/ihrGlsIdjJuUTgrMUeOg6lyKIYTUnpJTs0eZ70E:lNjApk/dicsmjQUTXUe/8iTsKTn48Q5d
MD5:	C39F7E6A1909A1DD9B4544C9D0A5B71D
SHA1:	75501EF1EF110602AFA64C751850E1A58514E9A4
SHA-256:	1BA753871141597B75C05D4677D63B1A86FCA0B440F50B54AB4B8104E30EDFCE
SHA-512:	C207DB947581C28A471C14E631DC99C9FE7F0C33D3DCACF28A2533E386629C111AE7F196341C1B3D365126EB2651A8A5A5692FFC5A39EA2D429EFF6AB7DBA7F4
Malicious:	false
Preview:	..........................t./.....q.........8...........\|...@...4...x........"..h................$......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......p...................L...................................................................................................................x...................D...........L.......................,.......................................................................................................................................................................................................................x...............................P...................................................................................................................................................D...............................................................(.......................................................................................8...................4.......................................................X.......................................

C:\Windows\INF\wpdmtp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x32e8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	21076
Entropy (8bit):	3.899994783992621
Encrypted:	false
SSDEEP:	384:NvsIRd2L5qc/JCx8aFbwlYYvGTgA6YDt0u2gUQtebjZ:RsIR0Uc/JfwYvaDtZI
MD5:	CD8BC000DC6E382AE383E1EC07344898
SHA1:	DED8FFB0DE83A190472BF9001AB271622F6A8787
SHA-256:	6EA67182D9D2CF7A94EAD36868D323367AC5548E1FF3A8368E355B38047D1272
SHA-512:	AECC379CCC8876E13733E4F54624662A25FD833D868BEAE6719B90C590249CA348D490DA4F3C7CA7566A91CC8D8249C61B568ACD295099AF89D5D08633101BC2
Malicious:	false
Preview:	.....................2....v./.....q.........X2..>....3.......8..D....@..$...(I..h...............PR......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........%..............T1...-......H.... ...................!...............................&...........(..x........'..................0...............4................................'...............+...&...........)..........................................\...........................................P$..........."..........................................L...........H.......4................'..................................L....................1..............................x....................................................$...........#...........+..................................h)..................................x/..81..............$-...........................................%..t......L#..8.......#......................./..................................T...4.......................D.......4...@............................$..........."..

C:\Windows\INF\wpdmtphw.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x11f8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6340
Entropy (8bit):	3.3156449740270046
Encrypted:	false
SSDEEP:	96:+Xgk4Ggf0GrDxRKJh4TiCHq5YLerD3oSQ:Rf0Gr1UJiTi1YgD3u
MD5:	0D8CB935957C415B37CF05CF9675C88A
SHA1:	12C6118B5F56F2692D7595E3303705688AB4673A
SHA-256:	96EDCF09877C59C392D3C22569F645079F14E8A84AC78053D3B50A7B212BF413
SHA-512:	384FC5AC80E31AB07B054376CB40BE5F80DE867CA6879683774D478600EF586D7D9F15FDA87A2BAD864804E440F846DDE49049C6FC00B67E6D916C34F5CFAC7A
Malicious:	false
Preview:	..........................F......q.........d.......................`...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................t.......`...............D...............................................................0...................................................T...................................................................................@...............................................................................................................t...........................................................,........................................................................................................................................................................................................................................................................................................... ...................................................................................................................................

C:\Windows\INF\ws3cap.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1520 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	7444
Entropy (8bit):	3.436832807214026
Encrypted:	false
SSDEEP:	96:sI39Z0J61Q0oCMibf6t6VCR2lMj1FGufta0CTs/VpZenxoMbUiXO:rZTMibCgVCCMy4HroW1
MD5:	E2EC1C9FFFB0541F8D032DCB6244E056
SHA1:	C28DFF9359285020347A57E83967E65A8BF5DCDB
SHA-256:	6B18EDD76F348B457676E612C692000C8FC41505C23E25F4FBD49C13A0091059
SHA-512:	55B10AA6319D67072B59B378B8417CAC3C5EB5F383D5E896B329DD5A8EA728A6C10026B5CC314C2AEC0BF862C6539306158F68524D8C9C054E506ECC982E4C7A
Malicious:	false
Preview:	.................... ...]w?....%...................8.......P...................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......L.......................,...............................................................................H...........................................................................4...........P...h...........................<.......................................X.......................................................\|...................................................p...........................d.......................l.......................................................................................................................................................................................................................................................................P...................................L.......................................................................................T...........................................

C:\Windows\INF\wsdprint.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1798 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	8172
Entropy (8bit):	3.5307674789558923
Encrypted:	false
SSDEEP:	96:poGTKO4SB7CqcrctPe1/YR56pV2GZ1b+FmezXmG0RiatKj3HcdJsl:ixlOdn6PK9bfcdy
MD5:	CA630302DD273E781FDF307AF389F3A4
SHA1:	228DD71247546B1A8AC9BDCED8EA62FA95632D41
SHA-256:	52AB14DE9F966F10D2F4220846DA83C1FFC37319A0754841F008214ACF9AB7DE
SHA-512:	4D2BAD27AFB57A58E475CF0E62184C37853CC2348837C32F1D38C85F9DC07403639BFBD70533C09F3BA83E606C6DE5FC8DD9EDBA59EA024E22137074A3BB011A
Malicious:	false
Preview:	................&.........../....#......................,.......................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................................................................$...d...........................................................................\|...........p...X...................................................................................................$...........................................................................$...............................................................................................................................................................................................................................................................................................................................................................<...........\|...8.......................................................................$...........................................

C:\Windows\INF\wsdscdrv.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1df0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	10452
Entropy (8bit):	3.6620173963520912
Encrypted:	false
SSDEEP:	96:HxqjQu0S7D6Y00+wQ45mRpHvAU481Gn6EqSGmP74S4/7czjUa2aqqtvYIQSGxSI3:H6DU3HSGEq6P74S4Y/Y3xHWO
MD5:	18B1053932F8A79B84BF2CBE79F57800
SHA1:	F120B114C4093DAFC310224EB2A96618A8CCF571
SHA-256:	453FDE63A83718FBF8F5711E68BB46586A8FA89C7D2F479E587230A221F46E7E
SHA-512:	FEC6E66CBFAE7B6C3E3BFA28AF8F0BF8F145B1AB75963F7ABAE916540D9BE8F8962C746A1302C9254DE2F4D09EB81BC8CCCA3BB4809FA4A414FC00C936E98964
Malicious:	false
Preview:	............................/....#..........\...........@...H .......".......%..h................(......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S................................... ...................P.......D.......X...................................................................................................x...............................X...................................................................................................................T...........................................<.......h.......................................................................................................................................................4...................................................................................................0.......................................................................................h...........................................................................\|...........................L...0...........................................

C:\Windows\INF\wstorvsc.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1778 "signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	8420
Entropy (8bit):	3.540438777763426
Encrypted:	false
SSDEEP:	96:wtIds+7R+GCwDrg+Fx4Ij0Vy707lqoi1rF6xif2cneXHtFhj8vvgHRiUcIPn83hS:wawGCyFRwVeEAo1y2cne90vvgcPo85S
MD5:	6C1D29B2A0F7B83C6E4E82B10FF61EEE
SHA1:	B2377882BA7965803A5646582B7B3871653BDAD4
SHA-256:	A1936178ABCFC1D1100BC6D45E5FCF2E637DD752F9C58C9B880407FA7B38F201
SHA-512:	23FEA84EDF5C45B6DEC4E7E6C33B6A4C802AD427FEE785528AC49C57204DA6AF93CAE9E48FE370C9522FF8A8AA2408397641B31EF0817C7397E2825839D959FA
Malicious:	false
Preview:	................ ...x.....A....%.......................@.......4.......d...x...h................ ......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................................@...........................................................8...............................................H...................(.......................................................................................................................................................................................\|...............L...........................0...............................x.......................................................................................`...................................................................................................................................................................................8...........................................................................................\.......................................

C:\Windows\INF\wsynth3dvsc.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x16e0 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	7468
Entropy (8bit):	3.522097710078752
Encrypted:	false
SSDEEP:	96:59tODvvIvRCB7WG986V1G+PBOyCnSlQL5+lnLT0LrzLBwUiR0:XuB7WG9BrkVnOgEAKUX
MD5:	672AF69E007119905C39F753DE00DB96
SHA1:	7C8504ECDECD16270BC1BA4457A92FE53B70460A
SHA-256:	B58A1A67CDFE89E0DD2DADB0D3414A71866C06F319D0C5899A5CF83CA9975AE7
SHA-512:	FEBD5A9349BE571FE5E34CBC4288D24EE6CC8C98138DAF470ED2AD78EAEC82491143E6648BB6849DAB436497CD0A27622E2312AC18DF0E5F5C0E3668329BFB8E
Malicious:	false
Preview:	........................'.../...............\...................P...H...l.......h...............(.......C.:.\.W.i.n.d.o.w.s.....\...........................................................................................................................................H.......................................p...................................................\...................................................................................................................................................................\|...........................(...................................................4.......................................................................................................................................................................................................8...........................................................d.......................................................................................................................................

C:\Windows\INF\wudfusbcciddriver.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x32c8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	19564
Entropy (8bit):	3.8722218851076606
Encrypted:	false
SSDEEP:	192:CsSgXvlo3TW3oKouknYWAjEu8IltQlAgV5ixV4h3M:CsSgfEy3oKoukOrcFV5ixVy3M
MD5:	41602987A5656CB9AF721AA6B54207C7
SHA1:	E57AECC9F5E5568FEF138ACED1C0C300ABADF011
SHA-256:	BC261E174C156A869F9D45573BEE13A351C03EC92490274EC247F662DC67EBC4
SHA-512:	E05B502DAA443F3F3350AB007C867F4790A72C3292C9DC50A8613AECAA2D02F567284EF49394339F4D759C702451CDE9272336B6755703733573D78B8A4C8D6E
Malicious:	false
Preview:	................(....2...$......u..........42..(....3.. ....7.......<.......D..h...............hL......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S............................+...............................#......................\|%..............................@...............................................l...................T...,...............<............&..................................................................................................H&..........................\|....................................1..@.......................d........................................................+...........&...................................,..............H....-...(........................................... ............... ........... ...........!.......%.......0...............).......!..................X....................,..................<... ....... ...................................4!..............."..........H-...............-......@.......l...................................

C:\Windows\INF\wvmbushid.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1500 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	7468
Entropy (8bit):	3.4442164425314035
Encrypted:	false
SSDEEP:	96:kVHI2denGQXnoq0FGP31RK6HiORr1CYdBN0u3MwtipvpMx:RzXnsFGP31FCqdKmIvpo
MD5:	56480F87C5BB4194925437F200766F10
SHA1:	244671736624D2E415022BF6B8F30C7D2E5C0527
SHA-256:	2938CC62D76785DA68BEF885A46F7E5F222C5BD36AB65C1CF93A5FF58FE01D93
SHA-512:	FD90FAF48DD0B43BC6E6960B8F1140CA4EB5064EED501E1C52410FA6F18DCD8252A685E4C2EC599B56EB78161EFC2229582FBAE481389D86B689D964AF5CCBCF
Malicious:	false
Preview:	..........................A....%...........l....... .......(...................h...............(.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........0...................................................................@...........................`.......................................................................$...................(...,.......................................................................................................................................................................h...................................................P.......................................................................................................................................................................................................<.......................................................................(.......................................................................................................................................................t...............

C:\Windows\INF\wvmbusvideo.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x15a0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	7684
Entropy (8bit):	3.4476834466495814
Encrypted:	false
SSDEEP:	96:rgexBuZdrNCCui0SGtYAEReWLXec1Sbgo0qUTE6Fj712AmJ:8dNONSGmjNL8qJFj7aJ
MD5:	F329E875580D66637DAA609351552817
SHA1:	EDF1C1423EDF2BE263D70089FC6EBF838B015127
SHA-256:	4D0D28F056E4462CA04AFB6F23B7646C58D02CD7B543AD844892054EF6C338D8
SHA-512:	9693A3FFFFB640A5D4AAB13442F2E5C954DB33FF5C3B0BE13D64908B8F37E483B937FED712F913E289B50022BC61F7891630FE777EBFDAB2B402689F4DDE6B08
Malicious:	false
Preview:	................2.........A....%...............................................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................X...............................................................................$.......................p.......................................d...$...................p.......................................................................................................................L...................................................h.......l...............................................................................................................................................D...........................................................p...............................................................................................................(...................................................H...........................................................................H.......................................

C:\Windows\INF\wvmic.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x18d8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	8812
Entropy (8bit):	3.5952474352959753
Encrypted:	false
SSDEEP:	96:7p0a9eu8WHCer9C0dg4OGNGZIlzGz9691MXJfDCoyy6/42ocSUFLNDF6wahqUg9:cFler8/ZGNGeG8IfDoe2ocSUPF6wagZ9
MD5:	115421A0A2083ECF78A0A821C16D3E68
SHA1:	DBD670BE7A134C9B9B295F47541A6D9DE1015A85
SHA-256:	732727F400F5909FF0B163BF9F87E745CA8AA15ADBCF43B3ACA3D0C80436A259
SHA-512:	BE52B3F285FC12DEC800E74CEEB5461428578CE16BC81E71BB156049286EA7B5B2C3E33E8830CE61C959CC5A82DE57DE8C4F1C9FABF8CB169702340BA86EEB94
Malicious:	false
Preview:	..........................A....%...........D...............h...........l.......h...............h"......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......l........... .......................................p............................................... ...........................P...................................................\|...........................................t.......................................................................................X...........................................................x...................................................,.......................................................................................D...............................................................................................................................................................0...............................................................@...............t...........................................................8...........................................

C:\Windows\INF\wvmic_ext.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1668 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	7796
Entropy (8bit):	3.530494617942262
Encrypted:	false
SSDEEP:	96:J4g6yS/n6+zCKugpNHqn641Okr+egacQ2IPNwy0PTphCr8shiCiAj:JeCK1pNHq6O+eLcQ2IiphOiCiU
MD5:	CE0EE38A71DA4B398FF80D464D651DBA
SHA1:	10742CE09E1B364A3A4D309C246B4323AA953D56
SHA-256:	A5203A5CCA070D75C68400F4792E18823442B39355BA568CA7F364994578639F
SHA-512:	0C590F8CAD5BC6BFFC9A1E2197FBF5CFDB0D52050D4C25149CD75393684B67B68130E613D258CC684F4EF75B2CAD92E22B47B8484F3D1BF5537081E634A6FC52
Malicious:	false
Preview:	....................h....MD....%...................h...@...........p.......p...h...............p.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S................... ...........,...0.......................................................................X...............................................................................\|...............P.......................................................................................................................................................................(...........................................................................................................................................................................................................................................................................................................P.......h...........................................................................................................................\|...............p...(.......................................

C:\Windows\INF\wvmic_guestinterface.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x13f8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6804
Entropy (8bit):	3.409720818422736
Encrypted:	false
SSDEEP:	96:M9mP1qz7+7CBadg0D+GNrs6nJ1SwJm3h+3sJQr8ZsZ1PvSB+LixczlVLfkz2bv:M1Baa9GfF6mSczlZkzC
MD5:	1CB46A62EAE7CF4ECEE2A8BD97029B60
SHA1:	8A5160FCFC34E7EAF4F3ACEDFEF4811B5EF52A16
SHA-256:	05383F2B9AB725E77323C4369B6EF0CA7846968A5B4F483A8BAAA3DF3A805D55
SHA-512:	C181219B58C68825AF367FAF2B424CC9B7A39ED762E37F871CC3512AA457464DE7068D2F5A1040E2515F7FDBDC63E16ACA6D3103B4D5382F04D2D5D9B32727B1
Malicious:	false
Preview:	.........................MD....%...........h...................t...`...........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................<...........................................................................d...................................................\|...........................................0...................................................................................................................................................4.......................................................................l...................................................................................................................................................................................................................4.......................................................................................................................................................................................l...............

C:\Windows\INF\wvmic_heartbeat.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1358 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6644
Entropy (8bit):	3.3708601594014342
Encrypted:	false
SSDEEP:	96:TWF4xOOtdj0v0XCer9C0dgJuI6E1/Z4TKMteYbFDzoLfkz2bguN:oogXer8/JutcyeYb6kzWN
MD5:	1291154173FF20178B771A3BD2C1477F
SHA1:	D5CDCE6B9D7946860F4ABC312A5D4497B431C96D
SHA-256:	7CFF7EE410683F08382DA3568277F33049387165D69B20B2C0E2347FD43C924C
SHA-512:	BE4EC2F2C79D7DD3C851F176FE861C64F6682303A079C6A58691B4912E056CAEB5D0739D6B6D3840AAEC28DE35A482102A7656A2ADFDCB6DB5A2417922426A53
Malicious:	false
Preview:	....................X.....A....%...................X.......H...t...........X...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S................... .......................................................................................................................................................................\|...................................................................................................................................................p...............................................................t...............................8...........................................................................................p...........................................................................................................................................................................................................................p.......................................................................................................@...............

C:\Windows\INF\wvmic_kvpexchange.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1398 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6708
Entropy (8bit):	3.4132436266016892
Encrypted:	false
SSDEEP:	96:XCl5Fri+Ts0/60pRzCvHjgkwhkgDUr6w1wk6aw93wXkgVwbkOkSFwDkXfksxyX8v:XKc0AvH0kW9lazVsFfYwkzvA
MD5:	ED2D70F5EE278BD55C8820B801D49F68
SHA1:	430EA1584B901027B77338763A6F14684C34C2B1
SHA-256:	FB4231BD31A9085096AD2C9F095E82C8405316BF6AA61DFEB29E5CD84F087CE4
SHA-512:	F31AB82A0A8F269A221B090E60634DD124334732D2B1DBE7734521812FB06D2AC572BE1127EDDB337EFBB428B81BCE5434ED121F6D7A17531B218C0FAF383639
Malicious:	false
Preview:	..........................A....%...............................t...............h...............0.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......$........... .......................................................................................................................................................................\|...........................................................................................................................p.......................................................................................................................d....... .......................................................................................................................................................................................................................................................................................................................................................................................................................P...............

C:\Windows\INF\wvmic_shutdown.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1360 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6652
Entropy (8bit):	3.395990385118318
Encrypted:	false
SSDEEP:	96:/6WWSRFr/SHCPugYZMGfK6R1/XT/MOjMDnLUebD6il4wMoLfkz2b3UD:19P1HG3zAvbaSkzxD
MD5:	E9CFEA9DB87326834AE0B0063EA7B54C
SHA1:	99798B3B35208FD6A482B3F3374149912C6B81AF
SHA-256:	6BDDDCB07DDE05113DA8D25737190909FE925B86B7B5985E4FD05E1BF8058102
SHA-512:	3F12D26C9E50E550F713BDD9994497F46B003FFC27F56D3C6EAD381AB5D400DE5DD7B47F122D48E733FB98B2BCD00A2852875C640D30576536A7150A9274971E
Malicious:	false
Preview:	....................`.....A....%...................`.......P...t...........`...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S................... ...............................................(.......................................................................................................................\|...x...............................................................................................................................................................................................................x...............................<...........................................................................................t...........................................................................................................................................................................................................................t.......................................................................................................D...............

C:\Windows\INF\wvmic_timesync.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1378 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6676
Entropy (8bit):	3.392338198854124
Encrypted:	false
SSDEEP:	96:Wd10Di+K0oTsCPug5GsJP6a1Y6neqW8jjRJUgE9Lfkz2bO:Dy/P15GscKe18j7Akzr
MD5:	1E5965475E4B18757A918605B469683B
SHA1:	5B4B3904ED850342E4FEBD5FAD17A4A827D4964F
SHA-256:	9DF5F16E5DAD8F05E7DE8ABA4520C6E5583A741F7A9F924C780FF484A7FA9E07
SHA-512:	37A96BCCB63BACDA6665112CCA3832E086F0B03307D1B163DDB220F9A78E1A9B7161A79C986F66C936B125AABE2279BE7ECA48E63625FC26BA282DC2F8190057
Malicious:	false
Preview:	....................x.....A....%...................x.......h...t...........x...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S................... .......................................................................................................................................................................\|...................................................................................................................................................................................................................................................T...........................................................................................................................................................................................................................................................................................................................................................................................L...................................P...............

C:\Windows\INF\xboxgipsynthetic.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x12a0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-GB
Category:	dropped
Size (bytes):	6404
Entropy (8bit):	3.330789345596349
Encrypted:	false
SSDEEP:	48:wdEGj2heZ1Mx2j/1j6U5h6xeOhSeJKNC/u/516Gvsq6R2NL9uxTpQZekI02BE/t:wZ2gYAj/F+1SeJK4/uhAMwR2FcT+ITkt
MD5:	A7F418746CB806F2A8B739B04EC3ED18
SHA1:	E8B8C64D115313BF497DA43B8F26260EAD8671AB
SHA-256:	58E2888C3F2670D824E4879DE0C6176E22377CA6BF816A55EA852D6835E62DE7
SHA-512:	C7A0AF3310B55558D039D837558C68CE07ABA28268A2AA9434DA33B672F495BBE8B06AB89A3D5834B8A5814D163B4C15E62D57D667549C0EFF1B3FFF401CE0A6
Malicious:	false
Preview:	................f.......y.%.....I..............................D...0...h.......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.G.B....... ...............................................................................................................................................................................H...................P.......................................................................................................................................................................x...........................................................@........................................................................... .......................................................4...........................X...........................................................................................................................................4...................................................................................................................................

C:\Windows\INF\xusb22.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1b38 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9460
Entropy (8bit):	3.660186307203171
Encrypted:	false
SSDEEP:	96:eZdn1P1QVCLvC1FgcGieaKcuUNGw1O6wRl6JRpqAzz6luwFanrlaC0/RxVV+gVMn:ePWE+gcXeaKxOXOuoaxuVMgVo
MD5:	5329AB502E9ADF5E227843A8BC274CA8
SHA1:	EF62409DB508FDB431B7D7757F6722B686986ADE
SHA-256:	7B6EF98B490CFEE649D3D0DB1FB1F849DD1A67EB0E23FD29DFD69F8F83E13F47
SHA-512:	F7C531B1A71E5DB360479977D54F9C1B28025D50CA881E9FB77F6DF9F46ECDF7D2D9A1B60398D0DE8B6E71E42B91FF78416CAFB494534FF2649B68DE5DC9F99B
Malicious:	false
Preview:	................"...8...oI(.....I..................`...@.......@...........h"..h................$......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......................................................................................................................t............... .......d.......P...................<...$...........................................................................................................................................................................................................,...................................................h...............T.......................................................................................................`...............................................p...................................................................................................................................................@...................................p...................................p... .......................................

C:\Windows\INF\ykinx64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x47d8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	30020
Entropy (8bit):	4.026979341288671
Encrypted:	false
SSDEEP:	768:HBjVAlaccZkJjIWGjwLOISQrVwP+ZI2JVipte1Ev9o:HBjVAlaccZkJjIWGjwLOISQrVwP+ZI2/
MD5:	EB1BCB3A3D4F911716CBF05D016E0D53
SHA1:	FDA6950176634533408FD52AB624AF4174A43B5D
SHA-256:	B55FB8EFE1145A45C9C6200A108CFFE4533F886412F175798939AF086AE9E483
SHA-512:	006E19CD9D3247CFF5160EE3F3D3B9C7B2DB58B4DAD2B6FA888E15BC1126CE47BECFBF7F74400DC44837DD93D0AA407EB9D953E795ED2BA813A16158BE11E046
Malicious:	false
Preview:	.....................G.....................DG.......H..X...(K..X....V..`....e..h...............@u......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........7...$......p&...&...'..P........%.......%.................. -..........<-.................. A.................. ...............l1..0...........DD..."...#..@$...>......,...@...x=..4!......L)..hF..d4.. &...+..8A.../..T0...E..........x>.......?..P.......\|A...............6......p/......4=..............l........................................................................F...................G..$G.......0...)......,...6...-..P4..4....1..............................p7..`6..................................T.......`"...(..$............... F.......................;..............................................................<B......p...........F.......................................................D...................................B.......(...D......@0..........................d;...............=......@F...E......................,7..............

C:\Windows\Installer\48bce9.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: x64;1033, Number of Pages: 200, Revision Number: {EE37356D-D07C-43F6-8D20-35139031CF9B}, Title: GlobalProtect64, Author: Palo Alto Networks, Comments: GlobalProtect 64bit, Number of Words: 2, Last Saved Time/Date: Wed Sep 11 00:50:57 2024, Last Printed: Wed Sep 11 00:50:57 2024
Category:	dropped
Size (bytes):	66512384
Entropy (8bit):	7.995639510217381
Encrypted:	true
SSDEEP:	1572864:+7lnBQ8U4BfikZwJgJAxw2TrW3TByP+4nVW9ijr1PBrB0OyQjnDXN:GBQr8ietJKwUWK+xg/1PBSOnvXN
MD5:	EE67A64E6EEC29580597358A7860C706
SHA1:	493877CD3362A44D59EDA084B444455F755C3D29
SHA-256:	EAA5E4FB71791A360BBABDF007F50861213EAD504C649C26482D6529D9FB50DC
SHA-512:	155B773109EA2A85C1B17287F370A4946A3B22B5E77ADE0C2D99189FED2FF4FAA573D5C2CA5602F4D6031F491605B0F8B9D3E466EB0E9E1CEE10BE35B2A0E04D
Malicious:	false
Preview:	......................>...................................8...................x.......................................................................................................................................................................................................................................................................................................................................................................................................................................................Z................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...[...k...:...;...<...=...>...?...@...A...B...C...D...Y...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X.......]...o...\...^...j..._...`...a...b...c...d...e...f...g...h...i...q...l.......m...n...r...p...t...s...u...w...v...................z...

C:\Windows\Installer\48bceb.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: x64;1033, Number of Pages: 200, Revision Number: {EE37356D-D07C-43F6-8D20-35139031CF9B}, Title: GlobalProtect64, Author: Palo Alto Networks, Comments: GlobalProtect 64bit, Number of Words: 2, Last Saved Time/Date: Wed Sep 11 00:50:57 2024, Last Printed: Wed Sep 11 00:50:57 2024
Category:	dropped
Size (bytes):	66512384
Entropy (8bit):	7.995639510217381
Encrypted:	true
SSDEEP:	1572864:+7lnBQ8U4BfikZwJgJAxw2TrW3TByP+4nVW9ijr1PBrB0OyQjnDXN:GBQr8ietJKwUWK+xg/1PBSOnvXN
MD5:	EE67A64E6EEC29580597358A7860C706
SHA1:	493877CD3362A44D59EDA084B444455F755C3D29
SHA-256:	EAA5E4FB71791A360BBABDF007F50861213EAD504C649C26482D6529D9FB50DC
SHA-512:	155B773109EA2A85C1B17287F370A4946A3B22B5E77ADE0C2D99189FED2FF4FAA573D5C2CA5602F4D6031F491605B0F8B9D3E466EB0E9E1CEE10BE35B2A0E04D
Malicious:	false
Preview:	......................>...................................8...................x.......................................................................................................................................................................................................................................................................................................................................................................................................................................................Z................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...[...k...:...;...<...=...>...?...@...A...B...C...D...Y...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X.......]...o...\...^...j..._...`...a...b...c...d...e...f...g...h...i...q...l.......m...n...r...p...t...s...u...w...v...................z...

C:\Windows\Installer\MSIC68D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	151963
Entropy (8bit):	7.010635592230606
Encrypted:	false
SSDEEP:	3072:9NtoWqoQ7VWZt6yfzrXC7uZiS4/fpnrar+ZfUoV:5RqXEt6yfzr6t++Z8oV
MD5:	2CB7A7DCECA5A6041701E90F28EF92AF
SHA1:	CB9C43A1CC7C7DED762E2B6C9EFCCE5B57538A02
SHA-256:	5B2C4D27FD2FE7B5D040A81B189B1D8BFDB1A38FE244BB163EC51928478BC955
SHA-512:	470F991BFCD00508045255A2CF08849778CE06196E11AA49E24465631916BA11F91B19B117517C047E9F037F086E987574AD365CA30AC140B4DF65082D23E079
Malicious:	false
Preview:	...@IXOS.@.....@'R\Y.@.....@.....@.....@.....@.....@......&.{62BC3D77-3D5D-4821-B162-5BF52C6B11AF}..GlobalProtect..GlobalProtect64-6.3.1.msi.@.....@.....@.....@......_853F67D554F05449430E7E.exe..&.{EE37356D-D07C-43F6-8D20-35139031CF9B}.....@.....@.....@.....@.......@.....@.....@.......@......GlobalProtect......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{147E1698-DF2D-C421-588B-1BEC0AE53B84}>.C:\Program Files\Palo Alto Networks\GlobalProtect\bmp00001.bmp.@.......@.....@.....@......&.{86766B4C-0308-5776-EEEE-BF0F68AD410C}C.C:\Program Files\Palo Alto Networks\GlobalProtect\libwaresource.dll.@.......@.....@.....@......&.{F7D8C07A-6492-6E55-F9CA-4FD419353CE3}G.C:\Program Files\Palo Alto Networks\GlobalProtect\ConnectedInternal.bmp.@.......@.....@.....@......&.{515B27B7-8E96-8C09-4BF1-4C86A1369093}B.C:\Program Files\Palo Alto Networks\GlobalProtect\Lato-R

C:\Windows\Installer\SourceHash{62BC3D77-3D5D-4821-B162-5BF52C6B11AF}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1707753716844396
Encrypted:	false
SSDEEP:	12:JSbX72Fj/AGiLIlHVRpuBh/7777777777777777777777777vDHFRaBIPXl0i8Q:JFQI58/SZF
MD5:	F76E1FCDABE9AAFC914AC5CA9988839A
SHA1:	ED1F31E832BDE398B1D2C09D7224F4BCFA9CC31C
SHA-256:	F72D64FA8E859C31DABAB088F136CF23334094DAC6404D674FEE096FB509F1B7
SHA-512:	F9FDC7011316D6B75893145FB969A0DFF4573B946A90E9047BC2280358A30D666EC671EC6EEC656E29B0AC6491CFF3CEB2BC79BCE1A48FFD7783C85D07D80640
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.7518825966616176
Encrypted:	false
SSDEEP:	96:5hs1/nTPnPawCYwX70yWC56SEC5wtawbYwX70yWC56SEC5wUcx:g1fLPvCFX70mOtvbFX70mOUc
MD5:	9957C355E6CE6DE7530AEB38AF187848
SHA1:	CA7270B555B270C001C174DE71A2134055ED7D71
SHA-256:	2E5EC0A392A8F42808CF22952EB13BBDD43D99D641D3D6156DD18CCEA60DED7D
SHA-512:	3B4943AACEE4CA25E4EB14B1B90EA7862B2560101DF48B62340C9AB6E7A882F0928826AA7E33EB0C7BF24EB656647AB4831B379741C14B51518C72E0C773AB83
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\{62BC3D77-3D5D-4821-B162-5BF52C6B11AF}\_2AE9C45021E1A96BA1E33A.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 5 icons, 13x256 with PNG image data, 256 x 0, 8-bit/color RGBA, non-interlaced, 18505 planes, 21060 bits/pixel, 96x96, 32 bits/pixel
Category:	dropped
Size (bytes):	110711
Entropy (8bit):	7.045534815219059
Encrypted:	false
SSDEEP:	3072:tQ7VWZt6yfzrXC7uZiS4/fpnrar+ZfUoD:uEt6yfzr6t++Z8oD
MD5:	C9B3419C73FB8A7863C7C84A20B458BE
SHA1:	37BDC9D287BD4D6656C27D45EBA5EC3D611899D8
SHA-256:	8D77C27F2EC9589B9BF797AB8F36045BE5AB76DF5478F4CDDF953B893BD68563
SHA-512:	CED6935988BD203052EBDBEFC0F4D9865569B7697EF513A9E35789BC11B7767D66EF95AA7E4FEF8F21A6AB36739336393C3FAB622CC793E3D7B5CB1DBABBC2B4
Malicious:	false
Preview:	..........IHDR....V...``.... .........00.... ..%...u.. .... .....g......... .h........PNG........IHDR.............\r.f....IDATx..}..]E...}....%....Y.Ge.APt....E.....q.G.q..AG.7..qEpe..AA...A..Y...B.....{..s_p.A...p...vU}U.U........;.}..c~.{o.+..1?..c^........`~...W..c~<........<........1.....x..y.0?...x.+...h.w..{..c.,\.......f...yc`a^.X.g....>.....Rh....rO..?.Z....{y.n.v%oo.v;..nk............Y...............}.......`;...-....>..%{....]...^.......Js...r...(%..r....,..3M...]...s\|..mk..f....L..Nm...~...........n.i.}......`{...,8..#....\|B.x......1.......I...R..).....~p.o..H...%...O.g..../..6V&.+'%b@.....ypz...[~...w.O..&&&...:?...W......Zr.._...........\...h...X.H!........~.....G.%%.v._s...m.WT.....R..... 7...u....&(..}b......L\{./.\|..O........<....n...z...{.S......kc....2..g(......W..+.....Z......T$s?.;;z5..F.N....V.N...A..j....._n.E.MW.[.9....:.7.s>..w...W.......=c..>...~..... ..x.._..l..@../.>..*...7.?...).6...@.b..V.G...G.&...

C:\Windows\Installer\{62BC3D77-3D5D-4821-B162-5BF52C6B11AF}\_853F67D554F05449430E7E.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.168529080708903
Encrypted:	false
SSDEEP:	48:QAW4jSSPvBv0fcxJMVBXO4Ba/dnUASukq+EQItyab+3Z0jpKFTpdd:LFSSxvrJMjXO4B4dnLV+5ItygKLz
MD5:	F1814A363433ED1E413AD7C650414C42
SHA1:	C0DCBE7A66F8AD0B83FD0873CB01D6B4A57A30DA
SHA-256:	2237534A7E9F656C859A5802007FF17E4649D6FFE4F30A844DAE582C14DE260B
SHA-512:	A364A617806433B2895F6BE7B9363117BAC3BB2594496B0C32DEB3E0FE0E6AB4D77C67D7295176DB96A6E8CBF3EEAEEEC58A1D96361CF799EE925BA5CB94373F
Malicious:	false
Preview:	...... .... .........(... ...@..... .................................................................................................................;;;.;;;.<<<.<<<.<<<............................................................................}..S'..%............;;;.<<<.<<<o<<<.<<<n<<<.<<<.<<<........................................................X.......[..M..............MSQIF;;<.<<<.<<<.<<<.<<<.<<<<:::.;;;............................................q.............F..C...............y.FEB.;;<.<<<.<<<.<<<.<<<.<<<.<<<g;;;.;;;.................................D...................O......h.........q.CC@.;;<.<<<.;;;.<<<.;;;.<<<.<<<.<<<.<<<.;;;.;;;.........................`.......................W.....:......\|.CB@.;;;.;;;.@@@.DDD.:::.CCC.AAA.;;;.<<<.<<<.<<<x888.....................`..........................b...../...J.XUI.::;.;;;.AAA.........^^^.........BBB.;;;.<<<.<<<.;;;:................C.................

C:\Windows\Installer\{62BC3D77-3D5D-4821-B162-5BF52C6B11AF}\_F385DCA0A7C7248F54C3CD.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.168529080708903
Encrypted:	false
SSDEEP:	48:QAW4jSSPvBv0fcxJMVBXO4Ba/dnUASukq+EQItyab+3Z0jpKFTpdd:LFSSxvrJMjXO4B4dnLV+5ItygKLz
MD5:	F1814A363433ED1E413AD7C650414C42
SHA1:	C0DCBE7A66F8AD0B83FD0873CB01D6B4A57A30DA
SHA-256:	2237534A7E9F656C859A5802007FF17E4649D6FFE4F30A844DAE582C14DE260B
SHA-512:	A364A617806433B2895F6BE7B9363117BAC3BB2594496B0C32DEB3E0FE0E6AB4D77C67D7295176DB96A6E8CBF3EEAEEEC58A1D96361CF799EE925BA5CB94373F
Malicious:	false
Preview:	...... .... .........(... ...@..... .................................................................................................................;;;.;;;.<<<.<<<.<<<............................................................................}..S'..%............;;;.<<<.<<<o<<<.<<<n<<<.<<<.<<<........................................................X.......[..M..............MSQIF;;<.<<<.<<<.<<<.<<<.<<<<:::.;;;............................................q.............F..C...............y.FEB.;;<.<<<.<<<.<<<.<<<.<<<.<<<g;;;.;;;.................................D...................O......h.........q.CC@.;;<.<<<.;;;.<<<.;;;.<<<.<<<.<<<.<<<.;;;.;;;.........................`.......................W.....:......\|.CB@.;;;.;;;.@@@.DDD.:::.CCC.AAA.;;;.<<<.<<<.<<<x888.....................`..........................b...../...J.XUI.::;.;;;.AAA.........^^^.........BBB.;;;.<<<.<<<.;;;:................C.................

C:\Windows\Logs\NetSetup\service.0.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	458752
Entropy (8bit):	0.4223592337912155
Encrypted:	false
SSDEEP:	192:vLZm8DmT1xMS92sICkjd0x5AUko5HOLboAcKYzFlgbm8:vLvM7mjhRoZO/oAPL
MD5:	CEC080E5EC9EE192153D6DF61386335E
SHA1:	56C5A20998FFF8EC98B02654A1FBBC4ECC0546AB
SHA-256:	2002242D7F28F318E299C7260755A91CA9762EF08ECE5297EDB73005C94178F9
SHA-512:	997518D9251AEB22E9A513B73F35F4DC469366FDE0FCB9DDE9D90C6BDA225AE7677FC795D977825E6CBF0DA48198E6711952B0BBFDD890DFBFAA335A7945D481
Malicious:	false
Preview:	....8...8.......................................P...!....................................?......................eJ..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.6.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.6.1...........................................................@K5..............?..............N.e.t.C.f.g.T.r.a.c.e...C.:.\.W.i.n.d.o.w.s.\.L.o.g.s.\.N.e.t.S.e.t.u.p.\.s.e.r.v.i.c.e...0...e.t.l.........P.P..........?..................................................................8.B..?......19041.1.amd64fre.vb_release.191206-1406.....5.@..?.........gP.......U..l....NetSetupShim.pdb.b......7.@..?.......I.[.8+m.!N8$......NetSetupEngine.pdb......4.@..?.........>*.....Nr8..a....NetSetupApi.pdb.........4.@..?.........E_iC...F........NetSetupSvc.pdb.............................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	364484
Entropy (8bit):	5.36550037881296
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauC:zTtbmkExhMJCIpEN
MD5:	0BE3D293703ACDCCC07CBA30447E01B2
SHA1:	A396A114E2643F443E56EBE2AB3023554735E9DE
SHA-256:	BEE324956AF9721A2E5B2428111B71497ADC1BF99DE552177E7199A1A83C62CD
SHA-512:	7BDDBE47F14C3382E481A08A037F2BDB71256910A847C4CC031F5D3BFEA7799DB9DE3697AC4A084866B362FC388B30310D29F43A0A92142A5065B9FB7B3F8587
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\DriverStore\FileRepository\athw8x.inf_amd64_55014eff4ceefbdf\athw8x.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x191e0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	230388
Entropy (8bit):	4.250825732891992
Encrypted:	false
SSDEEP:	3072:YiIKPYMf4q1S3j9gRVb4JKsBRybovrnx0K5kfTG7zc:Yp+RiMsBIbovETr
MD5:	6271B1F17D80A6A05288A4B45C860F1F
SHA1:	811A38D65F26633E2CF80ADD60E527D472DE5031
SHA-256:	6DE647224814CF8BAFD8A77F6F462CAB340CCC8FA42EB15B1CAD3B646CB0690F
SHA-512:	24C8BB4C347E8E0BCE2AD4120B61933F18315CE45C09CA6BBECEAD43C1F9963B99B8A63E09F64DECD2E06B5847346AE2E6C25AD878C5D6EB2281A9A7B12EBF1D
Malicious:	false
Preview:	........................oI(......t.........L...........$.......\|..@4.........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........X.......@.. E...\|......N......t...................h..../.......=.......U...a...\|...F...D......@p..<q...+...P......Ti..4............... 3...\.....0...."..p... j..........\|.......`........... ~..D...\....m......P...L...p5..D.......T...4................Q..4....s.......i.......(.......s..H2......P-.......m..lu...+......HN..8L.....L....k..........,...`...\...$0.......~.....d....................g..xd..$...\............f..p&..,{..\|h......4b...Q..........L...............h...........4...D>..`.......Hm...,...-..8....}..4...................\|.......d-..8,.......'..8......l...\|...........<...\w......H...`D..\|......\g..(.......t...\.... ..l#..............8....\|...!..(....-......XG..,P.......y...'......$Y...&...O.......`......./......8.......\|....B..tH..pl...v......4W..l7..t...(%...0...........W..P8..(M...d......T...............pN...*..................

C:\Windows\System32\DriverStore\FileRepository\b57nd60a.inf_amd64_77a731ab08be20a5\b57nd60a.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2da58 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	473236
Entropy (8bit):	4.466780069050446
Encrypted:	false
SSDEEP:	3072:AVWijelt5v9fIAGCpYLKCVurCACB1EFQ37f9qtpThTyDtN85hlLBmZaaAAhsnsuA:KWFG1EX8yl07btv0yb5E16u7G
MD5:	6D9E1F737D4D32F74BB54A237DB3D8AC
SHA1:	1A05AE4CF5A9FCDC43BBAAB4C5CE37B06E7EC67A
SHA-256:	5ECB87B13C40540F95F401FD3CE608736464CAD08D87D3F9FFFCE91A5624CFD0
SHA-512:	8CC0E243EA99122F1F4FA487ED19C801B20BD282AEC5F83C41A08E728B26B7858DB507E04AD25699EFDE339770241536822971EACD8BEA76846A2893F34872DF
Malicious:	false
Preview:	....................X...QZ.........................h...LJ...%......`8......x...h................8......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........8....x.........d....Y... ...X..............Lo...6...........5...+.......C...8...g..@...8...\|...dY..H....:..$O..\|............R..\|c..@.......,... ....(...x...-...)..$!..............T......X....D.......S......HN..DJ...g...Q...,..(........%...N..h...X....0..0...............H..,K..d................l......d........b......\I..8r..$'..X............8..P....z...W......................T...S...6..4U..<....4......0....P...-...-..\|.......(...<..............`j......P`...X.....t`..`....F..h...lC..<i........h........J...O..\u......l... ....q...%...........#......R...p...c..d....7.......7...8...V.......+......P....D......d...4....g.......S...J..x.......@q...)..<9..<...(...x...4D..........\|m..\;.......g.......u...h..,.......,..............<....=...........[..."......\|'.........0...Pn...... ....j..Tk..\|...l...(....9..0...0:..l>......{..\|...0.......

C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_e0bae6831f60ea5f\bcmdhd64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x6718 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	47348
Entropy (8bit):	3.955808562898789
Encrypted:	false
SSDEEP:	768:QDfhN+/JOvHyqtx5FkaiyTO+9z0mDWBPZ:QDZQ/JOvHyyvFkaiyC+9zpWv
MD5:	FABD2EDCE6B1841BB6A33BF1E758E4A1
SHA1:	3A30680CB061ACEF7412AFADD508B92698AC1E32
SHA-256:	616099DE8DA3DE2291E3637B232AEA93539669201F2298A39EBD0A6335FC2962
SHA-512:	A5DEFC028A3956F108FBFE3736D14950C60396638E939651C21CAD465DC334DBAB136C505B775B1CBAB15E723A57274B863A5F323075F5BCE181F9000667DEEF
Malicious:	false
Preview:	.....................g..oI(.................f..$....h.......j..............P...h......................C.:.\.W.i.n.d.o.w.s..................e...%......./...E.......]..P...............................T4...U..HW...!......x,......l/.................$........C...+.......R...=...0.................. 4......LI..t>.......=..p=..h@...X...X...X..<...<.......TE..`5..8O.......Q..D...@...t<.. c..,R...............5......N.......F......d...........O..........pc..\|c......\3..$3..@(.......V...,......</...S...C..@B..........\|O..$D...W..4....U...]..<U..<H...c......de..pV..0X.......c.......B.......F...........7...^...&...^......\".. _..D_..`_..(Z...Q...Y...(..........(..._..dD...7..._..07......x=..pI..pa..L1...'..l%......<-...H...W...........D...Y...D..."..<2...?...e..H#...H.......(...................;..\|[...........6...-...).......b..L>..TU...........V.......U.......c..L@...........>.......4..d#...1.......I..`H...........]......................<D.......... S..h]..<...XX..."..L)..........P...........

C:\Windows\System32\DriverStore\FileRepository\bcmwdidhdpcie.inf_amd64_977dcc915465b0e9\bcmwdidhdpcie.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x54e0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	39780
Entropy (8bit):	3.977144312598977
Encrypted:	false
SSDEEP:	384:A1gzAOE+OT1sNF+L2v3RR0JKDW/Wcjm7hzJh5BpPqTWuiWIXUROrWzACEeSGFdnl:XJFe2fRR66zJnB0TWuiCS1xlB7BE
MD5:	6695F648B824647C2649FC4E25224674
SHA1:	D7A2F06E1C4EE4001B49D48D4507C8B29CC81640
SHA-256:	A84A470E400C22A6E0E0985E59E17F8F6A4D3E43F0A6F89C4E8983DAA33230DF
SHA-512:	C65CD988BBBCF1A32F2CFB373BD387950CC10AFDF64989784A5AF990160EA2100EA91BB430A06CD107F4516FAA707430477AC7750EC1DB383CD3B960A2310E34
Malicious:	false
Preview:	.....................T..o.*......t.........LT.......U..X...0X.......j..8...(...h...............`.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......h8.......=...............-...........K..\.......(R.......................1..dG......P........'......8-...........$......8.......X6..l%.......D..\9.......................1......./...:......h...T9...;...6...P...,......P............2...R.......J..P...T...L8.......C..X.......$....3...$...Q......x.......P$...........R...................)...........".......G...(.......-..\E...?...I..............p?..\|?..H....F...K...F..@2......H........H.......Q..............................."....... ...............&.......................#...................?...........F......................L"...4......`(......................t,........... ..d;...O..X...0B......(#.......................................(...$.......N...9...'..........\H.......F...... @...;..$........9......,2......./......hA...N...........K...................?...?......p....D..TK...........(...#......

C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_b06c3bc32f7db374\bthpan.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1e30 "Provider", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	10972
Entropy (8bit):	3.661802503981105
Encrypted:	false
SSDEEP:	192:yLVV2oEVWkJAMgL9wjaSx/0ZDcVgWs3y3aj2aX:yLVOXNgL9ZS2aW3copX
MD5:	44B37D3C4A87F3AAC3199573A5F5E841
SHA1:	D576521A8799EED2BB712C746822A0D4CE5EA219
SHA-256:	314281860E888DD7D5532D0C07601CEE38BECFB4EEB64C0AA799BB6B6E3EFD4D
SHA-512:	0AB1C5F5DA739CFB5695BC206B13497299D3BC62831500F84C3B27ED582655ED4C00B7C99081661DC01DB38F65FCB026F9435086496BB55E92282AD10599E589
Malicious:	false
Preview:	....................0...Z.{........................@.......X ..<....#......8'..h................*......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......................................................................0...................................p...................................L...............................H...........X.......\|...T.......P...........................................................................0.......................................................................................@.......................L...........................................l...........................................................@...........................................................................................................\|.......$...............,...t.......................................................................0.......................,...................................@...............................................................0...p...........................

C:\Windows\System32\DriverStore\FileRepository\c_net.inf_amd64_32a9ad23c1ecc42d\c_net.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1550 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-GB
Category:	dropped
Size (bytes):	7412
Entropy (8bit):	3.4567736061473333
Encrypted:	false
SSDEEP:	96:uJdaioQpdr0rHgnbtR/gokF1HO3tBlAry7mv4rxNPGFULjZC9Kcb:uvYHgZ5kF1CynvKLCl
MD5:	DFC1F153C1142A3EB093DA41F764982B
SHA1:	2FCE4089F52AD7A5F91E6C8626BEEEA6106A0AD4
SHA-256:	3EBFC47CFA7453D75DB46614F57E048FA60F78D0E2830EACFA2FDCFB8A782303
SHA-512:	CAA97A70135B815F6927AFD1AD53FFFB9E673FDEC665736F105299F7D12A3D48B0A7488D4AAAD5837B5308E7DCDE8D9C25FAE755F8281CA2ECC3C6AFB5D01543
Malicious:	false
Preview:	....................P...../........................H.......8...................h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.G.B...................................<.......................8...............................................l...........................................................................<...........................................................................................................................................................................................<...............................T.......$...................................................................................................................................................................D...........0...................................................<...............................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\FileRepository\dc21x4vm.inf_amd64_3294fc34256dbb0e\dc21x4vm.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3328 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	22988
Entropy (8bit):	3.8043005899743374
Encrypted:	false
SSDEEP:	384:uY9KGffKgVhh9Jv2KCB9SAXIjsPaVRI86Mhm65rxa+iDv7G3:x9KGfvj9JmHMtwDv7G3
MD5:	815621AE92CE7FF83AE78135D6BB0B4D
SHA1:	9E42D754847BA59E2B158CAC57EEC25A15C239F1
SHA-256:	E31F9FFDEB95D68158C62065D35F69DDC042FFEDBF94067667C2D27410F81E68
SHA-512:	8862BD45494036649836A65499C8C7CF6753D9AC783F9807E9BC5A49AAF82947463DF1089F82A2887B4288FE45A742153A7421EEAAF82438A827FEA8B97B1AE0
Malicious:	false
Preview:	....................(3...MD....}............2...... 4.......5......h?..0....L..h................Y......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......<................-..........x...........................................8-......................x...........L...............\...............$'...1.......'...,...........+...........1..D...p"..8....... ........#...........2......0-..........d .......,... ..h............"......<............$.......#......t.......p................#......T0.......&...........'......x........2..0...........L%..d%..L'..\|%..p%..X)......p(...............'.. (...........$..............D&....... ......T,...........$......L#.........................................................,...........%.......#..<$...-..T$...............#...........%......0$..T...........................<...........,+...&...........................0..............................<....................-..(0..................................`$..............L............... ...........................

C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\e2xw10x64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4ad0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	55036
Entropy (8bit):	3.859094523282001
Encrypted:	false
SSDEEP:	1536:QXugMl1mWqSdP5zq2JbVdxmhkGqw17wv3v83mEO2lt8YF2lt88F2lt88N2lt88a:Q+gMl1mWqSdP5zq2JbVdghLqMN3mEO2b
MD5:	A543F0E59F9C0D9BC9CA7DDD24EA1098
SHA1:	62980C687B52658CAFAC8B9AC0059EE335A56391
SHA-256:	0170E149BA81DEE6B25C20B96544D16B58A8D82EC2246B2D219B7A324D067D62
SHA-512:	24E6FF80AFF44151C0B7F19C8C77047A7C9967553C4F2191024339C4BE4B2F05FD367F06ED615F7F3EA11D0E7BA2B4D6DE7AEF0E806705A081EBF29D960D7BCF
Malicious:	false
Preview:	.....................J...b.................<J..1....K.......O..x!...q...2......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......8+.......H......L#......@...............\;.......0......,F...C...5.......'...........:...7...9..........X....7..................\|(..........d.......0?...?......@@.......8.......C..\............&...+...(.......6...$...)...0......\|?...@...#...@...... /.......C...0..............($...'...E...........................7..........................(D..............4...p........+...I..`............8...1..HA......L'.......:...........$...B.......B...F...(..........`D..........(2...$..........H...............8...t.......,:..(...............................`6.......................................................,..\................2..<,..............<........3..$+..."..X'..T4...4..L....................'...............:...........................,....... .......!..P"...........8..........d...DD.......:...3.. E.......I..8I...........4......xC...A...3..,.......

C:\Windows\System32\DriverStore\FileRepository\ipoib6x.inf_amd64_ef71073a5867971f\ipoib6x.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x7b50 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	57668
Entropy (8bit):	4.040520490177727
Encrypted:	false
SSDEEP:	1536:oCUSZKDuJJY4xLFhTAQh3HSnUFwmLTp4Pq:oCUSZKDuLLxLFhTAQh3HSnUFwmLTp4Pq
MD5:	70506EAEED853826442503668B1BEB15
SHA1:	576D3A9B5FA9AA59CC9B4B62CC7EE085C9AD7BB6
SHA-256:	D4B652FB0163F262347B305CEDC223C9FF9C90BE3D2112BBA4E1A2F4039C3396
SHA-512:	5162183B6DA4DF64F6E53C42D319213884F2C3BDA21FDC35DA393809366E971447FFBB2B42AFFB9974E98849822CAEC1580C491434CE161569B20F1491689523
Malicious:	false
Preview:	....................P{..w..................z......`\|.......~..4...P...t$.....h...............@.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S................Z..hn.......f...7...f...................m..Xv...u...............j......D....?..4[...a...B...6...Q.......................5.......A...a..Tw...8...7...\..x9...]......d........x...`..Pm...9...7..l...<S..,0......\4...=...........v......Pj..P5.......p...............m.......R...........3..\Z...S...N..............d...\|.......0....F...y...l..$O.. R...0.......1...6.......F...k......@8...V..ta..................pV...3...]...R...q...0......x3..$o...................[...c..<...(...<...h`...h......$i..........`....m..........po...............;..h=..........$....V..,6...9...........`...n...........0.......l..tz...z..hg..$s...h...s..........."......Lz..................t...............<2.......$......4`...w.......a..............(l...........t..@b.......w..4....S...........B...........T...r...Y......d[...................v..0....Y.......[..T...Xn.......b..

C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_6649425cdcae9b5f\kdnic.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1a60 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9604
Entropy (8bit):	3.5374191552831293
Encrypted:	false
SSDEEP:	96:WVVE0TPx0N76qJmM5cl5Zl5YR35FyIBU/bz/0Dw6VDLvDqxE/V6byIMrmP1+9fYe:W7xL6JmMilzlutYUDLvAEdZmP1PHI
MD5:	DBD94ABA0A9B37A601BF3D345ECDBC19
SHA1:	66726B2D4FB1F890B9A0B2DE35967C58A1312C06
SHA-256:	2CDD50712C62AEDAC6DE3AF680184DB65765C41B3BC44FD2595E6994DD43A5D4
SHA-512:	D8E48B05E16D1C6A9217950FB979A5D2B9BDED2384ABE1101174DBF7DB3253A167C7269A2B7524EF93AFFA645BBD7AA13B2945BE587F782C52E86F55EC363A45
Malicious:	false
Preview:	....................`............V.................p.......(...d............"..h................%......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................8.......................................................................................................d...............(...................................p...............t.......................h...............................d.......................\|.......................................t.......................................................................................\|...........................................................$.......................X.......................................................................................................h...................................`...........................................................................H...........$.......X.......................................................................................d...$.......................................

C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_07fc330c5a5730ca\mrvlpcie8897.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3080 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	21388
Entropy (8bit):	3.900352728422151
Encrypted:	false
SSDEEP:	384:klIA2i6E0WQ08tZ4OfQJYbmrNj1RPhC4AI6X:E2iP0WjuQJYCrNj1Rg4q
MD5:	F9A3D1C63B6D09865A4E016549DD0E01
SHA1:	5CCDA5430162138D1FBD96E142C05C2F89068BF4
SHA-256:	E54866587F2F42B7901F05E2F17A6486CB0FC297F66C95F407F44265C0A4C584
SHA-512:	3EF15FFD19CF163CA674BA2362FEF1D9E7DA1CAAED60BD523CECD01651DA9B0686AE3EF4B327654840096A11EC3E67B7AF633AF376A0B2A856980A6D25D72E81
Malicious:	false
Preview:	.....................0...].......{........../.......1..X....3..p...X<.......G..h................S......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............,..................8............................'...)......................................h.......T(..........h........................!......4...(...x...........h...8................ ..P...............t....#......................."..................D.......................x%..............l...............8.......................(................).......'..........h+..........P)...,..h...&..........h...$....)........... ..L'.......................................................,.............................................................................................................. (......................................................................t-......p(...................!...............................'...........................-.............................................../..8/.......(......................$.......

C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_97bef65a8432edd4\msdri.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1390 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6948
Entropy (8bit):	3.3640404367318393
Encrypted:	false
SSDEEP:	48:ZoQN6ymXAaAXQtkgyd8QHqj55qzuiQg4+nzM7uWuo9EVvgK01xe2pe87+YUhzQ9p:6VyzanRyd8QqMXQMzMKEtEz6oC8Ixj1
MD5:	E7F5C655559E8391ADBCFBE54C0113DF
SHA1:	DCC1D1A2558932E589F273C6FB5EB760663FE74B
SHA-256:	697D7ADAED4954AFF47D989BF50422A3F069E1CDBDA076BD7EE2CD32ABB5A773
SHA-512:	C70C75481042651229101A9CA0058DC5D4BDF6F7FD5C5D0D6C7E6580CCE4760679FACDADF79226CB24ED4968F89FCB4BD2CEBCCC56E2FE0F8873A109D0188ABB
Malicious:	false
Preview:	...............................T......................@...........`.......@...h............... .......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......0...................................................................................................P...........................................................................\...................................(.......................................................................x............................................................................... ...........................................x...................................................p...................................................................................................................L...........................................................................................................(...........................................x.......................................................................................................X.......................

C:\Windows\System32\DriverStore\FileRepository\msux64w10.inf_amd64_5aa81644af5957b3\msux64w10.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4900 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	35804
Entropy (8bit):	3.947531574986077
Encrypted:	false
SSDEEP:	768:hJi5qeh4CI1aVU5jPLNAxFt/4yxtREtURMyR7S+LuMj7tTMZTyMlP7jLc+DlqQ3R:hs5iaVU5jPsREe7S+LuMj7tTMZTyMVcc
MD5:	F11FADEF201B7B312DD43BCF2A6F01C5
SHA1:	16F4FA9E51ED4BFD3CAF549D969645B03686FDB5
SHA-256:	1E2E8E7E24A53BE908C2A027BA461653FEB73EF758D73EA161D4D841D327F511
SHA-512:	28F99BF2D7FEE759DADDC7BD9CDEB7DEE4C3B67960A9278DFB434FD0EDF394FCC8975D43607995D6B8B6E1C53C71B7C1372AA7A6892C7ABDF5852B44954026B0
Malicious:	false
Preview:	.....................I...........b.........lH..(....I.. ....M.......].......t..h......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........-...................1....... ...;......`2......\3.......5..............(@..........................X....$.......................(.......,.......E......48..40...8.......!..........@F...........'...+...(.../..\-.......'...G...........)......t9...........B......\=......l+.......&...8..P0..........................................d-...............A..........T...............tG...................G...A.......A..$'......P........$.....................................................,...h...............X....................<......................t...................................................................X.......d(..P..PC..................<)..p....>.......>..`...(?..........d....................F..(........"....... ...............C...........E.......'.......1..............4A..h?...........>...:..,...0H...G......h...T...........@?..x>...+......

C:\Windows\System32\DriverStore\FileRepository\mwlu97w8x64.inf_amd64_23bc3dc6d91eebdc\mwlu97w8x64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2a98 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	18340
Entropy (8bit):	3.8200993840709785
Encrypted:	false
SSDEEP:	384:Y/NRU2ys2JOJBhw+cnUnx/buTl22c4GlWVNDNx7bRVmZMT:aXU2ys2JQ3w+cmbuJ22czA7bRVmZMT
MD5:	077C277C6A90AB8CCBD0B191EBD938CB
SHA1:	D7107B38A7F046ACE7AD29D18D835170E4B21C6C
SHA-256:	474FFCE72765376AE8900CEDA7FDBC5FC4FFA47195D4A5F738FB062780369B5C
SHA-512:	85B809D81184B52813592406E21ACD3524F78F574D232A5751680C8DB709C689B4D315D5F588A8C8FA3EAD1E7B303ED5C39485EDC851F0A4E33C580CB1157407
Malicious:	false
Preview:	.......................M%......R..................+.......-.......4..x...(>..h................G......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................0...........h#...................%..............................................................@......................., ..................................t...8....... ........... ....!..x(......l ...............(... ........... ...#......................$%...........#......................................................................t........(..p"..............d... "......($...(..................H....%......,...L'..........................................,"......`.......4...........................................................t$...........................&...............................$..........."...........#..................................H...................L........................$..........................P.......................................................d)...)...........!...!......................

C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_8de1181bfd1f1628\ndisimplatformmp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x32f8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	21852
Entropy (8bit):	3.860150808531242
Encrypted:	false
SSDEEP:	384:9Swm4iSEHwjj8WsM4S8w3bK4MKwKmuKeKjMKYKMaK7K9nKQ1a68M5Q0Lmin7w30I:9Swm4iSEHwjt8A9Mlzuf6MVZaW4nikmf
MD5:	47E6D2240A0C44F59302AD12CAB698F3
SHA1:	E44A8A7D1E7E2E226E7C16B6897732632FC0D136
SHA-256:	C7D875A44BE0FCD56662AE1185861C130674ACDE24BFA21C3E5794073ED96E60
SHA-512:	FA833105AC7B43CE22C0A19511CBEBE6748A32EC1C2CEC98436A7A1150FE05F5E73E24296B46779964F62EFB2880F86AC8320A77145D25D414634A5E010B6951
Malicious:	false
Preview:	........(T...........2...........b.........h2.......3.......4..L....=.......H..h...............XU......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......4"......(..................................................d..........................\*..........\...............................................d...H'.......'..........0........................"...#..4#.......$...................'......D(..........,!...............!......l........(..................................`....................................'.......(..............................t"......h........................................-......................\)...!...............................................)..................................h........................................ ..........t...L........... ...0/......D............................................1.............................. 1......................T-..T0...................................................#.......................-......0...................t.......d...

C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_5f033e913d34d111\net1ic64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x10650 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	129964
Entropy (8bit):	4.185267722491033
Encrypted:	false
SSDEEP:	3072:RJq2hNkwkceoAShgBpnAN52veQcbfb4Rf2B2ucte9k7rzE:k0eFhcbfh
MD5:	8035E4077A2A9058A8EB2EA34449319E
SHA1:	9F368FC9865C44E8FF7A3235339DEC37A3B85784
SHA-256:	5FA6D186B357C542FA27F6C1D15DBD67B58136272A9E3AB233DAB65226F5F95B
SHA-512:	63DE22EBC13C3DDA0EF640BA12A299700FE3502281CD3675EF785B99134BAA947CE85AAE30DE1E1289CE97C5C9055DFFB3C824A65A785C87604ADFA39A8BDFE3
Malicious:	false
Preview:	....................P.....\....:.}.................H...d........B...X..dQ..0...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......4.......x................Z..\|[......\|...p...................t...H.......p...p.......h...................8...P...D....]..d..............h.......T........................\......`...D...................d...(...h.......0.......0...He..H....d..P...........(........d.....p....'...G.............../.....`.......x............+..l...........T...d...........L.......................................0...........,...L........................8...........................+..\,...-..............4....3.../...3...1..l2..................0...$...........o..l...............d........g..8.......4........!......x...................Dp..,................................$...:.......5...6..t4..........<...........x.......p...t.......@...x...X...d!..l...............H........q..x...d....t..........H........x......d...X...t...........<..................d...$...l...x.......

C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_8604d8a50804b9c1\net1yx64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5520 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	39012
Entropy (8bit):	4.016799965514868
Encrypted:	false
SSDEEP:	768:o9/DoMjmeHYM0cpcfjkGAPnRZVKH4OjPhzF7nSNsbAkvcndt0kdpyLE:m/NHYM0cpmj6RiPhzF7nSNsAt0kdSE
MD5:	AADA124854A5802282012135823CC3B2
SHA1:	8EB54C08902DE0F7FE6B76CC200219E000162D5F
SHA-256:	AF8D48FD2261FE28F58325B11E140E83145BB00785133DAD8A40A06AE2730771
SHA-512:	D3695473CB32E24C4E894EB282F20FF70F74E1F60AAC570912C9163F06DBCF79BAF1F24B6B8EB879AAA71D72FB98A5D4E79686E61070EC5014907C058D53EB09
Malicious:	false
Preview:	.................... U..w..................T..!....V.......X..\|...0j......H...h...............`.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........?.......K..............<&...&..........t........=..p...d>..........d$...6...............L...........%..........\9..........$....5..........(;..lS......DG.......G.......F.......M...R...........4..T9...5...8...I..H3...M...S...........G...............-...7.../......X0..X!.......2..T6..................,...\F..............8............................A...............%.......S...............:...T...................A......l'..d3......,.......HI...........6..............dD..................................x3.......:......................tI..4.......$....A..........X2...................C.......C......P.......l:..............\7...N...7...K..t........ ..."..."...#..8$..........L....2.......... I...........Q......D:..X...........X.......\|M...O......$....J.......4..........X....C...................K......dC......TT...T...................... D..............

C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_450d4b1e35cc8e0d\net44amd.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x59d8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	45092
Entropy (8bit):	4.040759675036664
Encrypted:	false
SSDEEP:	768:Ik4MjoP6y6efAwgZ0vLxTfPTVpDekxct38kseDiz01:F4MjoP60PTVpD63hP
MD5:	C1F697C0A6E62ED5D143FFE1B9D02925
SHA1:	FB1372FC4B2E80786A707AE971BC43D4F1F85C99
SHA-256:	C51580F3449EF359A7416592B9F812654967A73D7D1E8DDD15D15501A62357A5
SHA-512:	FE501B613FBF589B2A701AD70B30752A456DF564584BFC74473B46BE75A80C2CACC0AAAA752A4689ADC8AAA3DC2D4B726B1E802E5C14ABF24961302D1FFF1145
Malicious:	false
Preview:	.....................Y..L.......R..........DY..3....Z.......^.......t......p...h............... .......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......$1..t1...1...2..d2...7..d..../..L6..x...$....................................T...................................................?...A...R......hJ..................PL...........;..,<..<5...5..T...4....<..T3...0..l:...>...J.................. U...........T...............O......d.......,................9......d;.......................4...................................L...U......`7...H...........P.......?...................=......................xL...........N.......V..P.......................tG.......................M...................O......4A......X................R.......Q...F.......G.......................E..L........W..............................h...................<7.......................H...N...............................W...................>...................................................V..4V......P....D..........................

C:\Windows\System32\DriverStore\FileRepository\net7400-x64-n650.inf_amd64_557ce3b37c3e0e3b\net7400-x64-n650.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5bc0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	43844
Entropy (8bit):	3.998418753313585
Encrypted:	false
SSDEEP:	768:4ASQcnYtEtG6tlgNlqj6LjNnZJJLRHxZG5H7FhICvkZmIl6:4PQcnnG6tlgNlA6LjNnZJJLRHx85H7vh
MD5:	45C2097743EC876BE0B564488EBEE432
SHA1:	22161FD925B2E13E1299D90825E668196A34643D
SHA-256:	FC0BF927D71D79899D789B284F96A63A4641047EF7FDFFF2EE80559AB5503A1C
SHA-512:	28F6A8B21C9C40086CAD7D6117AD46BB609413DC23DF19025FED26E19CBC692F14E4BFC4413C7394F52AAEC842B19555A3D383654E952BA54B5421750062243F
Malicious:	false
Preview:	................x....[...........b.........,[......8]..\|....^.......s......x...h...............@.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........9.......E...........M.......M.......7...J..........0*...................S...........,...R...%..4...d&..........\|................7............... ..8K...K.......(...............'..h9..........x5...:...7......\<..d6......\>.......K...L.......L......LB...9......."...............6...G...F...........Q...;...............................................F..8!......p2...........Z.......F.......>...>...?..4?..X?.......@..x....@...6..............tD...........B..................8C..0........................)..........(.... ...,..0.......8....................B...I.......2...3..............$A..LA..tA...A..\|... =.......3..,............................!.......!..........41..`'...................+......................0<......................\Y...T...S..............$5......,...\.......\4..........................42...Z..\|Z..$....&...4...........E..............

C:\Windows\System32\DriverStore\FileRepository\net7500-x64-n650f.inf_amd64_cc87c915f33d1c27\net7500-x64-n650f.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x47c8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	33036
Entropy (8bit):	3.953867041979506
Encrypted:	false
SSDEEP:	384:GXgUsSHeSUYlG1uhrxbMUfXBSNS0SkS0SdSYTRXiJCk2MW0uh0RO1gPTpKhKkKyK:Fc3NYp1lIZRXvgUpXJ/pgHx/Y1vRfnOd
MD5:	95E51D27AB64450E53DC39A980A95FEC
SHA1:	B5FA6B99ECBDD79761C33AF0965071AD695C3B3B
SHA-256:	FEE69BCDA6B83051BAF73552A0D396AED3C7A1B5DE849AE66C454E75C15A04DA
SHA-512:	E86B510C6AEB8BDC66DD9D3848AEE9502C359139D3D514F0C039892B7AF24FC8555125E4B110DF343CA4893CFA7A7D79B88232D43226780A463C262ED770C60D
Malicious:	false
Preview:	.....................G...........b.........4G......hI..h....J.......Y......Hm..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......T......<3..........h;..D!...+...........)........................................... .......... 2..............0................)..............p...h&..t9.......:...........?..L....D..\,.......&...+..(+..(@..@/...........+..4...89...9..\|8..X:.. ...............................'..d5..04...A......h?...........................C..................tE...3...........$... .......F.......4...+...1.......G...-..\'..........,........(...............1...............................(......................................(...X...\ ..................................87..........................................0...H%..................8&...A..\...........l.......D.......................L....................#......\|D..H..../...........................A.......@...........&...................................?..........X$...F..xF......p................1..............

C:\Windows\System32\DriverStore\FileRepository\net7800-x64-n650f.inf_amd64_178f1bdb49a6e2fd\net7800-x64-n650f.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x6198 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	46140
Entropy (8bit):	4.020560134843549
Encrypted:	false
SSDEEP:	768:rZvk9XW+AjdxPl3VEQ5tZdlGGGJkOvHzDweJYEA8Il:rZvkVWxPl3VEQTZdlGGGJkOvHzkuY
MD5:	7F76DD71D82084C006674132F43528BF
SHA1:	A15CB1614FE7CBF31548AE5BC656ABD1FE599F9F
SHA-256:	EEE4CFFF5FC002863A9FDBF5A716C755CA1226D64F156421DBA694136C816F6D
SHA-512:	4BBF42255549F5DF3F913BD0F36ACDBC864034B4403045E1F1CE1765BD0392F40C6E55025EAC7CF9C9D85762293E50BF2E522ED19B3778F509A738C097AA5470
Malicious:	false
Preview:	................\|....a...........b..........a.......c..h....d......hz......P...h...............8.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........K.......L.......Y...T...1..d=...........Q...........,.............................../.......(..,....(..........t............6..H;............... .. R...R......08...........Y..@*...^...........8..$>..x;.......A...<.......K..x...tR...=.......S... ...F...<..x....$..............T9...N...L...........X...Z...................................]...........M...#..\_...4...0.......`.......M...=..\|C...C...C...C...D......,E..p...\|E...9...............I... .......F.. #..............H:..(........................+..........(....!..T/..(.......$G...................G..tP...........................E...E...F..DF..t....A..........\|5..........h[.......8...........K..8$...............)..................\|....3..........d^...3...@...........................[...................Z..........T........................Y...........4...`..X`......d)...............I..............

C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\net8185.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2890 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	14428
Entropy (8bit):	3.7879047729781767
Encrypted:	false
SSDEEP:	192:HOZCRyRIhrqmo/V/jz9WcnWdKaoLgMlDhKVReQvSHGSGcWsx:HOZMVXklz954yDhOewk
MD5:	B5145DBB213CEE5B10212F5FC4B43042
SHA1:	8B24406BDB3128BBA42C061AE94FF3032F057AEB
SHA-256:	5D62CBA107D3DACD6C40CD9DF89A416BAD7F68088A716D3B4014E0F05ADC4EEE
SHA-512:	2F23428CC26AA93A560AB85BECF56C5380C95E4F8815358F22A967DCA3ACF784361393F854D16C8F312E1FEC71FADBBFC0E9259FFF6F0994B04F8975DBF86D10
Malicious:	false
Preview:	.....................(...].......{..........'.......)..T....*...............3..h...............X8......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......L%......................................................D...........................................8.......<...................$...p........ ..4&......................D'..`.......\|%........... ..P!..@"..H#......@.......t&..................l...........@ ..................l................................................'..............................H...................d'...............!...'...'..l...........X...................................................(................................................ ......................p...............................................................................@............"..,................&...........$..............\|...........................T%......."...........................".......................................................................'...&......................l...............

C:\Windows\System32\DriverStore\FileRepository\net8187bv64.inf_amd64_bc859d32f3e2f0d5\net8187bv64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3290 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	20988
Entropy (8bit):	3.8934114909427233
Encrypted:	false
SSDEEP:	384:P9q+EW2HO1IkRYilf9gamqHw2ii86fkxPNl:P90UIkRYilFtTw2iiHf2Pf
MD5:	A1FAFEFD4310709694329145598526E1
SHA1:	F95DAC6CA17E7257CD19E55B40C8EFF801B7489E
SHA-256:	320C5941F4EEE4204641275BA5628AB69411F3BE468DAB569AFAE666232FAA66
SHA-512:	388C5A395714B426835A94F68643608B9E5839FC49964769A2E8E22CF1AEDBAE1F18C73130404B72C64A360A7FE18AF3A11373E54D74EDE261CBB37EC15A60BF
Malicious:	false
Preview:	.....................2...p/......{..........1.......3.......5..\|....=..,....G..h................Q......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......0.......................x...................................t...........H"..........................,.......`%...............1...$..............4+..<....................".......+..\|...............(...$..8(..8...........t+..................&...........&......................."......................................................................x.......0................0......T........,..D1..P1...0..80..T0..p0..........h!.................../...........................,.............../...................................................................................$.......0..............................................h'.../...........'......D$..................................................T*..<-..................L........,...'...................#..................................................\1...1...........-..........................

C:\Windows\System32\DriverStore\FileRepository\net8187se64.inf_amd64_99a4ca261f585f17\net8187se64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4058 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	25588
Entropy (8bit):	3.9639444043617362
Encrypted:	false
SSDEEP:	384:JUm+EpzmQ8V6/tWgiMLKFS3dGnpiChTeItiH7JZsexV3JZsW:iIpmQ8V6/tWgimwnpigTJSIbW
MD5:	938BD22DB5530E50D99E1DE59FC289E9
SHA1:	C52103376035B7DF9D9465484AD61CF75457ECE9
SHA-256:	54A7F0CBD0849A43F83E19DF3881DB1FE0EDFDF534121F2E78237ECBC43FED0D
SHA-512:	9F2D57D2C141ABFFF782DCE1972F86DFBFC1F0B5BF0FA78B0DB6A699083B5AC34594463B425586448C864EE81F3D45576A292152F9A0A1B2A3585F6E2D6279C6
Malicious:	false
Preview:	....................X@...p/......{..........?......PA.......B.......L......`X..h................c......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......<.......................@$...$.......................=......$....................*...........6...+...#......................X3...2......$........8.......;...........(..........89..............@...X5..<2...5..4;..P0.......8.......1.......&...4...........3......................./..................<(...'...............................................................#.......>..........l&...:...?...?...=...>.. >..<>...0......D/..........\,......p:.......'...............8...:..........D=...<.................................................. ........................................2..............P?...........%...................4...<......................,........-..............T...................l7...7......................d...........<5...................0..............P...................................(?..p?..@#..................................

C:\Windows\System32\DriverStore\FileRepository\net8192se64.inf_amd64_167684f9283b4eca\net8192se64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x8f88 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	60932
Entropy (8bit):	4.117457377594474
Encrypted:	false
SSDEEP:	768:r20ppJicNwzxf07CV/CDPYL24th+YQ2MGnTu7M//m:a0dNNwzR07CV/CDQL24thw29nO/
MD5:	46C0274197B0FC61AB8C78CD142867B1
SHA1:	4414AFB443F019C59E49C135AEC96DDF895C79CA
SHA-256:	D1E159ECA93D80C37F2255F86BBA07ADC91E469A748E5F17A7DD7BEE6BAE052D
SHA-512:	B0C2782517389DDE3C3AE772898C18D6E73338D55D76F8706C3BE609B87D2079DD1DE834B80117960B0CBC5C8CD51D3C4037AAA0B4A3F10E0AE80176C43DAB26
Malicious:	false
Preview:	.........................p/......{............$...........P.......p...H ......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........S..hU..................<4...U.......@...$...............................s.......E..,....y...........3.......}..$....&..x'..."...v......@.......\........h..............xs.......U..."...<...@.......A...v..l....K...`...\..(o...l..Xl.......l...g...g..8...8~...d...x..Xe...f......t...........P......(.......................................<.......\|....................3...Z..\....1..DO...6...S...S..@T...\...............+.......Q...........7.......{...........".........................T...............T........................}..............................<%......Dw..........................}..........z...5..82...................y..P...`........y..........<........$.....xx......8...................\|...,$...)...)...........................A..............`u..........p...............D6......................4..................../..00...{...... B... ..

C:\Windows\System32\DriverStore\FileRepository\net8192su64.inf_amd64_66c8bfc7a4b1feed\net8192su64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xbc10 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	74020
Entropy (8bit):	4.16007157200378
Encrypted:	false
SSDEEP:	768:FZIzkUASZe4enkW8CqG0vPzbFqkd+B5kJX+g4hQkeKLxtLC+l:FyoUzU4enkWld0XHFqbPkJX+gsQkLp
MD5:	FCC1A92500E11E17BC157300877001E2
SHA1:	A3DF7FAD37E8D75E61A1510FABE047D3EEEF1B64
SHA-256:	C5C0304289D71D1A09029FCB93338F6552C6959052F8E9C3D4186229CB993401
SHA-512:	F2B6741E6C70DBBA85C649A72226B3ED274EFF59A35BD5D60886C64F733B7F259B0E32B855D464C6A0D1DFCCCFC337BC2A2CF11B725C13439CC90E1F2A7AC352
Malicious:	false
Preview:	..........................\....:.}.........\|...;.......................8!......h............... !......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......x....................x...`...q.......P..@Q...........m......$...............l........................`.......8.......@...A...C..X.......\|E..4>..h?..(D...,.......g.............X...............w.. .......X...<.............................xW...............6.......U..\F..<G..h...pH.......)......x...`p......0........................................k..........Hf.........X....1.......i..$......$.......x...........T........%..............$...............R..........................H...I..\...........n..`t...............r...O...P...l..T............[......,.......Lc..........p...........................?...A..DB...........D..d=...>..lC......@-......,.......................T....q......D.......X.......\m...T.......w.......3.............$\...............E...F...Z...G...c.................<..................$....#......d...XR......p{.......N...r..

C:\Windows\System32\DriverStore\FileRepository\net819xp.inf_amd64_ff7a5dd4f9b1ceba\net819xp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5900 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	35284
Entropy (8bit):	4.039779753713115
Encrypted:	false
SSDEEP:	768:CifzRHUpJWDl4206YDOxwa9POhG0axrC715K3SX08aT5HLMre81592LLIcIFxaIG:dL5UpJWDl4206YDOxwa9POhG0axrCZ5C
MD5:	E40DF4811778E0B54B585AF44A758A35
SHA1:	C3C9BB7F49B77420BFAC41208F53DEEB782C8AEC
SHA-256:	7C5685CD34504D5D77BC038521259CC267F23E5C07CE8B968361E4663E30913C
SHA-512:	D1883D687E3FA1B56E0A775AA9C323C2F45E2A40CFE4DF0170FD757B8097FDDF8A9EA47E3096D8EA172CDB0E12B2D91A58D44585212082838DE77356C46C10AD
Malicious:	false
Preview:	.....................Y...p/....:.}.........lX.......Y.......[.......i.. ....y..h......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......8O......<>.............../.../...........................B......t........G.......$......$$.......................... D..(........J..............LV..\....P...M...)......H).......V..T............... N...J..XS...P...H...F...V...O...5..l....9...4...6......hL.......<...0..........LH......................pG...............V...............&..........H........ ..P............&...W..h%...>..p,...Q...?...@..4Q..L(..lQ...Q...I.......H...........C......HW..........p............................P...O..........0................0...E..0.......................,U...............................M..........<P..p=..........P0...................R......@M..,.......LC..............`;......`:.......................B...>..lU...................................S..................pI..........0M..........,G..`+..\3...................W..hW...................*..................

C:\Windows\System32\DriverStore\FileRepository\net9500-x64-n650f.inf_amd64_e92c5a65e41993f9\net9500-x64-n650f.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5f48 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	41428
Entropy (8bit):	4.0124668897591285
Encrypted:	false
SSDEEP:	384:6wEiv/dH2mnGs+d2IvmMwSjeC2UssbInNkUjucVPS29P0g6blvujuKDOpzDUv9Yl:trv/dH2KIvTdpNbOJ4bFu74kGSSz
MD5:	864D56BF2E2BB94816767A87CDF8A9EE
SHA1:	837A867DA2EBBFBA19EF878E6ACFF2D983B53096
SHA-256:	1F15AE2F15D9F35185F55EEEE8034FBA29542DB81DC67372AA5E62F10F444515
SHA-512:	8356160A77854AF78D4387E13CEC71ABFD47283786967F9F7744D915CADB8DF85E4854599EFC2E619C8949B6E282E5AD3C42B2954D3AD92D8AD5656532A03461
Malicious:	false
Preview:	....................H_...........b..........^.."....`.......c..X....t..x...X...h......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........A..H....Q.......... ^..4&..DC...........U......$>... ...............................%...........P...&...........................?..............h............:...............S..4A..$\...........K..pC..8>..DW...B...V..@....".......G..tH...H..\I.. J...J..`B.......................;.......R...........X...L..............................l...0...........\|...P........,...%..."..p^......(S...C...F.......^...D..`E..<................<...............O..............p...............$<..................................@...(...4...L%..t........T...................................E..........LT..............................0-...........8...Y..\2..(3......H....5..p ...........................I..x(..t$..8....+..h)...)...)...)......X*..HF..............tY..............HX...:..8.......h.......................tV..........H,..H^...]...................7..$P..............

C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\netathr10x.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x16aa8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	190068
Entropy (8bit):	4.147837494951384
Encrypted:	false
SSDEEP:	1536:soKE+3oPA6KIur21g0FoNfg/5kB4NHjwvtE3F2HAUTQek6:soKF3yA6KIur2S0Foy0OXsAU8f6
MD5:	D4E8D3D92241C56C93CB61FBBC2493B9
SHA1:	ABF2496D6B6A237AEDEF119A93D73E0206B55C7E
SHA-256:	A53EB095A216A50182B145015FC5F0AE272F4EAA902DA45AB00165F0091A02C0
SHA-512:	B20D38B0928C6564B18275AFDC821839254B9844561FE08743192FA4A2D92D97610643DA6152C2B111807698EB6B6E3B2895F1BDCF52D3D02E84DA2CE8B01001
Malicious:	false
Preview:	.....................j...p/....:.}..........j.......k..........xW.. ...(...Hd..h...............p.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............T?......p..................0b..\|b.......7..X3...................s..4...\|... q......."..0...........H...t................t..<........t..`.......H................s......@....u..l..............(W..0X...W...:...<..t8...<..x=...#..T,......T.......p.......`....S...`..$p..._...s..P........O..H........c..P...8................#...V......hv......tX..<a..(.......h........i...z..0........~.............. .......8....7..l...L...HV...Y..0....F..$\..\|\...\..0....]...]..4^...^..PR..P!...L......................(...\|K..................................p...............(................................M..h[..pf..H.......pm..H...P....O..........x............]..........(....I..............\|[.......U......l...4.......d........$..X....a..x=...........................a......P...\G...G...H..........<....X...Y..`Y..$0..<F...E..........P.. ......................

C:\Windows\System32\DriverStore\FileRepository\netathrx.inf_amd64_220db23f5419ea8d\netathrx.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2e6e8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	379012
Entropy (8bit):	4.458728961273495
Encrypted:	false
SSDEEP:	3072:hr+IVN1v6Qei+L4pBAC9WXWIw9KxPv0p58IbBH3SffasnX2vzkW0zn:fxrPzIwU3W+AH3Sm0zn
MD5:	BD7A12D2FB24A2E7E5236C2AF1BCFD4C
SHA1:	129C00B7C0E0CCCB6FFD39AB57D1277AA186F04B
SHA-256:	B1E4EAB59CA2CD693F37AECDEC78332AC8B1D0F327842CFA7EBDE1B2170FE1D2
SHA-512:	388ED8775448DED7EA9C7EF58E778FB000CB950D5BE4A20E53C1FA6BA28197C26D34091C8760FAA464A1C50A5E0445434090FFF422C9EA3EBEA9389D4A383CC6
Malicious:	false
Preview:	..........................8................d............7..............@...@...h.......................C.:.\.W.i.n.d.o.w.s.....4....n..\|...........;..@........0.......j..............t....f...{...$............... ...[..............0..t......x...`.......=..........$...\|...d.... .. ...xI...q..\|....p... ..d...(O..H........r......h....e..d7..p8..........................th..\...Dj...d..,Y...f..Tq.......'......hH...........,..........H.......t'..h...,.......4.......$...p.......T........p...5...0.............. ..................................D...t...............$.......(....,...o.......T........4p...x...2..pD......@...4.......@...`...x...................1..X...0...............4&..T....>..\|...0................/..0........4..,.......\|........(..........L....v..............U..D...........8...T~......h...x....9...&..hK..h...t...8...x..........h?...$...A..........\|....b.......Q.......Y..l;..L.......3......\|...(.......\...............\|r...A...O.......(...................:..4%..d.......

C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_f6f0831ba09dd9f5\netavpna.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1420 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6932
Entropy (8bit):	3.3361183158633105
Encrypted:	false
SSDEEP:	96:L5l9oACPXZqHaiRjJpFYtId6LhRw1DcHC4:WqHaiVFpd664
MD5:	D303FEC04E8478C7696ED716B26814D9
SHA1:	A0C9ACECC0BD093CFCD59F425C756C2DA6DE4C10
SHA-256:	36322F02F006ABD771B5A334F31CBFFD2B97D592A567901D4201CD113C19009D
SHA-512:	7859EFC577C971D5E654E8A7725C1C1F9FBF40F151ED225CCEC1A6DB771FD6AB8C1981B3ECDC6E24A256143F437408A8E004CC6DCC1E9E789B8C3373C556A8B1
Malicious:	false
Preview:	.................... ....b.........................................p.......@...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................................................................................................................................................................................................\.......................................................................................................................................................................................................................8...........@...................................................................................,...............................................................................D...............................\|...................L...............................`...............................................................................0...............................................................................................

C:\Windows\System32\DriverStore\FileRepository\netax88179_178a.inf_amd64_b6748bc8bb8ccf4d\netax88179_178a.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4470 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	32148
Entropy (8bit):	3.9351263738773894
Encrypted:	false
SSDEEP:	768:CC9EVsNqXfRdLGs1bbF2ChOup0f1auNAsyMiQv70KCt:CC9EVsNqXfRdLGs1bbF2ChOup0f1auNI
MD5:	47A2CBBE599B48CD643743CA3DBD22A9
SHA1:	DB15D0FB4FEEDB6E270B6E66B302773A766C0092
SHA-256:	2F2E61E4DA54D45D2BC0A7CC374983519308FE08B0504DE63DE2B0149473FB68
SHA-512:	23618A1122FB786573D88FB1BD9591565D5E7C5C3FDF4CF0B3E14FBF724D85599B1101264E6A284106DE8D37D2894BE9B143D07F6BF86207E4514534C136D9E9
Malicious:	false
Preview:	....................pD...........b..........C......hE..\|....F.......U.......i..h................}......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........+......4............-.......-..................@:...............?..............................................`"...2..........P...2...........@...8..............................t...............0......<1..<,..h3..X)...3......89.......<...>..4/..(0..D>...............,..H...x(.......1...................................2..................................................,C...............=...........2...)...<...............(......H .......9...............:...........5..D,...........7... ...#..............................4................&..............................................`#..............................x;.......>..................(............:..............................l'...........A..................................0?......(....@......D)..x...............................D0...........*...C..PC...>..................l4.......$......

C:\Windows\System32\DriverStore\FileRepository\netax88772.inf_amd64_5d1c92f42d958529\netax88772.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4358 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	32284
Entropy (8bit):	3.940790801648064
Encrypted:	false
SSDEEP:	768:Ht2VQILT3MxShGiFD+9W9Hi8nApA2q19MNANqkNdu:Ht2VQILT3MxShGiFD+9W9Hi8nApA919k
MD5:	C1094D4F7FDB68DBBE11138C4ED7D39E
SHA1:	1D77AA073F506D22C307D55748D82F4E63EB21B7
SHA-256:	9199BCBDB69A1919C097A704595A9758D41DF083F62103D1F4DB9EF4B419757A
SHA-512:	31B9C943E563054A2497AA7B9B4507D4E754518730E28B2DDC1EF9CB28A90CBFCA81341B84FED110BEF089F86B3B474735AA6376EBF6E9316E18DE0649E1C157
Malicious:	false
Preview:	....................XC...........b..........B......PD......HF......(U..x....i..h................~......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........)...................-..d....-...................8...................................*.......................).......:...........(..............p?...9......8+.. .......@...<...................T'..T+..<(...0...+...3...'...;..............43...=..........<=..............<,..<...4&...;...0......\+..............................................H...........,.......h<...........B...............3......t,...;...'...3..............<%...<..........88..............X9..........04...%...5......................................................H?..................................................L........................)...................=..............................(9......$....................>...............?..................................(>...........?......\|)..........................................l/......\|B..(B...=..\....2...........1..............

C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_7ba6c9cea77dd549\netbc63a.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xc618 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	93836
Entropy (8bit):	4.17704877821231
Encrypted:	false
SSDEEP:	1536:PvE9unDnFx2V/8Vogsjwx/izD81iXYs3CGEuXxrhrZXXXmXXBFXXXtzXXXXXXX+g:PvEUnDnT2V/8VogsMx/3S3CGvXXXmXXL
MD5:	2ABC5B3CAD438C92FEF6407D8C1E8EA7
SHA1:	26EE2457BBF3C2893CFC7C937EB4E20FEA715F96
SHA-256:	14EF6B8B46C2A8C3BA108A10D1C1A9FF743F141FF101240D5810342C553A8B2B
SHA-512:	A24258CD0CC00DF7DD707F34FDC4FC1CE214A98957AEBC3E417A29A877C3809C21C9A229E3208D4B7E7EFEED9A77BC5FD0B20BB9314D79291B106A70FA41B605
Malicious:	false
Preview:	........................V8;....................J...............,+......<;..H3..h................n......C.:.\.W.i.n.d.o.w.s.....p... D...C...C..HC..x....H...C..4...ln..T&..p...........xX...........F...F......h...TG......T....G..(F.......G...0.............h...........T...<.......K.......\..........@...hD.........l...4....E......(...<....4...O...P...............h....6......4...<........_..0c...........0...............1..d0.................................. J......H(..........h...............\...................F..t....P..8Q......P...(...<...t...ld...G.........$....k..L7..h.......7...7.......7...&...8...c..........X...0....0...I.......(..`8...8.../..\9......X...........L............=..\|?...'..p...............:..t:...$......D....z...... A..L...,...(0...........(...............R..4...lg..........<..........t...X.......dV..............,...t.......<F...........................J...#..........p....p..............@7..X7..p7..p........7..84....................n..8...x.......(....2..

C:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_b96cdf411c43c00c\netbc64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x6e50 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	62220
Entropy (8bit):	3.9887865384611034
Encrypted:	false
SSDEEP:	1536:FsXyOUyjCPYfrIHPtY4LLPLjPRQdpFzyaUz01NFKReYb2W8qoOYaBsMreBOufZf1:CCxymPYfrI1PRQdpFz+01NFKR5foOYaw
MD5:	42A531FC1CBB51B1A976B8382A192B10
SHA1:	C7E50031EBCB5720A4C978EDF4B19C3B8ED4641C
SHA-256:	BE50433B30ACBC772992F115AF5C2850F821AC3D8875D96A12FD86B75A3A94E3
SHA-512:	ABABC5DE56CD1B20C052F10C0837D196169F1A539AF29DA9D92A3C9D4F50A3C41B694CECD200797ACE25FB0DF0B82123B030EC75559B35255AEF669F67DCE93D
Malicious:	false
Preview:	....................Pn..V8;....:.}..........m..8...Ho..`....s...!..8....... ...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......XF...........$..`........(..$C..........$........l..d=.......i.......B..@/..<P.......g...8...j.......(...........#...............1...$...2..`M...;..........t9.......h.../..lk...H..49......@j...;..P>...Q...Q...Q..8...p........B..L0...G......xK..P...0m...:...a...L..........d...x0...#...1.......F..................`T..x........a...a..D5.. ...7..."......\|P...b...)...7..4N..XA...Q...........U...A...A.......O..@X...W.../..8b.......X...P..LQ...e..Db..........dB...F...f......T3...T... ..,U......dU..<2...U...7...2...L...R...#...............U...B..h2...W...2..LX...6...H...^...8..@"...3..l]..LY...X..`8...+......0B...R.. Z...^.. ,...=...d......(H...j...#..HZ.......................].......1......X#......@_..<<..DE..........4Q......xO.......a..4>..D........<......./..............H...G...i..L....................f.......A...........M...M..8...tQ..............

C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_1fff3bc87a99b0f1\netbxnda.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x27528 "signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	403700
Entropy (8bit):	4.319971124178066
Encrypted:	false
SSDEEP:	3072:V+XjVogdNk6Uf1rOjp9uFAgZ8tqqCST+4yPreeWIXXWBZdLyaO4f6tP:VoGBAgZ8xT+/LP
MD5:	0939CCB2814C525EF2B0E62BC2AFC2D9
SHA1:	1CF98996D771BD17C570249B3A2B54AEC402B8CD
SHA-256:	5603B52CF35BA1AC0A9011D836F2B8A5BEB3B5FB86083984198100A3058CEF0F
SHA-512:	EEDF894FBD4A3A308784246A3E0D2319FCEE48A740C9B03B581D024422B521E4BCFE84A9C4C805ED0CAB37F248DE378DC5095A71FAAF25C9198C972AD4B05527
Malicious:	false
Preview:	....................(u........yl...........t......8v..@8..x.......0{...V......h................(......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........*..,....... ...,...D...H...4/..D0......,.......\|o..lT..._..L`..`4...p..........hn.......h.......p..t............f...)......l...$y..Xr..........xS..,l...s..p....e..\"...\|..@[...z......@...<...........8....a.../..P....I..`...........hs..._..Hf...q...v...Q..x...L.......L.......H........b.......................4..8m.. ...X............................A..............X>..(@..H........\|.............\|...........t...8...l...................h...D....l..te...d..lj..`g......h..TY..$)......./.. ....j...............b...b...Z..8....v...!...................F...K..8c...l...Q...D...C..8....M.......3...2..(....4..t... .......................P....c...r..D........f.........,d...\.....@b...m...3......4.......0v...Q..h......................t>...o...O...F...]...m...%...x......T`..\|........s.......+...k..\|&.......~......<t...s..`m..<..........P`..hX.........4...

C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_895623810c19146a\nete1e3e.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x9120 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	66444
Entropy (8bit):	4.082586440350948
Encrypted:	false
SSDEEP:	1536:NHgyfAJ8TQMlwnYz23Xo/hPaTnTOEXbHzACuWRZBzYQoH4rWb9yPeQWARKKq:BgyfAJYQf3Xo/hPaTnTOEXbHzfBxKKq
MD5:	7B9D52A95ACA4386190E87262698CEC0
SHA1:	C54389B80E75917503560C56E2ADD875D0189523
SHA-256:	0DCEE02FDC54095FD4A61806BA0F8CFDE56C551E6837E246F8EFBE55D327E15A
SHA-512:	4B9DE8B9BA39345225DBBCDB8BCF27B833542C366990EA9640604C9AD26F9FF36108E0C0B063360D74FDCC3936D1E325076E2406CA4DD6B856C0C650460D8F69
Malicious:	false
Preview:	........x........... ............b.............L...............l...x....&......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........C.......K...............7...7...................=..P...DA.......c.......n...J..LI......X.......\|....6..........Dv......Dq..\....n.. ........x......... ................8..........p....`.......k..<v..D_..._..._..4`.......... .......l.......$g..tg...^...t...]....... ..\|r.......q.......q...$......d)....... ......T.......................D.......<....~..<............6.......................w..l...\|...........hM..h~......L8...l...r...(...s..`........1..HX...2..P3...,...-..01......l.......@#..p%...&...5.../...(...w.......................................~.......M..............8...........................[..Tw..Dt...t......`s..........H...T....4......H.......p0...q...............n..........P...........H....O..,w...M......,N.............. ................d...m..D....f......t........;...A.. D..0j...]..L.......D.......tq..@....q..................X.......

C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_af58b4e19562a3f9\nete1g3e.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xab88 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	79100
Entropy (8bit):	4.135846643909104
Encrypted:	false
SSDEEP:	1536:tKiyplcr7JMN5Wfh5F3iOcaNxZ17fNvf0ueFcaBOOIPmN:xyply7JMN5WFcaTZ17fNvf0ueFckIP+
MD5:	7B36D93E7CCC957F85C2E26E906607F4
SHA1:	FF3998459F5B392F4129B5F4DD9625172396A2A6
SHA-256:	BABBA167FBBC9741686631905FDB983457CDAB584CABBDA476534400F417D5BC
SHA-512:	CC9B4D8B0BD2E2CAB60859A2EE3E3D54BFA5B404AC16731DCDDE9653989B68FC100D2146B17AD26FC6341453BA18B4CAECCD831F8A696887D52C1485075503DE
Malicious:	false
Preview:	........................L.......R..............T................%..............h................4......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......\|...DQ...............q..TD...D...K......$...............`...............$...............pF...........D..<...................\............H..`..........................t................;.................(........(.......'...).............`...X+...0...........'..T)..........T......... 1...0..x1.......1..(2...;..<<...2.......#.......7......T....................C......4.......................T.......4..............0.......p5..........S......T........ ...........3..x.......P....G.......4.......M..dk...8...9...9......x...(...........t:..$...........Ph...............l..P... n......X...........p...t~...........}......p.......\...H...l...................$e..TB...?..T?.......Y...B..\@...A...<...<...v...y...z.......~..@%..t....... ...0...........,...............l...h...,...<..................................X.......$F......D.......................

C:\Windows\System32\DriverStore\FileRepository\netefe3e.inf_amd64_7830581a689ef40d\netefe3e.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xd820 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	91644
Entropy (8bit):	4.182305422948858
Encrypted:	false
SSDEEP:	1536:S8j4BpvIgeu1qYJQcVGDW+1YxhhcXGIJ3F+chnAW:S8kBpvIJZcVGDW+1jvZF+cF
MD5:	E3143287B359009041232412BE38CFEB
SHA1:	2DAA8E6293C71DE1B9E7B21B2EF62CA2DA84AE30
SHA-256:	397614C058027FF5FE819BFF43B1AC01CE075BA061731D5CF5A635F76BCEFE14
SHA-512:	CE0A9B64301C027042B462F35252B9CBCB786E5C41C915F751CDF3C1984ECDE4E929ADB228A0A444E2F2E9E6AB1B8816448099C10C09D2A3CFBEBABDB2FBE36C
Malicious:	false
Preview:	.................... ............b.............U................%...... 0...5..h................e......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......,...lL..........4........E...............S.......D...........a..................L...........XS......\|E.. k......\|d..........\...D...T.......d................G....... ...I..........................t...p....B..........P...P....n..........\|8......."......,....o.......H..........<...............d!......................Q..................0W..0...............h....:..LE......X...0....H......d.......................T........F..,...$Z...........[..................@R......8...................0...1...1..h2.. 3...3..4`...4..$5..........h...........Hi..............t...........d.......,........X..................(...........(....e..................8....C.........x............z.......5...6...}...}..4...d..........L....Y..87......dn......<...T............7......D%..<....................+.............. ...4...P.......\|........I...K...`.......J...H..p?......

C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\netelx.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5dfe0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	484876
Entropy (8bit):	4.261066941682942
Encrypted:	false
SSDEEP:	3072:0unsOv5JUKAlEhuItlSL6tjuH+bskUcSpbVs0ssqi9s2p/X4pf/Oo7rLqimPja93:0g6/sjuUnIP7lmZFxF
MD5:	4780A670106FF7EE7D5C0888AA82CCB7
SHA1:	8564BBBD8B5614F08BCFC4C40428232CE737433D
SHA-256:	E3D6E528C2EF31371B3756C17D60FC141C9A1BDECB3775BF63E1E32B3657211E
SHA-512:	B49E382656B5D65E56BC0A108A75D6B9484AAFD4FF1FF187FDD76002382082EE4839E6263608600DAF5EFBDCC527102BB123B6BCF9A4378A181707A61AFF36FB
Malicious:	false
Preview:	.........................+....yl..........P...=...............Xq...V..........h................f......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........t........1......2.........`V..............j...........Z.......5...6.. [...q...c...d...f..,g..pB...D..to...p..@?...@......\|....b..pT...U...V...-...u.......v...7...}...q..,x...l...E...... u..\...8........m...\|...z...~......,........y..H.......<Q..l]...>.....L.......<^...Z..l...H.......\|...$f..Pn..h...x....(.../...`......`...$K..,.......\|s...........o...r..4n.............H...0.......<....W..................Xn.......o.....@....I.......[...................X...~......l....f..,....g..TG...h......03.......:..Ds...t..\L..0E...O..8}...8...$.......t................h...$r.............\|....Z.....0a.......~..0...4q..d~..........\|=......`z......<...(...Lb......Hy...c..(\|...c..h...d........J......,.......d....M..............x...XP...........r...s..hs...s...t..dt...t...u..`u...u...7.......8..h...\|...........l.......Hg...... .......$...............

C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_84cd7b2798e0a666\netg664.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4988 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	34140
Entropy (8bit):	3.972780805262807
Encrypted:	false
SSDEEP:	768:wfqH1eV8QU3fVkuXteURMNimwfne6ApwHuUeK/5PeIbG000WCCCG:wqfVkuXtoimwfne3Uen000K
MD5:	C7046CB62364DFC9A179B6D3FC55564A
SHA1:	AFD9DF73C7677A839D5617B15BA627AEBD11214F
SHA-256:	20A21348DFFF688C2A1BCE6AA9102F2B7B8CAE118A411EA17BD7EF55B1252603
SHA-512:	2945C3A59B16F222B6272EB55E0B6C464CB18DCC7565262666F4CC733318AE262C1CFAA784FB72355BEA4574A24EF84E032A05718B681F04F23128826A8920CE
Malicious:	false
Preview:	.....................I..L.......R...........H.. ....J.......M..`...x\..p....p..h...............X.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......p,...!...........%..$'..P............B..L3......................................................................................./......x3.......E...4... ..H6...........!...........F..H........... .../...3...3..p-......<A.......!...3......PC..........$C...............8.......-......................\............................3..................D...D/...>..............hH...............9...H...8......8/...........:.......-...........................................................C.......................... 9...!..,3....... ..........`...........80.. 1..t1...1......D.......................X?...........@..........`:.......C..........................`$..."..........`...(...`....................:..lF..................................8D.......0..0F.......=.......,..4....;..............@.......DA..........$H...G......P...............l=......$.......

C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_8b2087393aaef952\netimm.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1028 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5548
Entropy (8bit):	3.1412388600587424
Encrypted:	false
SSDEEP:	48:Q+mlXqXoNn0OYUH/5S/Y5i4FpJeN3CAh22MZxE70aD7+qDHEUBQr:Q+mYXotg1lOGVCfMe2M
MD5:	9CD7CF1BBC9B56CA535020A2332ECD6E
SHA1:	A672AEB5BE3D04D120D7FBEC9FAD2F4606AE0921
SHA-256:	EBD5C07025FFCDE25D4EE0304E88309B221E15F40C35F80AC6D7A76A188FFE40
SHA-512:	E7C0B83C4A663889D7E733C56EC5DA8CC61ECC6FE1E4972EB4DFDA59C04D3AF5659EBA300E06512E3C3D574880CA3DBA71D3F64DC41A7267186A97E8E893B07D
Malicious:	false
Preview:	....................(...L.......R.................. ...........,.......H...`...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...................................H.......................................................................x...x...........................$...................................8.......................T...........................................................................................................................................................................H.......................................................................................................................................................P.......................................................................................................................................................P...................................................................................................................................................................t...D...................

C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_752bf22f1598bb7e\netjme.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x47c0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	33700
Entropy (8bit):	3.934340720150607
Encrypted:	false
SSDEEP:	768:sDFDM4Hq9A3fzaw2pr26gURM/gQC2TwDaL0G1aPgW0Mjhcto:sJG9A3fzaw2pr2NgQC2TwDaL0G1aPgWh
MD5:	DA7A6F4C1F9AFF39503397095D3B04E5
SHA1:	0D9A93E203238F75978465A3AAF80C2DED87848A
SHA-256:	81530DED0C38DB3D0BE950AFA7A3B184631CF0FAF568763A4937BF9C37D99492
SHA-512:	2D51E2AABA1F4A8CD0BA8015CED2B938BDEE9DC194DA7AE7334C40D01644820AE1783B58F8A0F565E8BAC7AF0D28223ADDDD9E3A20715EAB9DB336CFB62FE1EA
Malicious:	false
Preview:	.....................G..L.......R..........0G..!....H......PK......`Z.......o..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............>.......7......d ... ..........................................4................F.......:... ...........%..\|)...........)...............E.......7.......<......t"...........E..t...0B...2..<...t....D..<0...%.......E..pA.......8.......<...........A...............-......P%..X4...4..........................................D0.......5..............H........4.......;...F..............d+...G..,........(......................\|"......................................`,...%......(...............................\.......................)...5..\...l...........................@........B..............T....................6......pB......T...........xD..................................$....................D...............-......45...........B...................'..D1......D...<;.......1......41...........1...5..DF...E...2...................,......p0......

C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_d823e3edc27ae17c\netk57a.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xc088 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	91292
Entropy (8bit):	4.175033409780443
Encrypted:	false
SSDEEP:	1536:+PHvXdQ1ARv8eXeq/3rhEZsWC/I3SDK1AyjABIbe74N:+PHvXdQ1AR8eXeq/3rhEZsWC/I3UWudy
MD5:	86FA73CBA760CC0C5B176DC553F6D2A1
SHA1:	553F9BCA4EF9EA6306B8A1EA434CCB18D4264B34
SHA-256:	4CA2E23F40B53900B904BB020F3E2D78609382DE1A6CEA4CDA053A26510BF41D
SHA-512:	04BF19C924CBDFD4D37E1A762223E4975FC92FAA7A4023BB91CB9BE26D1E8F9795611B8F9BAA6805BF418C87200E3CAFF0256A211BFA08F8CA3F251864C18437
Malicious:	false
Preview:	........................L.......R..............n...........0....'......`9..8+..h................d......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......(...p............}...o...%..d&......$b.. p.......p.......;..............<...............?...?...m......d...............B......P.......(....'...........&............h...p..........\|...\.......,&..`.......... ...d......P .. (...........k......`q......L.......,B..,...t ..........D.......................................8......................(............"..$%.....................\........q..x...t...\F......\|.............................H........k..l.......................................,..............(...\...............................@................t...... ... .......X...T....!..L..............................x...........4...x...\$..\|...........8.......T..................................p.....................................................p.......................`.......................<.......<.......0..................4...

C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\netl160a.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2e78 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	22028
Entropy (8bit):	3.8044457259254845
Encrypted:	false
SSDEEP:	384:CsXD5rf+PBgdwJ5DVs2hf3H9fJ+z5abaR3MaG:FXDVf+PBgdwzVs2TB+MbB9
MD5:	DF809409017D3616C90BD8685CBC3427
SHA1:	07871DD86059E9156FC1DB3F943563E357512FED
SHA-256:	74D7F0FCD3A3D62D43B4EB8928BA11F5DB519E6F9F259088A5F4DB5B1EA1D3DD
SHA-512:	D6F472A342649C09E5021D943273E158FBCAA5AF351163870BF710605691DF7AA1FB530A7C603DD118541A6A8854B9439B9A6C5ADAE23D642A827240E66F00AA
Malicious:	false
Preview:	....................x..........HR...........-......p/......@1......(;..l....H..h................V......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......@)......................(................................................%.......)...&......l&.............. ...................0................ ...................................!..........x...D...`...\|....&......8...."..L........,..........<.......................................................l........................................................%..............P-...............$...-..t-.............0$......h#..8........................(......................."...................................................................&..........................X...................................................................$...............@.................... ...................,..........d!..............$...................(...........0!..............\...`,...............%......h'......0......(-...,.......'..........t....+..............

C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\netl1c63x64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x20300 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	267668
Entropy (8bit):	4.400738290143317
Encrypted:	false
SSDEEP:	6144:QARkbp78gkmAkmVbo36Y+q8fkoiCZbiNDBK51BK5YBK5yBK5tBK5LBK5GBK5e:NR+p78gkmAkmVbo36Y+q8fkoiCZbiN18
MD5:	B77841A9EBE13931DF0CDB0458A46F99
SHA1:	1E03E1FFB0600BF645917E8C383591B630B6A8F5
SHA-256:	40B5A8F04241C9A1F36DE0305FCC842EA2947815FF2BEA13B1825FB22423C006
SHA-512:	F2CF2801E55D7B006A60B25D0A9AE95CFB952D9A46E50618B0BF61A35023AEBB300D3F95A5DAB1F5C91ED1DAF4D341F74315D4542178DECD374F0787632099C8
Malicious:	false
Preview:	........................,.......R..........p...........$... ..............Y..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................$..P.......,..............,...........X...............................l.......\...H................B..0........T..h...L...\|....Y..\|&...........\..........,...............@...X.......T....p..............4................................... H.....D...L...X...,...........HW...W...R..p......X....................... ...L...........l...t...............d...........\...L........"...................+.. ...........D...............X...<...................H..........H...0...,.......L%......D...,...x...........<.......\|........E......................l...................8^..............T........................]..h...x...P.....................<0...0..P...........x...........@Y..........0.......................p... ...D...........................t...........h...D...........................T.......................<...8...L.......

C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_8d5ca5ab1472fc44\netl1e64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4e68 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	39684
Entropy (8bit):	4.004074994073078
Encrypted:	false
SSDEEP:	768:UpxWRs5fjUjCYbOa7nb9B7fWQ2qwG/WswN5zcDJ9tzMR1hGfdCJXAI5:kWbCYbOa7nb9B7fWQ2qwG/WswN5zcDJg
MD5:	EF622122E1C54882ECBB722A62A3C2BA
SHA1:	FD59D712FBEE311C77C482BA166C8768FEB3A760
SHA-256:	DB37426290F84B22CA64D6BEAFAD2CE6FE913A894CD017B8409EAF576B36561B
SHA-512:	F3B648476E245A43E11838F20D2AB6BFC61586F8F4A9EE1B5BB755E448D9AA000DB34C87CBE69D24468F5ADB1E8707B2DA112A9B3D76349E9F9ABF8023D7D173
Malicious:	false
Preview:	....................hN..,.......R...........M..<...`O.......T..P...`g......0...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......8J..........................<6..........8(.......+.......K.......)......./..X).......!.......A......`........................2..\|0..`.......$....;...I.......9...................7...<...............8...0......@9..L-......\|=.......I... ... ...5...........6.......................,.../.......3..t5......d.......d............1..................................$...`...........LM..............4@...M..\G......T/..<"... ..h....#..h-...C.......C...,...6......d6..............X,...F..........8...t...........(.......d....A.......................... 2..........................P............4...........................B...........B.......9.......................>...?..4?..\?...?......\..................../..\|...X<......pB..........................(:..........$<..................L@...............@..........$?...K.......M...L...8......L?...........G...>..........

C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_783312763f8749c7\netl260a.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x27e0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	17500
Entropy (8bit):	3.771734228781894
Encrypted:	false
SSDEEP:	384:3d3aGinNvIb0UywjLaVJGkETcqpOJqicLzf:t3aGinNU0UyrVJGkz4iYzf
MD5:	E475549D9EF386DEE5663F813F66BD44
SHA1:	3F3E0EB8AB5EF9940C4827B5C8A38F31FCD2187B
SHA-256:	B202B47EE8AF986D8F43472341DA0FE8B235F4D9167038D819C090ED4322BE7E
SHA-512:	DE0F575D20BE7FE94305B4DAB61D1321DBBB0DC755C5E3E0147C597E49699114020888C115B83AC19C22CCC5CA3B298DE5407F3F36178C36F2A0DD813BA3725B
Malicious:	false
Preview:	.....................'.........HR..........P'.......(..T...0*..8...h1..x....:..h...............XD......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........!..........................\...........................................p........"...$.......#..................................p...............@............................... ................................"..................................................................@...............................................................................t#......\........&..............0!..0'...&..p"...........$..........................................................,...........................................,........................$......................................................h........................%...... ...............@...............................l...................................................................................\|...........H!...............!......\%.......".......&..H&......(...............................

C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_762588e32974f9e8\netloop.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1950 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	9316
Entropy (8bit):	3.520842831373584
Encrypted:	false
SSDEEP:	96:ZwK8MutZW0sHH+yAvnGlyhQlyh0yhwrfqREtjaZgwr0ic/vQwdZ1E6eLoT7Yu50g:2AHH+5Gl7lnwKC4v/Ju4l
MD5:	931140188B7C6C13002F4BD29BF06171
SHA1:	5148B331BD0999E1F325E37E16DC41D736E856BA
SHA-256:	3506E542E573F3392EEBDF2DF85CD73336E2762F631BCCC272BBC5B4DCD698EF
SHA-512:	F369000F14F7357CAC76BBFAE99674F68446F22C16B89D440345EBC85F830D9423D9FC74B4F104185904991CA6ADEA50702CA7695770171BB5AF2E9F01A48E60
Malicious:	false
Preview:	....................P...*......4Ne.................`...\|.......\|...`.......`!..h...............`$......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........\|.......................X.......................................................................\|...........................P.......................................................................l...................................................................L...............................................................................................L.......4...................................................T...........................................................................H...............\|...........`...................................................................\|...................................................................................................................................h...........t...............................................p...................................................................

C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\netmlx4eth63.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xc290 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	91252
Entropy (8bit):	4.118234741341177
Encrypted:	false
SSDEEP:	1536:CnZwY4oKZGD9cEZXiUbLX+8cm/YH1R4P5LQ4TXhWJ1j4sRoQROWcWDz0CAjZOHSn:QZwY4oKZGD9cEZXiUhcm/YH1R4P5LQ4D
MD5:	B5A1771E22871588EE926CDF1AC265F4
SHA1:	A3FAF216FC84F13DF04E94C698C1CB1B7F9A5D88
SHA-256:	971EFC05280B5F34F2009A0D3822BE58356841632EBA3CCC0DB73AA5407B37E7
SHA-512:	8C640A99327F33F21A6ACF7412CCB5574D9853641A41FD03974B180D99321AB8EB8AED217FBA6C87CB301D94F231859E607CA7E90A58EA30A29F4BB508A89AF0
Malicious:	false
Preview:	........................w...................../...........P....)..p....:..p*..h...............pd......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......`....h..................LS..<.......................0V..<X......@....!...............c..x............S.......#...................Q...t...#.......j..pP...T..$......T.......`....P.....8z...........{..........0M.......(..h........&..............Q......l............................5.......N.....p!......................x.......,..................$....M..p...d'..@...................pT...........O..........d...L....N...(..........M.....xN..,...P.......h...P....z...t..............4......................,.......... ...,-...Z......................$_.........\R..8...<%..................\...................L....v..8...<...h............Y..$...<............'......p...............P%......Le..........H......<).............(...@..............d...5....... ......D.......P...........\................[..........p....u..(...\|3......DK..d ......dg..`]..

C:\Windows\System32\DriverStore\FileRepository\netmlx5.inf_amd64_101a408e6cb1d8f8\netmlx5.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x10f90 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	114740
Entropy (8bit):	4.214571185877463
Encrypted:	false
SSDEEP:	3072:SXNfQ/ZaDu3ilYCxZbTC2rGaf6PAbRL4jXB76NuqqtS3K731tqWAELHHHSHFAUgX:SXkgRi31tWUgt/Q7
MD5:	516E31B106F52630140DA608D6BBD188
SHA1:	81699347DAFD0808077EED12216E3F0999723F99
SHA-256:	9D753F387ABB4BAB3E3D3139A17332224C3CDDAB6AE10681B63D1355324B2180
SHA-512:	CC3B7D93D05B415608452EAB0B0532826A9DB1FA28B854DF26ABDA946BA8558B8E7EF3E0585559DCA12E9C9CEAF4002CFD1BAA4D4E710711BEA4D1CFA78B2931
Malicious:	false
Preview:	........................QZ.....................#...........`........A..$?......h...............0.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S..............D...\...l.......PJ...... .....................;...;......'...................4...5......p<......@!.......*..`/......DI..$6..."..D........K...K..LM...d..............,B...B..x....H...C..............i.......&..p...............L...hi...H..D....................$...........&...-...F..........4................... ............T...... .......tK..<D..8....%...N...c......,...........(..............0...........$F..,&...........D.......E..........DQ......<.......t...0...t.......T...d...............L.......t...P...t...................................p........H.............. b..........................d...................L...............d................%...........P.......................... ...t...........................................P...@...............`...D...............x........N..................t....a..D...................h...........

C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_1f949c30555f4111\netmyk64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x20c40 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	194572
Entropy (8bit):	4.36866792905052
Encrypted:	false
SSDEEP:	3072:jEVKYeFc7/qhiyhqPPjUcM3psofb+WiSDQ20Gqb50wVavZ9g9UpG:db1u9UpG
MD5:	8FF33D66C8B7107A6B4FC09ABE5B264B
SHA1:	15CA65F2B05C07F5231F187F801A2A950FAE03E5
SHA-256:	019258F0CB8AF268C412535D222EA29369E917CE334CE0E075E22C88A1831A5A
SHA-512:	598300CFD06A67F0AB2AC22360ACDC1DFB78CFAC37333A6F6BA7C30B47385D5E584C3AF24BD962FEEDBC9446B280365C273C2CB560088806498200FCCBE2B6E0
Malicious:	false
Preview:	....................@...,.......R..............0...8............@...Q..@S.....h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......4.......<........@..\....r......\d..........N...N..h....1...j....................................<...........0X...a...i...k...l...m...n..\|o..tp...?..\|.......\..........@...........,...<...........,...\|...........l...........\............u..P....@..........................d..................l...l....Y...b...j..Xd..De...]...^..0f...g...h...h...P..........`.......@...............l...........\........z......p...P...T....z.......t..`............................................................... .......X........W...)..............XD.....(......p...l.......8y.......v......\q..........................h...<...`.......................t.......t.......0...........................t7......H.......H............W..........................................+.../...........y...5...0...2...3.......\|.......5..l.......d............6.......9...;...<..........

C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_35bbbe80dec15683\netnvm64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x6ac8 "Class", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	51716
Entropy (8bit):	4.012249312833772
Encrypted:	false
SSDEEP:	1536:PnrayDxiVW3Hux10kqExc9fOaSEqkcx9d456koqR0J11ITZTNgWeNTSvA/b//dOE:PnrayDxiVW3Hux10kqExc9fOaSEqkcx3
MD5:	F2D606973E434D9D56335F232875DD58
SHA1:	80E8ABFF67127BA177B7C21386BB19A37853B595
SHA-256:	AB15B6013D976CFD13A3DB8D6C258F3715E94218F17F98926B967C765AF7BF7B
SHA-512:	3CE0301D4F4C7551F872F749F40559D3488DF2E7EA230A29FE400E42488BD3E0794AC2BB2470AAA21B86DF967D5D044E7D141FF1DE62CBA2E806692CA78B1BE4
Malicious:	false
Preview:	.....................j..,.......R..........4j..U....k.......r..@....... .....h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........@.......R...............'..LI...........O..............(................7...............R...........R...........@..............<A......l7..l8...8...:...'......x>...=..\2.......?.......@..d....7...'...@...M..tT...3..(f..DI...L..D`...Q.......a...........I..........TL..hi.......2...7..(d......,T......x...`M...................D..................($...............e...'......\G..........h...._...........h...*...+..............03.........../......l....1...................U...:...X...#..@\..................`...........P........................................(..........d...........................h@......................(........i.......`..Lc..d............T...............T..P....@...A...A..lB..\_......xC...B......8C...C.......C..8D......(E......D....G..h%...6...%...........b..4S...N......,O.......(.......G..4G...F..........PW......hY.......]..........

C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_7080f6b8ea1744fb\netnvma.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x4bf8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	33028
Entropy (8bit):	3.9557696440240155
Encrypted:	false
SSDEEP:	768:LyP5a2Fbr/Y31Of/fd9hG6U4KRFRKV3fOkrXrZ3gd0oY+kDZNTGZhaKxhqUX/B/C:GP5a2Fbr/Y31Of/fd9hG6U4KRFRKV3fF
MD5:	711EB45F1B4E744C0009AE2C23355ABE
SHA1:	F26791875AE4FC24347FF5FB4175F331E0D8DAE2
SHA-256:	746B481B2B277C983F91A4CC513ED38EFF8E0AC82A10F17D421C06537E165898
SHA-512:	26ADD43412631CC008341254A5551090C3303FFD0D0301CC326F46FD80C329C6419077D721EEB1D7BC503B6F83E63841F733BBD2263CA2B8BCEC2772A10BE8E8
Malicious:	false
Preview:	.....................K...........b.........hK..(....L.. ....P..\...p]......8o..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........5......................P$...$...........<...........................................................$..........................h1..............t6..HH...H.......I...... &..0....5..(...@<..D....-..H,...1...;...>.......-..,8..........<I.......I...........8..............d9.......+.......;..,...T>...... ...........................................D#..<)...............#.......6...........'...'..(.......!..L................!..d,......................................d=..t?..h#..PA..8"......d...............`............%...................................................................)..\|8......@6..............................p3..........,K...............>...........1...1..l....2..........,>...G.......7...................................3...........6.......-...............&...'...<.....d<.......%...........5...5......................h.......`.......

C:\Windows\System32\DriverStore\FileRepository\netr28ux.inf_amd64_d5996f2a9d9aa9e3\netr28ux.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x28fb8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	278348
Entropy (8bit):	4.374406833182488
Encrypted:	false
SSDEEP:	3072:z+VZ8r3xKEjhVFTD2ZzDPRBm6dvNuZFbqwGFbE:z+VZ8lvcDmG1uZFbqPFbE
MD5:	016B11FCF80D9B57687E1E273E765D23
SHA1:	F4EC5BE3CB1DDCF53C23F810CCB9BB40B6BEB6C4
SHA-256:	1C048DAE6AB93CEBEDF1D47218309B1745F91860C8629960A4A64E48E41CFCE9
SHA-512:	A57B537B69CECEC9E978AEFB1594F998E16A45C293C37A8026A69F931C2A7C4A9EE14A5543F113F28E83ABE3BCC943614DF10BF7A053A92CE5F78A27806D8221
Malicious:	false
Preview:	..........................\....:.}.........$...Q.......T.......pt..x......`...h...............H?......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........P.......w......0................~...@..0$.......S..........0........Y.......Z..tn..$r.......m...i......`....w...i......,........:...x......PH...........$..$.......L............&... ...x..@.......\...lk......lE..Te..,...t........>..T...P............=.......b......X.......<<...?.......&...*..HN..@....}..x.......................t......H...@...d%..$J.....tR...Q...j......X...\|[...Q..d=...C...F..\|S...F......,g..LH...M..$J...J...N..(N...;...W..PX...X..0%......\|U..xz.......1......x......x......(...............H...dN..Hz..P....... .......#..@...H...........\|...l........_..h7...B..(;...K...B...>...e...L..\L...........V...'..T...$........^...d..................<c.......<..$=..4....>..H........O..........4...PP..`...<...p{..,.......<....... G..x...........t............v......T...8...TA..X=...'...C..................~..........................@F..p...

C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\netr28x.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1d828 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	219084
Entropy (8bit):	4.342562843517913
Encrypted:	false
SSDEEP:	3072:3QhUzoXykTAvQTzvg+dB6jbvcK1D/PLD/Rs:zIpFdaDv1DrDm
MD5:	44560E2FC0126C990FADAE73DC4FE027
SHA1:	C6CCE2D3B36142B4C797160C3F8317DC28CB6F1A
SHA-256:	EB3088F9105B0BD3F098ACA4F0F64738BD96EE287DF84E30C05290C3AF60DEFB
SHA-512:	054589ABFD3A64FDEF4B2B4C05CF0DA1ECBE957ACEAC6616FAF0D64807422B174703D9E4C9BE2DF9060B1F1B8E89C83A7BF268EC2777C9B5C22F879B6418C378
Malicious:	false
Preview:	....................(.....\....:.}.............4... .......0....f...X..........h................W......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......\...H...X....#..PU...U.................8........r.........<............n...K..........X..p....L......8u......d....y......80..x.................... ...q..............xn......H{.......V.. ....]...2..\|...,.......d...............q...T....................(...4...............U.......~..8!...k......pu.........\z...z.......\|...\|...}..$....~.....h ..\|#......t...H...4...4............4...5..<$..8'..........x&...%...p...a..................#......\l...l..,m...$...........h...k..........t[...S..`....v..@M..........P....m..Tn......Hm..Di..t...(................A..................0...........T...t....(..$I...I......PX..`C...X..\Y...\|...Z..D[..T...X.......h.......$...........\|...........x...........P........2..P3..d.......`...H.......@...T...H`..,...L...0...h...........0...hR...J.......O...Q...R...L...M..............@...T......H....c..................

C:\Windows\System32\DriverStore\FileRepository\netr7364.inf_amd64_310ee0bc0af86ba3\netr7364.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xa820 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	66980
Entropy (8bit):	4.141748311729847
Encrypted:	false
SSDEEP:	768:iyn4hCqGgLnhOLfKp2tbMoC8ahpgSVPeutTyGYcxzLwupH4vmeHxY6KfE0bN:ilCQLnhotbMoC8a82yGYcxzLwKH4+eEh
MD5:	89B05420C5ABA4EA06AA0B63349AEED8
SHA1:	40DF09FA1FE093803518A7ADC094A380C0F81713
SHA-256:	FB7BF5184AB7C22C258BFE9F27C5C2717D9DBD9869404FC84208E43B495EFFC9
SHA-512:	0749DD612294E8C15FF597551EB8E82CEB13E758689DAFBBDCA1E73BB27145DE8E445B200D0C00ACDD033D20DA733E98DF14E8FD7D2D770BF16FD4F450AD9B9A
Malicious:	false
Preview:	.................... ...<.^....:.}.............L.......................h...8...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......0~...W..h...`...........4G...Z...u..@...............8.......... ...D...............................F.................4...$................J.. ...........d...d..........X...d<...C..............\|r.........tp......T........w..t....c...b......8>...............(..t....)...*.................\|s...........`...e..0l.. ..........Xe......8f......TM...f.../...........F......\...............X....#..p........$..,......<q..h...........k.......9..,"...... r..PL.............. _......P...U.. ........C.......................!..........,........x.......M..8...8....Q..8w..<O.......................%.......x..........@........q.......................i...~.......j...M......$F...>.......N.......\...c...e..h................k..@....d..(....[......\........L..x...Ln...}..............48..L:...\...O...:...........#......4......8?...,..@m...@..$,...A...B...B...B..

C:\Windows\System32\DriverStore\FileRepository\netrasa.inf_amd64_1bdf7a435cb3580d\netrasa.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x34d8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	23036
Entropy (8bit):	3.8512437610712613
Encrypted:	false
SSDEEP:	384:b68RH56n4J/gcqqAVnV4p4W4aWC4WK+HqLZyc8r3LQ3qnoA5xRx2rPQ:btH56n4J/gcqqAxV4p4W4aWC4WK+HqLC
MD5:	629D5D68F088E79A5D368876EBF0B1FD
SHA1:	FD6F06383B4A136CCA5C6534B0D3A5D979887448
SHA-256:	830A22E7A48ADB07957E8736FFE8EB7C92C8F2C404E77DDACCF1966B5B410909
SHA-512:	73321C1146809DEC73A1AF266B0C11481954F52F81113601FA1285DCFA75D3F6485FFDA68EA1D6457FFB33A54228C33454652DBC7E6D49B014B3F5213823846A
Malicious:	false
Preview:	.....................4.....................H4..5....5..$....9.......B......xN..h................Y......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......D...........................$...<%...0..d%...-......D#......p2.......................*...........(..P...p+...........'..l..../..0&..............02..............................l...x1..H"... ...$....... ..t ..L(.......................,......H...........(.......................(...............................P...............................x....................... ........3..X...............P)...!...+...,...!.., ......P ..t.......L...................."...........$......................H$..................,$......8............!...........2.......................................%..............<.......$!.......................(...(.......#.......................2..............0+.........../..........P1...................................)..........h#...................................................................!..............$3..................

C:\Windows\System32\DriverStore\FileRepository\netrndis.inf_amd64_be4ba6237d385e2e\netrndis.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1b88 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	10196
Entropy (8bit):	3.5596560655543064
Encrypted:	false
SSDEEP:	96:DikIUNgdIa1X32V1zh561yUDL56bnsNzl4gMMmkIq99ellvXxW7fUjEfuseyHbrm:Dg2Vlzbns9AM4vgAjYeyO
MD5:	B7F9D8DD5F5DA05B9D39C4949ECC4A18
SHA1:	F79DAC28D6A220768EEC08F7C65C199A984BBABF
SHA-256:	E3B6DD47F25BE926550CD38756077A9F0FE668D09BE0BBC017D8FA3F114AA4AD
SHA-512:	AE6161605A8E24A1851CC2FC46FDEED1D0DDC0BE27EC42C2EF3DD0B27D758EFF2C10640FCBCFE621F03E77EFDB512FA5E522FACB85FA543700CCF1A3F748EB9C
Malicious:	false
Preview:	.........................\|../....#..........................(........ ..p...`$..h................'......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......`.......................\|...0...........................................\|...........................0...........................x....... .......................................,...........\|...................................................d...................................................................................................................................X...................................................D...........................................................................................D...........................................................................l...........0...............................................................\|.......................................................................................................`...................@...............8.......................(.......................

C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x76a8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	42548
Entropy (8bit):	4.047383523584513
Encrypted:	false
SSDEEP:	768:OLhuUjLXDkseF0AicyTNOnkSTZUWeL9S9j/4ypP7a86Mkzp:OLhuhsFTNOnkS2Wcm7ZI
MD5:	7284593CF8FB559AE230B2D9BB00645B
SHA1:	34DC3AC3FA6B2E97F1E2A27F5EBA466861E041BF
SHA-256:	36D3D2C2BEBAA4422F532A16F7AAE2C9F5662B6BDE8C307C105BD996CEFB74C8
SHA-512:	2FCDEF169EB32F6133081C7628116519583B3BF96834BA20419EF564CAD41562C98D48F41E3DBEC4AFF8C07BE01269744B8FFE0E7791E6FF6B2516B736625DBF
Malicious:	false
Preview:	.....................v..,.......R...........v.......w..\|... y..............h...h...............0.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........1...=...................7.. 8.......................P...........L...U..\|=..0....................H..$ ......H6.......u...........i......$U.......r...P...............S...9.......2...s......X#..8i...k..(j...3..`^..._...h..@........ ......,B..4p......$W...'...(...D..............T....+.......[.......a..........................0.......................d...p...h............&...t...........Y.......B..PZ......L-...............e..............................T........o...........;...D..@...\|...........0...l...............09...............................V..$X.......f...............[......\|....b......4d......................,l.......p...............:...u...............U..........X.......................8]...s..............\a..........p:...8..Dq...k......Ps.......h..................tV...W..............h............u..lu..........................$...........

C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_20caba88bd7f0bb3\netrtwlane.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xc8b0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	120452
Entropy (8bit):	4.078556544684701
Encrypted:	false
SSDEEP:	1536:KJ08IPRLH4M5q9RbC0oaqSF+Coe5O/dcH:KJQPRLH4M5q9RbC0oaqST50dcH
MD5:	5B5CBD02A8B4649834A0C99D1DDD4F00
SHA1:	741D39D88403F91FCBF6CAFE320524DA5C693D66
SHA-256:	EA526785DCB530D50D39E78927DB03541BC2DF8F3F003C3757BCEECEC39FAEF2
SHA-512:	26D89094CBD949DB8D1497EE8E7B753F1F74A01E178CF71A5464EE5923C44E977F7D1AA56D8E72E0B0EEF6FD96C9010B4C64DAA1BE2CAB967A4F3033131D3F27
Malicious:	false
Preview:	........................r.=....:.}..............................B......T]..(y..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........~......Xs...z...........7..T...D.......\|%.......B......P...X...$.......xd..........0.......x....v..........................4....g.........4................)..........(.......4....$..4.......t......p...p...x_..4e..$J...........^..........D............0...6..(...........@...................\...........d...X...p...8L......0....................................Q..(T...;..0...P.......<n..l...........\..li......$E...!...D..._......p.......xl.. ...........4...................x......d.......{...g..<y.. ...............8.......P......., ..H...h~...D...:...z..\|....=..HU...K......(...<.......4............'.. ......,...\.......0...............i..P...4Z..`...............0..........................................................l...(-.......5..$6...........e..H...P...................t...P.......+...q...........................9..,...............X"..

C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_b02695ef070d7a42\netrtwlane01.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xeff0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	137868
Entropy (8bit):	4.169334339916224
Encrypted:	false
SSDEEP:	3072:fiShCLzThUky+SxVWrfvqiTk6ezLtzZLY:a/U4VizLtzZLY
MD5:	CBD97D751922E64ABE77F6D1731FEB7C
SHA1:	11EB07D6EB5A1DED4746FC2E817888EA0C045185
SHA-256:	3AC03AA966B298328319B5870F37F9BB3243CDC7E5F353B5CA19273E2A422AF9
SHA-512:	A75A2B90719DC27119DC99240015075637FB5A21542429C8CEF8CD4274C4263ED81081269021A79524EFC4C6C1A6AD5B2636E72496CE451BEAF84AC04DABC8F6
Malicious:	false
Preview:	........................NS@....:.}.........`....................I...N...e......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........h...\|...............hA..Dz..........\|%......\|...\|...`...X...0...tj......\:...>..0.......<........4..l...................\|#..L.......l...............$....)..D..............@....$..4.......t....w..HU..................@...,....l.......a...s...x......H...d...Lv...z..\|.......d...........(...4...........d...................p........3...............W...{......hs...0..41..h............k...S.......H..<X..(.......XT...!...F.......L..L....\|..ta...V..\|o..h...,$..H.......................h.......L.......................d..................., ..H.......0....D...S..........\....N.......K.......................'..T.......H...........4...l...............4...8u..`...............43...........V..............,........%..........\...............h@..T........I...p...6..4.......P...............q.....\|........+...[......$.......h...P<..h=..8C...<..8...........X"..

C:\Windows\System32\DriverStore\FileRepository\netrtwlane_13.inf_amd64_992f4f46e65f30d4\netrtwlane_13.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xc078 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	89732
Entropy (8bit):	4.1633887108668
Encrypted:	false
SSDEEP:	1536:EJ8MW5WtqHaWfsKuyNknv2rmJMdrcBgjVbLSQbI3R:o8YtqHaW0KuyNknv2rmJMdrrkQbIB
MD5:	4C272FCF7DAF2B4E825ADE1575A2FD3B
SHA1:	954194F501DDDE79F13D9C1AC3723CB066C49165
SHA-256:	3F38A412F6BAA8E66A55E8AD68DFEBAC5E0C8ABA7F6A2E05D109F006674DFEBC
SHA-512:	61ECA87D759CEA143EDB12743C3818D6C7CBD6452C4419C01059CCAAA9972B469CCE63F743A7AED87AE95E8758C3D91F6CB1EAC645A4BB6E2E9FD5F752391025
Malicious:	false
Preview:	....................x...u]B....:.}............j...p...H.......d).. ....5...(..h................^......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......`5..d4......D[..p...,^...?..p@.......*...%.......\......................t........r...........[.......?..........t:...Z..`...HM......9..`....B..`n.. .......).......2..xK...........#.......d......P.......`...P.......8..............8.......<....F..X...\|...l...\|F..,F...k..\|......hE.. L...G......H....M...................n...............................b......0....~..8...T.......8....... ...@C.....x...x..........d!..Lr.....`............^..(............#..,........w......,{..8......`..................................t............................................w..(y.......................z......h'..0A..t........A......\.......p...\|...................X...<....&.................D...............,...<%.....................................................8.........T....s..0J..,........H..................h.......<............................!..

C:\Windows\System32\DriverStore\FileRepository\netrtwlans.inf_amd64_97cd1a72c2a7829c\netrtwlans.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x7668 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	67796
Entropy (8bit):	3.973416764847058
Encrypted:	false
SSDEEP:	1536:6uLR8ya//TKkLPqXerbsIE1LP9LJdo9+Rl5D5dZ9Odv7rGziy2mq:608yaVHr2P9LJdo9+e5
MD5:	1FB1AD5244AD75E7940E204197EAD14E
SHA1:	5B1D771CF8FFE2A172806154004E442B9AA851AA
SHA-256:	FB1BA3D9B56D190BEA1135669551858B939E24349065CD810D3CA5B13B0EA5F2
SHA-512:	4F1C9F6A41BF23D73EF4D52287ADE42653C95FA1B12E63D8FBA73CCEC623F105F7D1D2AC1C3D7BD29A585BB240DB1EEB67291F3C3DDD2248DCE534D938F181C9
Malicious:	false
Preview:	....................hv..<.^....:.}..........u..a...`w.......~...$.......2..8...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........W.......H..................L/..\m...................[..........\|J.......C......lh...G..............\|...\.......X.......TQ...s...E......t........X..(...Hd..............dC......tn...W......\|Z...T...U...F...o...Z...........X...c...E...........e...........T..._...............e...C.......p.......e...............................l..................4................j...4..X....t..._..h4...4...k...t...3...3...5...2...4..h3...l...q..0j...8...7...r......,2......P6..p<...........c..@k...............L..du..8...........,u......`r...^...........Y.......M.......R.......S...O...f...........Z...L...P...^..pg......p....0...@...j..._...<..`G..pt...T..p........h..........t....Q...n..@q...l..............\\......$c...W..0f.......2..........d...........lU...:......\1.......?..T9..4&.......... m..8$.......+.......-...%...&...u...u......."...)..........Lc..TH..........

C:\Windows\System32\DriverStore\FileRepository\netrtwlanu.inf_amd64_1815bafd14dc59f0\netrtwlanu.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1cab8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	246276
Entropy (8bit):	4.32330182343796
Encrypted:	false
SSDEEP:	3072:Uhbt3B2H1Hw2f76rFvLS+pHmyRfTDDb9do:UhbWRw2x4fTDDA
MD5:	3A7B5A81BF8B54B90F98815723A38F91
SHA1:	B9F9331BAB66AD0FFA6FDF250A2B5EE600E8E6A7
SHA-256:	22B39AF29766FEFE4EA532A2D021C9C07C9B33B26CA8EF434A724D8ABBF78290
SHA-512:	F073284A2E0087D93EF20B68C8517D011D3E4242FE560948980BCA4A835EC2F844AA0EBA9F44D62642A93F0E821B2F9AF557028D46124BACA7D96341A88921F8
Malicious:	false
Preview:	........................<.^....:.}.........$...............8....~...\......p...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......h.......,....p......t.......pl......f...u...............l.......^..........X....P...*......,......X...........4s.................8....h...1...4..........\Y..H...4x...N...P..`Q..\|........................f..0...........\....#...U...........!... .. ...T+.......2......D_.....,T...9...........[..$...lc..he...Q......H"......0........]...e..._..l..............(...\.......`........U...T..T....e..<...t........3...Z.......s..h....v.....01...@..P.......pf..............8...H..............G...(...........A......l...............r...............{...\...d...9...r.......z.....$k.......:.............H<...&......(... ......l...$~...............\|...2...I..Dw..L...DO...P.......?... ...^..pA...:...e..Pa.........................!..X........}.....@$..................$........m..H.......,u..\|M...8..$...h%...d..........T-..T........?...=..4....#......`G..

C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_e76c5387d67e3fd6\netsstpa.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x13b0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6748
Entropy (8bit):	3.3307396977501464
Encrypted:	false
SSDEEP:	96:8zlxu+BECTRq3dYT36VwXSRN2oE1Dj0eqmn:8nQ3d864nhDn
MD5:	59D7359E52B2DD6554AEEC91DB12A63B
SHA1:	2CB235513A9A8E19CE862D22987D0DCE66C9D95B
SHA-256:	8E6413490D7572483C1B3C2739A8D001CC15D6DCFA7BB03467B39E1954BBB206
SHA-512:	1C9203FB887CDDAB7D3810F00990F1E4DA3FD0983D12F3AA2F8D0BC1F18CC1A0B1C118ED122661C9C41705FBDFF82FA80E12DD7FC43ECF1D16964A8F20D73F2A
Malicious:	false
Preview:	.........................b.................................p...t...............h...............X.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......(...................................................................................................<...........................,...................................................T...........4.......................................................................................................................l...................d...............................t...............................................0.......p...,.......................................................................................................\|...................................................................................................................................4...................................................................................................x...............................................................................................

C:\Windows\System32\DriverStore\FileRepository\nett4x64.inf_amd64_54eacac1858c78ab\nett4x64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x69b0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	57236
Entropy (8bit):	3.9724762061094334
Encrypted:	false
SSDEEP:	1536:Z24AMeM0zVggrfSEZvcjroQswtGWA7A1YF2/hqwmVfmxRmiGI3u3KXwvv0Mog5KD:Z24AMeM0zVggrfSEZvcjroQswtI7A1YM
MD5:	1ED94DA826D41CB7D364108F0284BF70
SHA1:	E71C7755958BA15EBCF14DE62468FAD572E2959C
SHA-256:	9F47FD90EB062EEFC4508355A57F9DFC63A9C3D4BC583915CC0B621C9F446CF5
SHA-512:	C1C7575972AC4AB553DC8F8A67D8A72484A710B1EC514D5FAF91C657B41F0DB27F1FB6DAF4F0A80DB578628D504314ADDE3A37BDA067ABB42F910CE116F0FBD2
Malicious:	false
Preview:	.....................i..QZ................. i..0....j......hn...........)......h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........,9..8...........lZ...-...8.......a.......... ,...c..................\N..T............,...........-...!..$[......P1.......0...6......p0...Y...g...Y..xL......XM.. Z...&...!.......;......X`...4..H4.. 7...E..,D...\......4Z...C.......b.......*...........:...S.. 2......Da.......3.......D.......\...G..X:.......B...... "..0V...........8..PZ.......d......\|f..........t-......(h...?......t....@..D=.. ........=.......V......pX...5..........................0M...@..pS...Y...>...[..(...................$...........L'...b..x.......D...t`..lP...<.........../...3...(.......:...............@...................(......P%..."......(.......`d...c...............c...............................Q..\|........E...........g...R.......=...............]...P...d......p7..........d4......0........`...N...1...E..,E..xT...............h...h....... ...........X..4>..LC..PB......

C:\Windows\System32\DriverStore\FileRepository\netv1x64.inf_amd64_30040c3eb9d7ade4\netv1x64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x36d0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	25700
Entropy (8bit):	3.865719465655544
Encrypted:	false
SSDEEP:	768:PKFSHdHyEp4CMGWQpMD7nvNQrP/PXUpKn:iFS1yEp4CMJQpMD7nvNQjPkMn
MD5:	3A5B8702CC8B174C9608EB8F15EA48A6
SHA1:	EA804A49A3A68B39B49B0936126AB1315080A088
SHA-256:	BD3489DCEDB8EC48E6FB4C1B5AB91F8B0786788DA643F04424FAE3881B7AE8D5
SHA-512:	1E23A0BF3B9797CA8E2295468EB20A547FD3FB6B01D18BBCA4DCEE0F19DE8923DBCEB8BC2BCC835620028B7D7E788D7CDFC3E9BF1367C11F139116B463A8DF63
Malicious:	false
Preview:	.....................6...+....yl..........<6.......7..X... :.......E..D....U..h...............`d......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......<1..............(2......H................%......L'.......(............... ..................................................8................$...2......\,.......,......<.......(0...#..........$....%... ..D%.........../...2...........,......H....!......`"..........................t ..................................\................................#.......................5..............4$.......5...........)..D*.......... ...........................\!.......!.......+..........................................\$..........h...p......../..........................."..................l+.. 1..........................4 ..8.......,3..(+......................H+.................. .......D...................D1.......#..............X......../...3......T... ........................+...........!.......................6...5......@...d............+...$..........

C:\Windows\System32\DriverStore\FileRepository\netvchannel.inf_amd64_ba3e73aa330c95d6\netvchannel.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xf78 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5220
Entropy (8bit):	3.0284850762333386
Encrypted:	false
SSDEEP:	96:QGMMOFKlpO1J1e7KRuc1MO1Z8OTCYOhOxOPAkOPgvU:7LiCGSiWEU8EYgvU
MD5:	9C4C3449AFD39BB6C240CF7D844F5730
SHA1:	B3A8287E2D0B338AFDB4366E381D855EB27F2704
SHA-256:	5C5B20A30825F61E5B3ED776994C0B69804C6125EEB4F82FCCDD54AA09DD7F89
SHA-512:	48D71B7D96540E2FA4B35F40AA091439F243296C852F33AEE67CDAACA09FC83F3C54C88C24DA7F7D9E122C690BAB9BE70B8D1AECD34D6358D344F63060A80CE1
Malicious:	false
Preview:	....................x...<.(......&.................p.......P.......P.......X...h...............`.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................................$...........................\|...........................................................................................................\|...........................................................................................................................................................L...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\FileRepository\netvf63a.inf_amd64_a090e6cfaf18cb5c\netvf63a.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xe6f0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	96092
Entropy (8bit):	4.152985063702903
Encrypted:	false
SSDEEP:	1536:VOMgcTGCCQ9QHomjP99LYwP1ejsBPGrwIQjg79s0nWXpw:VOMgcTxCQ9QHomjP99LYw9ejsBPGrwIj
MD5:	19BBB1A52DD6F720D8920145DD193D51
SHA1:	802DBDBB3B56D061A53DDD85517B6AC63757556A
SHA-256:	FB2818CE5F21587098D40511BE1C22B7043C2EBC50229D333F0CFB00A3A89155
SHA-512:	4721DCB95A3EECD2351158FDBD5DE88902064EA74F76D8FBDC5E3728B50A1DAA03882F0E70B07B8F8DA9924290A9EA914D130CC915B1DC7810661A050F554E2B
Malicious:	false
Preview:	........................,.......R..........`...-...............L&.......2...D..h...............Xw......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S..............P....g.......8...!...-..........t...........................................................h!..<...................h........(.......... #......h"..........pK.......................... ....".....................\|...P... ...........`...........H............#.......,..X.......0....+..........8................... ...................4...............T.......8!..................................,............$..........d.......................................H....... ...................................................t...................X...........................................................................................P&..D.......X...T'...........+......................................\............................)......D............................................................*..H$..,...............................d...\|....$......

C:\Windows\System32\DriverStore\FileRepository\netvg63a.inf_amd64_9f5493180b1252cf\netvg63a.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x3bf8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	27724
Entropy (8bit):	3.937899210432298
Encrypted:	false
SSDEEP:	768:t3aSi4ymSIe0w1hckyJjv05GlwIjke1Ep+:BB7ymHe0w1hmJjv05GlwIjke1EQ
MD5:	C619E809976DAB33897D42FF9DB3E874
SHA1:	1F21C44B8B75BA030A96AAA5BA803159BCF3AB5B
SHA-256:	15A7FF09DEC4DD6F013C8493DA4D82771CD02313B4E3E5057A526F2D20EBFAE7
SHA-512:	F49FA1124B84424D2B9FF5890842E4905881DE6151F9FBE4551B8FD7CE14F96F8060FAEDA89477AEC1C77D605D44C9FAAE5EFB8356FF6E61B789685AA44292BB
Malicious:	false
Preview:	.....................;..,.......R..........h;.......<.......>.......J......p[..h...............Hl......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........&..........l.... ......(...........................................................................................................8;..........L:..H4..................P........................$..\....%......\|+...#..t$...'...(...4......./..t&...........&...........+..........."......@5..............\|.......,1......`/.../...................-...............................:...........&..........'...'.........../.......0..x#...............................'......P,......4#...........................)...........+..x.......`........................................-..........0........)...................+.......................6...'......'......./..,...............................................<&..l9..............................d'..T7..................`$......H1..................................4...p....:...:......P............1..$...T...........

C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_ec11d0ad3c5b262a\netvwifimp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1bf0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	10036
Entropy (8bit):	3.5745806098990127
Encrypted:	false
SSDEEP:	192:tKxxWZu6m7uO5u5i6VeljKlsK+Kvzlw9svuL:tKxxWILa35iRGVvzQsvuL
MD5:	8AF36A11E9DB9F95D82A9C0856628210
SHA1:	03CC3E0DB53139E4A273EEC661CD17783060CE1E
SHA-256:	F46827B647ED76A16C279CC6E86433530A246AEB407F853978910D2A6D53370A
SHA-512:	DE1DD061DF9F3C668F67B386662AD3262BDE573EB27F0058CBD24B079D9910A0FA301D9CD524625727C8339E322CBA0379AACF9863BF61E486191C2F536234A0
Malicious:	false
Preview:	........................<.(....yl..........\...........T...@........ .......$..h...............0'......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......4.......................x...`...................................................L...........8.......,...........................................................................................T...x...H...........................,...............................................X...................................\...........................................................................................................................................l...............................................................................................................................................................................4...............................................................................................................\...................p...............................................................................................

C:\Windows\System32\DriverStore\FileRepository\netvwwanmp.inf_amd64_f9e30429669d7fff\netvwwanmp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x10e0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	5676
Entropy (8bit):	3.1483727973632583
Encrypted:	false
SSDEEP:	48:0PuY9X+g7ilW1q24MvuFp5ulGF/RA17ccT9EdGxhRz7f+xdr7+Ex3ZxE1qMZ:0PD9X+0it24MvuFD/RE79Tqdpd1luZ
MD5:	03E17022320B1F748366C286F0666402
SHA1:	ECBC102291D14A2DCD3B6FD9876066749868F4FB
SHA-256:	83938F194D74228DBB1FABCC9B3ED302782C6561BEB38A4EC97BC26957C736AC
SHA-512:	39F73EC3794DB344151BE85F5B6FE04043060A002087A0E55C4954EC283131EAD9A82B1EEEF8C549F4E57008FCE65453606D0612D8A554D184835FD198AD04F5
Malicious:	false
Preview:	........................<.(......&.........P...........................@.......h...............(.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......P...........................................................................................\.......l...........................................................................................p...................................\.......................................................................................................................................<...........................................................,...............................................................................................(...............................................................................................................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\netwbw02.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x18dc8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	237404
Entropy (8bit):	4.191386164047112
Encrypted:	false
SSDEEP:	1536:znii7cc7TMXHKsJu5Wg1Pmb6C6ehbFPAORPFwQKZqCcDr9gK5:z8c8XH76C60PTIbcHn
MD5:	340C5D418099AD19E66DF8852AEE35CA
SHA1:	D022E79B56F18100F6CC81F9D7BB91218C1D45BD
SHA-256:	3E094D018220615E9AB44D04D122E5A9050A915B888EB958F1E65FA9FF7C5838
SHA-512:	66BC4C88AF4EC69285ABCC72158478BC52B47BAAC92B5E1A001564EA921E50A20870E61BF599347A2893C25B1BA2E0D1BBBDC10EEC41491F06229C9EA744E392
Malicious:	false
Preview:	.......................u]B....:.}.........4...........#..x.......8>..........h...............X.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........N...*......D2...........,..0....x...................u..P....P..x...........\.......pI..t....U..(_...,......L...t............0.....(...........B......X,...&......H[......`c...v.......H...3...E..X}..._..Dp... ..<....X..(...........(........$...... .......l&..Px...............x...s......$........[..dh.....(...............4......T...T....t..<u..............`t......4 ...J......p!...........i...........T......8b..$N.......\|..... 9..p>......H........z......x+...t..hR..d...............x...l...............P...............`....!..(X...K..0g......8"...D......h............c..................Xu......$G...:..........\...........tu..............P ......h...........dI...b......t$..\.......@.......H%..<....'..8...............H.......\....v..X'..........\|....j..(x..xd.......d.......g.......u..t...................@...........T"...A..<<......x...Dh..@8...=..

C:\Windows\System32\DriverStore\FileRepository\netwew00.inf_amd64_325c0bd6349ed81c\netwew00.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x98b8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	89092
Entropy (8bit):	4.008618631867438
Encrypted:	false
SSDEEP:	1536:NTnU253b7nuo2wKsMhCSEW5GKVrgS4NIb+snQp+D11ag0QvApGsfr:NTV53UwK8SEW5GKVrgS4NI5D11ag0Qvo
MD5:	2799730807CFF0D3349AF41C3B399BB7
SHA1:	D4623637EDF67B414F0F7CF18E3AB19EE3AAEAAD
SHA-256:	B9850924B03B1E3FEBF6A8F90462F07D469823A4C9948312440FB07860DA0997
SHA-512:	14107508AD084725CF7F2C3FFD19BB538DD8769B354F023DD3A7837641F1FEA2F80E58420000F167FEBF2BEC54DEE6C4367907D83A19AFFC98827BBE0F3EA9ED
Malicious:	false
Preview:	........................u]B................4...q..................P...XE......h................\......C.:.\.W.i.n.d.o.w.s..............w..............P,...)..........h.......P...<u.......k...{.......?.......j...k...............,..........@h...........t...^..Xq..........D........+..xt.......e..X?..p...Ld..............`{......Ti..<\|..,r...q..l...h....!...C...}.......%........... ..('.......%..x4.......B..................8....9..........H~..$.................... ..4r......H`..........X....+..d............h..........$o..(... R..lp.....Tk.......r..........g..........\|U...f..P}...".....DI.............$...0............t..............................Ht..................h!..............\|.......0l...C...o..x..........................L{..............P........................a...{.......k...k......0%... ..............&..X%...(..4................................(.......$..0*..@p.....(_.......m..........P[..............L...........T....................I..H....P...v......h....p.......d..pe..

C:\Windows\System32\DriverStore\FileRepository\netwew01.inf_amd64_153e01d761813df2\netwew01.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xf730 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	182812
Entropy (8bit):	4.065974399254813
Encrypted:	false
SSDEEP:	3072:yN7vyk30W1oCr2r1Y+K5+N/W/AdKT2kETAlKbPdNK766Ej6RO7ridYeIMc:Qx6VzMc
MD5:	13988AAE49911D1F25C873E7B679807E
SHA1:	1FB9AAFF612A413AEBA3EBA9E2E4C4B436DCB816
SHA-256:	BD0014F486A58328A08550B65BC17A0337DC8225B5C754096F75C225C830E33C
SHA-512:	03E04A17AF4FAF9F554860311EB431FB35F086AE800E46F7F9A9E8AEE5DCC2E49CD503237D6338CE01E8A695537F453171335909AED4B8CD34E90481A3AD9730
Malicious:	false
Preview:	....................0....6G....:.}.................@...<.......hp...\|.......#..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........ ......................T....+..x...................$...8...... ........Y..@...pI..PD......\|0..0?......(i..................P..........\................-...)..........dY..........\.......$z......Hq..............L...X........#...]..\........'..........."..,)..................x....:... .. .......l...`...............(...................."...........................-..h!..........`m.........................@........]......0Z......P...........p...........L....,..x...............x...X............................... ...........$.......0...........l#..................................\|...............@..................p....................!...!...i..<...0.......p...D.......4'......@............(..\'.....8......................................<...4,.................P...........8...............................`...............`......................

C:\Windows\System32\DriverStore\FileRepository\netwlv64.inf_amd64_0b9818131664d91e\netwlv64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x29320 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	525196
Entropy (8bit):	4.2746799020128625
Encrypted:	false
SSDEEP:	3072:Qd+EmWuBFrHoNIoE47etlvR3ouFF9uO7bLfnzaa0Ec/07OYqfyTptY9vDpVHT9sU:QyC20CGraBKfehkb8Qm7O
MD5:	C92CF1DD5D5142E2D622BFA8105A2BEA
SHA1:	732A3A3548EF2D33CA62F35246667466EC8C03A6
SHA-256:	05B3CD0BC5CFA659591A020C844ACDBCB621B90DCD44DE88013482525D01A910
SHA-512:	0DAF86949867B61A47AB595831E13543765A1BA8190B0F9DA9D4FA2C84D627FA5F541CB165905B8B52DA26728E750D0A3DDE25ACB3A24A73EF78FAC5F8A07DBE
Malicious:	false
Preview:	.................... .....I....:.}.................0....M.......?...!..........h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......\|W...Z...].......D.......u..<%..........0............/..H...\|...H...Da..Dl..xl..$k..Xk..PP...z...Y......h........%...E...s..........l...l@..H....X...I..(..../...Y...q..40.. s...l......j...........W..........t......I..La..l0..,........... s...I.......m..,_..d9.....D8...3...:..l)..hl......du...y.................\|i...K...`..........L...<G........._..@R..<>...<...l...N...............W...:..l........D...U...'......\\...C..$<...5...S...G...m...I...D...R..\|s...}..<-...2.......V..tA..<S..............0....d..\f..x............/...Y.......r...-.....$q......Xp..8...x...`U..4A..........\...X....@......P`...b..tr..p8......Lu..H....H..........4...Pb..@,..X0...^...&...A.......r...@..d7...8.......-...^..t~..L....b.......B.......?..H..PJ..l........d...V..4)..t7..d^.......R..0.......d...........,/...~......t=.........,...........TI...V......<;...4...V..

C:\Windows\System32\DriverStore\FileRepository\netwmbclass.inf_amd64_dba6eeaf0544a4e0\netwmbclass.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1c60 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	10492
Entropy (8bit):	3.5969452449115065
Encrypted:	false
SSDEEP:	96:aVFFzOkn0maOBgD71tlJ61Y5YMaeqMn56QGVJ/NT0vyjbvMwxA4ZVl/YxnDTHaqn:axumtSDxA0xlqE6f/DvNA4MDTHaK
MD5:	FE9947A73F5417DBAF9C0805104495A4
SHA1:	EC8220FC500DE34EF4CB2FE166A41FBE63C9B470
SHA-256:	6D6189E5847D4B1E6CC114D0771CA56AA4111164911B2CF477E7D4B6F9363373
SHA-512:	E5F5927533B8DF7F62C984E2E72A139183B233433EB3E2D2C50D646B5BD34D14F05F70B6B2FB5FB98F75FB0A352BB8CDD6052E2DA8D46BD88BF4F077534BD5D5
Malicious:	false
Preview:	....................`...gi../...(km.................X...T............!......P%..h................(......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................x...........\|.......................T...........................@...............................................................................................H...........................X...................L...............................\...............................................................................................4.......................X...................h.......x.......................................d...............................................................................................................................................0...........0...........................................................0...........................................................`...........................................P...p...................................8...\|...........................

C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\netwns64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x12018 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	177060
Entropy (8bit):	4.1302298013692536
Encrypted:	false
SSDEEP:	3072:ZolIP8WNhtA+Esd5+ENVKWXqgz9I3+DrkkO8PP8CQ2NiiSDpp6zrejoD5Oev2wfg:ZWwoKF2F
MD5:	130B39F560AC5A5D296C34B8801820B0
SHA1:	09762007C1B42BDC0FDEE6CEFB9A58AD00AAAED4
SHA-256:	9F9AD4BE5034BC2576453802D77F39B0C5324427C4683E910823EAD536B22392
SHA-512:	310631354EAEF9064E6ADEB1233133A1F9937467707133A2AE6E80DAACAA44FCDD1C335BC845643D043B2D40256305CDCA052C2BBF20E6727353BE1C1A4A83BB
Malicious:	false
Preview:	..................... ....I....:.}.................(!..L...x/...c..0...8...h#..h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......x...H............f.........................................8...0...........\...........\...DQ...u..\|...........H............a...........e...............o..........DT..@...4f..H....p...U......0$.......h..T(..........X...tb...;..d...........h....]..L........r.......5..\|...........................p....................\|......T....%..............p..........L...........0.......`.......L...........d...............................Y...................%..........<...$...8...H...............H... ...........4........y......d!..............\...........4...4...._.......w......(...$i......@...........D............$..x...............................L........6..p*...........U..........D.......0...........$...............<9.......{.......4..@...D................... ...0B..$%......@?..........d..........8.......T.......h........{..............................

C:\Windows\System32\DriverStore\FileRepository\netwsw00.inf_amd64_24d55504ae3587aa\netwsw00.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x10c10 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	161044
Entropy (8bit):	4.114887075904147
Encrypted:	false
SSDEEP:	3072:92gwK1gc6v5lseHYvNsfm0sI1vaHMUS6B/2mqqX+c9Bs:Q/I+Us
MD5:	8EA0F5F9152F7F45E20D5F3C436BA9F1
SHA1:	D58DC01750A7D40AD2F6192526CB19DC6534A6F6
SHA-256:	5E2910B3757B35C58928EE2EBD5E920E3FB12B3681649A8F7E55098ABAB6A4F4
SHA-512:	90CC110B08F7BB2C385949B7F2733A59D62D94CD14C5A0B0ABA710B3FD5E7CDA05C911B0810F7B8BBAC7B61547048158C714B45066F0C1FBDE371BAEE698EF0A
Malicious:	false
Preview:	........................F.K........................ ...t.... ...U...v..<.......h................u......C.:.\.W.i.n.d.o.w.s.............D.......4.......8T..................P...4.......h...............@~..`h......X...\|............S..4...........................0...............................4....~......(...(.......h...D...........t...................l...`............P..........PK...t......\...Pc.............. J.......... ...P...............`F...................K..........................\|S...J..................\...................8...............................8.......t.......DM...R..h...D...........T...........................p...@C..<...........4...D...(*......(F..................................4...D...............D....R......\...............4...........PJ...J......l...0...p.......t.......lP...L......L....$..@Q...P..........T...........@E......<.......`...4...........................l,..d...@-...)..\|...(....... .......................E......\|...........T......................X...

C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_42e02bae858d0fbd\netwtw02.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2d860 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	413292
Entropy (8bit):	4.1786985725766765
Encrypted:	false
SSDEEP:	3072:MWh3WYQinxQGNnrKSjGekfdFtqSPT2ZHBl3oX:v9rKSSeklR2ZE
MD5:	2BFCDBB7D28FBBBD1DB415A197F989F6
SHA1:	AC1B8CFA76365E2AADF2B841E97B28827DB5CAE7
SHA-256:	4801C9E9802DCF738B2D48F72E90F9DB6601097290D48495DDD419BE621A9CD8
SHA-512:	7A4C06A921619F968EB9CA65644E58910090ACCD85F2B65C19A3B21D7801A4C6FCFE83E4D544FA8D8BFC84C39070C7DC0954DC64DA4EAF03D424A4D075F4C676
Malicious:	false
Preview:	....................`....[N....:.}.................p....;..H...<.......l'...&..h...............hN......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......T^..........`6..@....,..,"..\..../......@\|......0...L.......}..lZ..PU......(........$...W..p...@...................4/..x....S..(K......,...........l#..............8...p...........`...<m...n...j...+..`-...(......k..........z.......G..`I..4.......h.......0a..............T...<.......0....... ...L...........................$..................$..,....c..Le..x`..p!......dp...h...b...&..p'..(....2......H(................. .......(....g..._..8... ...h...`.... ..................................(...........x...........t.......T...........f..(....9.......6......(-...;...............\|..............8l...m...i..(...l,...'..............\...t).. ...........................................................<...$...................?...7..............h...4............v...w...r..p_...I...2..`o...t...a.......F.. ...........<'..........8.......$..............

C:\Windows\System32\DriverStore\FileRepository\netwtw04.inf_amd64_c8f5ae6576289a2d\netwtw04.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x188c8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	217836
Entropy (8bit):	4.218648972746863
Encrypted:	false
SSDEEP:	3072:+jldVySO3lJRNWXasY3dmYmIYAPN4uUP1fBmPr2bHOA7vIs4hu:aethN1UP1fBmPr2bHOA7viu
MD5:	16F9BC19431C1EAD5F016198BBB646FB
SHA1:	E9016FD4902546F28457E9FF0A0CE1E81F80B659
SHA-256:	732F745065717F2FAF9EE0DF54CE31A6066ADE15175DA23543237FA0258A0F8F
SHA-512:	7AF184347B763804CFF35E5A9D43B6580C43C33C02E4094DC466A34391842B7507447979989EAB89BAFAB4297AB9F874965FD51BF376C266A1AD22D481983BE9
Malicious:	false
Preview:	.......................[.P....:.}.........8...a..........p....v......d.......h................R......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........%..`#......\|q......<M...'...!..................0....t..._..l+...z..........86..X_...G...z..l$..........4...................l$...&......p.......0...P...0...............\...dk.../..pS..........dR.......4...m......$....D..\...l....:..........x........t..<............v.........h...`q..d....-...x..$................o..4...........x...D...........\..<I.......(...q...............f..L...........8...XY.......i......(`..l...l!..(.......T...$}.......z...1..d%.......&...]...,.........................8O..........x...@....R..........Xt...8..Di...#.......................6.......b..t...\.......D....s..l....A...+..............8........s.......P..4...........T....e......._...7..........D.......H%......$...0... ...@...............?..(...........0 .../......L"......4y...c.......K..........HT..8t......@...@~......0.....................`...........\|...(.......

C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_2edd50e7a54d503b\netwtw06.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x12d70 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	165348
Entropy (8bit):	4.154248243354286
Encrypted:	false
SSDEEP:	3072:vO8YlYwflnLZZ/ZH8dY3trm+lkCSiCSCiCiySiSiyCiyCysSiyCzyCSyCSiiiiS0:igyrm+Ff
MD5:	623AA589075452AFB1A045603A70F05F
SHA1:	A67A19526787C6DA571B5D165FA1A98F73830424
SHA-256:	3C04BD8A9BC38487326F0DF015820BE097AE3692103F7B258E6CC080F92BE85B
SHA-512:	AD5DAB1CEB683958538D76A16C5EB000DB7900CAE55312A39DB4034D98FC6D350CD8ED1438CB56A6D0E8C3592E2C17F615CCA0261313225CFE78A2AF2640A02D
Malicious:	false
Preview:	....................p-... T....:.}..........,...............B...X.......u..`...h.......................C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......l).. '..........d....\|...+......0....................................a...h...J..............,(......d+..................@........n..........L..........0+..`#.......x...h......8...........D%..............8.......d...@"...~.......l..........8...\.......T...........\|...D..............$...pb......4....w..........D.......,s......./.........T...x....P...R......<....\|......H,...................,...,..`...............,l..,%...i..........................p......P*..........Hi....... ..........H...L................+..........................................\......................................................................\|'..0....}..T...................$..................(...h....).......!.. ....$...y...z...v.......................#.......!.....d.......0................{.................. "......t....+..l+..@................ ..X&..l!..........

C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_7c0c516fb22456cd\netwtw08.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1b7c8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	227612
Entropy (8bit):	4.3090951432189675
Encrypted:	false
SSDEEP:	1536:YSO0oB644+T6pAMpk293nW6Y0e2qgj4BYUoEaYpHEnzYRrMxaul9B4L7K0j05pTi:YSO0gSdptpn9Yjsj6bPMwul9B4LL
MD5:	73A554F2F2753483530811C097EBE473
SHA1:	5CAFC807E8EA45F141CA83464CEC9AF193703C5F
SHA-256:	15A9034F5E2AB67873384BCEB5478F7989D719CF3E3AF9BEDC75BD888A3945B6
SHA-512:	AB01D5EC6A8201B01B93F167AD458185A9EBF1912EB5AB2146E7F0B96EB8DBE13EBA75B26BCEDFA0AFBCD476708B60F177BE72E7CF212E1017D25210188D68BB
Malicious:	false
Preview:	.......................}.U....:.}.........8..."...............p...?.....P...h................y......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......P0......<................4...,..........X........y..x....}..............L......4....P......./......P4...(..`V...].........<1.......;..HE...1...@...R..@...D..Pb...Y..........DY..tz...........Z...:...^......8..........t.......,...L......0...@#..8...8%......................`...H....!..4.......@Z..\%..<O.........x>......<............%...A..8........E......(v...p...$......,E..DL..............0...(............8..0...............@.......T+......T...d.......<3...Z..................P...0a......L].......I..D5..h....................a..4..............D...........8...T...P.......l...P...\|..............T....................X......( .......,...1..............8......`a......`....%......./..HS..p.......d+.............................T....*......h(...,..p...D........3......XN..........4<..........................t.......\|...........0...(.......,.......

C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_ede00b448bfe8099\netxex64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5b28 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	39292
Entropy (8bit):	4.034342986306524
Encrypted:	false
SSDEEP:	768:uy6LHF+ax0P4vfY1d98EeDu1heYZnmNEGlhdk39uHN2tS:utLQax0P0g1fZ1heYZnmNEyPI/8
MD5:	A2843A912B664B8A699354BDA1142600
SHA1:	53D6076887EDDC1482138D4709A02D24376C9F64
SHA-256:	EE1EAD30E5C7AFEF019ADF970AB584B30530AECE7B568C3D6FA6CFE6584DFFF9
SHA-512:	E367AAD26EDD12F1D57471C1A5BD65A6BCFEB6370FD81B4DB6B883EB45B0AF565E931B5647EB68A4646B9A3B1BF010D695AB1174754674ED1991F2AF55DCF749
Malicious:	false
Preview:	........h...........([..,.......R...........Z...... \.......^.......n..\.......h...............x.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........J.......T...............)...4..........T.......`H......(I...........:...>...2...........,..l/...<...(...........D...............;...Y.......?...V.......O......<P.......*..@...XU...V...........@...D..pA...C..TT...?..(U...W...........P.......P......86...B.......7...7..........h>...>..................l....................................N..........tB...............(.......Y...............E...............@...K..DL......PV...?......................D...................4O......P........A......\B...................E......................0+......(...........0>..........................lM..\V..0...............t...................PW..(M......xN..p ......$T..HM..................(............... S..........xV.......E.......................U...W..................4@..x.......DN...M..................xS...............Z...Y......\................N...........3..

C:\Windows\System32\DriverStore\FileRepository\pangpd.inf_amd64_395e590fee2fe205\pangpd.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1940 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	10380
Entropy (8bit):	3.496281262896112
Encrypted:	false
SSDEEP:	192:G5btP7XYg6aNr+g263+sUs64lLZW12Sc+gDIGdxcA:GXpN0a+Ns7pZW12SAxdxcA
MD5:	97EE0160E40ECDA26245F23586466FE3
SHA1:	8B315FC4B058B9F10A4043518FA1006AB51D9521
SHA-256:	C2E90872D9B0111A1EA58693E72F72527C9324FF93A675D00C9A1612ECC75C29
SHA-512:	DF98FFF918DC8DAB13A1A6B658E1C5CC87109B7468BB2C60F07578B72EEE7AE05269AE353F2FD43B69F72E814B42B1014CB9CE17C8E77B956BDC0F7001E172E5
Malicious:	false
Preview:	....................@....pw.............................@...H...<............$..h................(......C.:.\.W.i.n.d.o.w.s.....@...................................................................................................X...........................,.......................................................................H...............................................................................................................................................................................................................................4...........l...............................................................................................................................................................................................,...........................................h.......................................................................................\.......p...................$...p...\|...............h...@.......................................................

C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_81bff1eb756435c6\rndiscmp.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x11e0 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	6268
Entropy (8bit):	3.2194925043744105
Encrypted:	false
SSDEEP:	96:Dc+jHWWT1PR6HkglAwzpQ5mdwqV94JmKeO4QXE:RVP6EQ65wwq34cyZU
MD5:	30A634E83B1BCFAE54B90E3F2943F989
SHA1:	90759CAC85B50851824D6B7B04078AD6927AFBBC
SHA-256:	E8434E917BCBB342A19E16F064E4374D203DDF350DAE33596AC89F0E31816F72
SHA-512:	9AAA83D74744670BAB782BCC0742B780B7D6D4D41B797DC0BD0727E98FE1992011071749D72FC0CF4FE6E4843EFA804E21B8CDC9FE1756ED47B3C88C10D98BBB
Malicious:	false
Preview:	.........................-......#..........L...................t...............h...............x.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............................................................................4...............................................................................$...............L....................... .......(...................................................................................................................................................................\|...........x...............................................x...........................................................................................`...................................................................................`...............................................................................................................................................................................................................................................................

C:\Windows\System32\DriverStore\FileRepository\rt640x64.inf_amd64_8984d8483eef476c\rt640x64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x13948 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	159188
Entropy (8bit):	4.283248100435375
Encrypted:	false
SSDEEP:	3072:EFyWOAFlgbfZJnTCesun7ICkMKTyS6UfRGUslw0Rv:QMWAw0Rv
MD5:	BD2B0F7618E267CEBDC79A5EE9FD95AD
SHA1:	E9633C40890542AC4FEF47D0E3041A6E1BEA1A91
SHA-256:	CA55C871FC8730510CF5C7AECC4A76B977011588DBB4C65CC53DE91D06055A91
SHA-512:	8FDD68988545A2AF5659DDF307C974111BE9D7E4DF41F4AE963E887172840BB1D28D382D3FCA5CE05ABE3891FCAC761B6244E1D5E091508A3CEEA7CCD7CCA958
Malicious:	false
Preview:	....................H9........4Ne..........8......@:..p....G...P..P....j......h................m......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S.......0h......$...P.......H#...7...?..................$...0...'.......................$......8...........@7..........\...@.......P...................,5...%..........).......5......\|....5.......F......t...0....,......x.......,............1..$...`!...r...e..\|.......\|... 6.................P..........D...t.......P"..D..........HK...........)..l...........x6..(...d...H<.. ...,8...E...f......Pf...f...............................h%.../...t.......)...(......L\|...\|......$...X...\|...d.......t..................L...(....8..............................................8c..4...\.......................H.......X...L...$...$A..<B.......A..........p...@...\|... ...............(...H............%..$D..........l...................lD.......?..........p3...:.......5......`...P.......................@!........... ..X........8...7...........&..8d.....................

C:\Windows\System32\DriverStore\FileRepository\rtux64w10.inf_amd64_d6132e4c7fe2fac6\rtux64w10.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x8f48 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	71204
Entropy (8bit):	4.032662731113243
Encrypted:	false
SSDEEP:	1536:s+sd5WJkdjln0Pc3nJ8bmtS9wL8ubNspUQfeYe5p+hhv6D2dApYewuHa+HlCMTUL:5sd5WJkdjln0Pc3nJ8bmtS9wL8ubNsp1
MD5:	02B0E1EB5EA8FB5C43ED5B96439BB10C
SHA1:	459222A367B38FE20A062BA0366D907D4B5971A2
SHA-256:	4F8923E200A1BCF3B02CB225191BC7E065B4A169B64AA7A5347C07384DB8306A
SHA-512:	3D295268A19FC3683CCDD36303A0358677A79995B2FE576129187293DAB8242E507ECB62C60CF9505FCCEF106517B725C355176E1CE6A56F966A51DD7D8C83D5
Malicious:	false
Preview:	....................H.........4Ne.............H...X...........(#.. ...........h............... .......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........K.......................5..l=..........H?......8C..lF..lz.......]...G..........L....S...T...U..`V..P5...b.......................f......0...............}...l...}.......7...............2.......e..l6...f...t..Lr.......e..h....%.......j......\~...m.......m......D...Xh.. p...'.......\|..8u.......k......@`.......n...2...:..........Tr..........,8..t........3..L3...3...3.../......x4...T.........,..........@f...e......H'.......b...............-...............................i......$3..`3...W...3...C..P4...4...4.......(.......!..................l'.......7...................`.......Z...k...............k..........P-......Lf...R..........\........(...i..h+..p...lm...U..X1.......!.. h..\/...........h......d... 2..`o...9.......n...6......T9..............0........e...$...L..."..............P.......$...........$...\|...8.......`0..L,..........(...`....p......

C:\Windows\System32\DriverStore\FileRepository\rtwlanu_oldic.inf_amd64_1a82423cc076e882\rtwlanu_oldic.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x131c8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	134220
Entropy (8bit):	4.270467673032472
Encrypted:	false
SSDEEP:	1536:V3XTOF5IUC0/32rdkAGCa5e0DkYqMa296XR:Vz9xVrdkAGzwmi2W
MD5:	01B4D5156AA7CDBB6C8D8120C857DE53
SHA1:	2C755106C0BBF15D7BA77B121BFE071DFB8F84E1
SHA-256:	ADF86360376AB130F5B295A392D58CF75941D42C2151FC09FB5351AA96338374
SHA-512:	70241893CC15D01D8BBB8D018284C70270BF3842AADB50F3F383D53E20BE3009239F9254F580E2AFF4447C39DECF577033EC70F605444BEEF4E27163157E2883
Malicious:	false
Preview:	.....................1...#b....:.}.........81..j....2..H....;...:...u..DK......h...............H.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...............4k.......K..L.......4a..h...(.......................d....'..4....2...........@...$..........p.......................0h...........................%..l...........................................T... ...\...T...H... ................W...........c..,)...\..h.......8N..p...(...<....s..............................$ ...............U..,......................<.......X....0..................................-..,8......."......0L..45.........H...x...."...+..........\,.......&..('..Xr.......'..p............J..........h`...........?..............L...4v......H............B..(@.......)...........,...*...$......d............... ........]...........!...............j..............`...8...........\|...Hn..\:...i......D...............lW...X.......Z...\...............J.......g..H...p...@...<................0..dx...0...0..`...X2......................h.......

C:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_9957a38c3d2283ed\usbncm.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x1a00 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	9172
Entropy (8bit):	3.5340238666678334
Encrypted:	false
SSDEEP:	96:Zi+K8bG/zWQEvI//nBBPtkq37TV68uQJ1WGNZUt0RKD6bgd7Ia9UyYc0EN+:orqQl/KOTsnGN9Fa9UcXU
MD5:	706B9420C920FCC4A1359643F51A2C79
SHA1:	DDECB9B743E37B01D43E9A0B2FF711CAC6EB3A6A
SHA-256:	DA940FD1F1C5FB5D8BFFCED6A4BA30447B1BFE04EC706342C3881BAFB0CC03BB
SHA-512:	DC078255B0968053F65FAE9477322D05AB936286E806C56C890A55320828742C09555B5113A440E9E77A6FF93AECF6CA0735ABFA2148AFEA97C835509429E30E
Malicious:	false
Preview:	................&........#b........................(.......@...@...........(!..h................#......C.:.\.W.i.n.d.o.w.s.............................4...\|...4...........................................................................(.......................................@...............................p...........d.......................$....................................................................................... .......p...............................................................................................................................................................<...........................................................................................................................................................P.......................<.......................................................................................................................................p...................................................................................

C:\Windows\System32\DriverStore\FileRepository\usbnet.inf_amd64_9e6bb7a4b7338267\usbnet.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x2fa8 "Signature", at 0x68 WinDirPath, LanguageID 809
Category:	dropped
Size (bytes):	18604
Entropy (8bit):	3.7780244104014056
Encrypted:	false
SSDEEP:	384:loTx2ISF73gr0VZim4MJYk1pZUI6FOsAHK:loTx2lUsJVJs1
MD5:	4F82E1EFF7A7310E39AF9C5B4B1CE5DD
SHA1:	35721A42C40ED8BAC6B15DA156986D8917CF4100
SHA-256:	93688A8BFA5C5CFD46BAA8E006C8FB892965F4D33347CB371D6CAC885B2B88E4
SHA-512:	E6217C0B9479472272C5B66FC2BB980B0858053D3C28B1AF776042B39843AB70957B9EE0EE125662F7B7C8C7993B0F7B73ADCE7A6174EBC7A27D886A248A13C0
Malicious:	false
Preview:	................"..../...+................$/.......0..@....2.......8..P...X@..h................H......C.:.\.W.i.n.d.o.w.s.....x..........t ..............p....................................................................................#............... ...........&..\..........................t........-..$........(..."..$ ...$..........................0...X....!........... ..................................................`................)..............................0...x.......d......../.......................#......@&..d...P)......................................................\...<#.......%...&..........................@..................x&..........0...................................................$'..t#...................'...(..........................$..D%...............................................,..................h'..............(+......L...............................................0*..........................L...............0&..............................

C:\Windows\System32\DriverStore\FileRepository\wceisvista.inf_amd64_07ad61d07466a58a\wceisvista.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0xf00 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	4932
Entropy (8bit):	3.0090752989182277
Encrypted:	false
SSDEEP:	48:9F537BvhkGEcr08QKgvr5DICLHldyDAPVjR3WGxfs7+WFjTDVRc:9F53N6GEcY3KwDFdyDAPVj9vIj9Rc
MD5:	6F189CFBF43E4DCA781976CF114B33EA
SHA1:	958C6B28A605D2FF1DBE9D3F323B024C4A46ECB0
SHA-256:	E62D12C479F0BAD351CD42D99510273D4DF95140A19AC2CCE31205C9E9A0B1BB
SHA-512:	65AABBA9FC2E76373CA4FEF4AFF5E92FABE1418F543E824A45F6F1A509EDE70F3446F6924630FD2270E1DA35F16249CA7115303367B25DD6875BB765B6CBEEF3
Malicious:	false
Preview:	.........................-......#..........p.......................p.......X...h...............@.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S...........................................................................................................X...............................................................................................................................................................................,...........................h...........................................................(...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................(.......................

C:\Windows\System32\DriverStore\FileRepository\wnetvsc.inf_amd64_268e58b44338d192\wnetvsc.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x5c08 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	42796
Entropy (8bit):	3.99187036629011
Encrypted:	false
SSDEEP:	768:eXrerzOr6841/mHD14bqviz0/nwx9FlzpBimDNmctnekDhWtKBhjp8YEDc:eyrzOr6841/mHD14bqviy+9FlzpBimDx
MD5:	3E47BCE5711A58744831D11179C287F7
SHA1:	1306F94D7BAA8D8EEDAA6AD8BE479ECEDF9C41BB
SHA-256:	E7E9379F834EE8E8E40AEFE85A075D9A14889BA80CB45FEE1817BAF5306899D0
SHA-512:	F3E7EB0B5282F44A9A8A399190BF70A37945AC433298023719AAE23805724AD92824A9BAEEB24B2C888496A1E00982C9695045B62B48AE0987765B4FE9A3F6D7
Malicious:	false
Preview:	.....................\...$../.......0.......t[..&....].......`.......r..........h...............(.......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........#.......C...9...........!...%..xQ.......+.......6..........8....N.......................C..........l!..........................81.......5...............#..dS...................Z..\Q......,R..,0..."...=..p7..tV...:.../.......4.......F.......4...E.......9...........E..@:......P.......TG......P;..................................D....... T..............4 ...;... ...G.......#...S...*..\|Z...C..............\|B.......3...3...F..$/.......&...............5......X............-...9.......0..4P..........4............................'......$S...............3...5..H...........................................T1......\....4..t5.......F...Y..................\|H..X3...4...............O...................+..................46..........."..,Y......x...$7.................../..............................8....A...[...........#..x#...N..T........(.......C..LB...A..P-..

C:\Windows\System32\DriverStore\FileRepository\ykinx64.inf_amd64_0bbd8466b526ef26\ykinx64.PNF

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	Windows Precompiled iNF, version 3.3 (Windows 10), flags 0x1000083, unicoded, has strings, at 0x47d8 "Signature", at 0x68 WinDirPath, LanguageID 809, at 0x80 language en-US
Category:	dropped
Size (bytes):	30020
Entropy (8bit):	4.0027001079416475
Encrypted:	false
SSDEEP:	768:HWHNVAYaNc7keBsIWmCh5ZISJQ2zPs5d06VaJF9v9o:HWHNVAYaNc7keBsIWmCh5ZISJQ2zPs5l
MD5:	6BB512A217C91B75CD363CDC3D0F7AC0
SHA1:	0655A5195C943DFC46D4D80D13F4B6DEFD5C0723
SHA-256:	B05E09C09A3663B3E92F9F305DE1C46BFB2AE3976161416A8FD340F4731DF4E7
SHA-512:	0C3D1BA6F620E1DD0F3201E10405C103ADDE8F2B1142A97200184A50497F0D76AF42E3A536BF55FD063B437BF470E4E61F9B17F0E5D9CA2657BE35B93F032929
Malicious:	false
Preview:	.....................G.....................DG.......H..X...(K..X....V..`....e..h...............@u......C.:.\.W.i.n.d.o.w.s.....e.n.-.U.S........7...$......p&...&...'..P........%.......%.................. -..........<-.................. A.................. ...............l1..0...........DD..."...#..@$...>......,...@...x=..4!......L)..hF..d4.. &...+..8A.../..T0...E..........x>.......?..P.......\|A...............6......p/......4=..............l........................................................................F...................G..$G.......0...)......,...6...-..P4..4....1..............................p7..`6..................................T.......`"...(..$............... F.......................;..............................................................<B......p...........F.......................................................D...................................B.......(...D......@0..........................d;...............=......@F...E......................,7..............

C:\Windows\System32\DriverStore\Temp\{bde618de-3b74-034f-b443-966861a24834}\SET6DF9.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	78712
Entropy (8bit):	6.731129659479318
Encrypted:	false
SSDEEP:	1536:aaqBCIdZxkzMsEG66LS5+e8ouaA6e9C/TpGTAIJaw4A7eJ6FPx8xKUxzeO6:afBCWZxkzMsEG61+Z2A6e9C9GsIJawzh
MD5:	6CA91596CFAE2079BA66BFBB099F41E6
SHA1:	12729569CA22D782630E988C56A6472D8CFB96AA
SHA-256:	9CC08F70555E3958E1676FBA56B12D482EF961F8FDBBA9E69DB7A44F3B007A02
SHA-512:	F06F785AA445C1F77D6B3553D3DB99C1373F99FF55505BEA71763F15B62334EBE1DD77550110179942FBB44B85EE7330EE59F888E409C8600F6DF7A7611B8ACE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.u.)...)...)... ...*... ...+...)...{...L...,...L...,...L...-......-......(......(...Rich)...................PE..d....<.d.........."............................@.............................@......;v....`A................................................t...P.... ..`.......4.......xQ...0..$......8............................................................................text...o}.......~.................. ..h.rdata..............................@..H.data...............................@....pdata..4...........................@..HPAGE.....0.......2.................. ..`INIT................................ ..b.rsrc...`.... ......................@..B.reloc..$....0......................@..B................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{bde618de-3b74-034f-b443-966861a24834}\SET6E48.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	11096
Entropy (8bit):	7.297347328750378
Encrypted:	false
SSDEEP:	192:ewinWnVyXJCCramyKQFWQFgjI+yGI+X01k9z3AGRkt6yXX:hY18FRcNrR9zXRc6yn
MD5:	6F4E74E781E6BCF142DD838CFEBB41C7
SHA1:	F4943F6168827C6E6E5CB4F9E7D34B35398D66C9
SHA-256:	F6F9275BE2DA16360F7498DD1B4631F9B19FFF816D8A025B0146C20572B1A1EA
SHA-512:	6FE8ED0041CB9E9F0ED350DF512738164B1F26A475A50DB2F9691E7855D6E5AE1DE590CAB13E190EBD66765A722B39153C90E913CFA00835C0FC3CCE347BAA85
Malicious:	false
Preview:	0.+T...H........+E0.+A...1.0...`.H.e......0.....+.....7......0...0...+.....7........Y...J..........230303031743Z0...+.....7.....0..G0... .O8Y...\|dO...Nz.\|.\....Y.)..HB1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...10(...F.i.l.e........p.a.n.g.p.d...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .O8Y...\|dO...Nz.\|.\....Y.)..HB0....&.....c...-.SO.H.hCG1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...10(...F.i.l.e........p.a.n.g.p.d...s.y.s...0.....M....k=....So.Sm;-1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...10(...F.i.l.e........p.a.n.g.p.d...i.n.f...0.... .}.K.~..I..H.f.4...<TN%.H..._..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...1*0(...F.i.l.e........p.a.n.g.p.d...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .}.K.~..I..H.f.4...<TN%.H..._.....g0..c0J..+.....7....<0:.&

C:\Windows\System32\DriverStore\Temp\{bde618de-3b74-034f-b443-966861a24834}\SET6E68.tmp

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	4333
Entropy (8bit):	4.760587896237931
Encrypted:	false
SSDEEP:	96:I23N5XHo7pnFhdhEykjSY/BR9Ch60jelHWVx2IscstJqM1pMJM1McMrMZM9iDCZ/:pnX0hFhdxwIh60jel2Vx2TcGJqeEO9qR
MD5:	FC97A101113D88276C58400BBA7AAF77
SHA1:	814D0C9FBDEE6B3DABA6D18389536FDE536D3B2D
SHA-256:	20B44F3859A6FF1B7C644FC90CED4E7AB37CCF5CB50EC21D59A92906932A4842
SHA-512:	616AC0EB0BF54E4EFB94B9CF1A301E8AD08F13D7477256552BE616D450DB84614A3A7E5376EC7D3FC11E893C38CF578EB826FBF156B17B2CF48E5004470E5BDA
Malicious:	false
Preview:	;-------------------------------------------------------------------------------..; PANGPD.INF..;..; Palo Alto Networks GlobalProtect Virtual Ethernet Adapter..;..; Copyright (c) Palo Alto Networks. All rights reserved.....[version]..Signature = "$Windows NT$"..CatalogFile.ntx86 = pangpd.cat..CatalogFile.ntamd64 = pangpd64.cat..CatalogFile.ntarm64 = pangpdarm64.cat..Class = Net..ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}..Provider = %PAN%..DriverVer = 03/02/2023,16.15.20.869....;-------------..;For NDIS 6.x..;-------------..[ControlFlags]..ExcludeFromSelect=....[Manufacturer]..%PAN% = PAN,ntx86,ntamd64,ntarm64....[PAN.ntx86]..%PanGpd.DeviceDesc% = PanGpd.ndi, PanGpd ..[PAN.ntamd64]..%PanGpd.DeviceDesc% = PanGpd.ndi, PanGpd ..[PAN.ntarm64]..%PanGpd.DeviceDesc% = PanGpd.ndi, PanGpd....[PanGpd.ndi]..Characteristics = 0x81 ; NCF_VIRTUAL \| NCF_HAS_UI..;For NDIS 6.x..IfType = 0x6 ; IF_TYPE_ETHERNET_CSMACD..*MediaTy

C:\Windows\System32\DriverStore\Temp\{bde618de-3b74-034f-b443-966861a24834}\pangpd.inf (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	4333
Entropy (8bit):	4.760587896237931
Encrypted:	false
SSDEEP:	96:I23N5XHo7pnFhdhEykjSY/BR9Ch60jelHWVx2IscstJqM1pMJM1McMrMZM9iDCZ/:pnX0hFhdxwIh60jel2Vx2TcGJqeEO9qR
MD5:	FC97A101113D88276C58400BBA7AAF77
SHA1:	814D0C9FBDEE6B3DABA6D18389536FDE536D3B2D
SHA-256:	20B44F3859A6FF1B7C644FC90CED4E7AB37CCF5CB50EC21D59A92906932A4842
SHA-512:	616AC0EB0BF54E4EFB94B9CF1A301E8AD08F13D7477256552BE616D450DB84614A3A7E5376EC7D3FC11E893C38CF578EB826FBF156B17B2CF48E5004470E5BDA
Malicious:	false
Preview:	;-------------------------------------------------------------------------------..; PANGPD.INF..;..; Palo Alto Networks GlobalProtect Virtual Ethernet Adapter..;..; Copyright (c) Palo Alto Networks. All rights reserved.....[version]..Signature = "$Windows NT$"..CatalogFile.ntx86 = pangpd.cat..CatalogFile.ntamd64 = pangpd64.cat..CatalogFile.ntarm64 = pangpdarm64.cat..Class = Net..ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}..Provider = %PAN%..DriverVer = 03/02/2023,16.15.20.869....;-------------..;For NDIS 6.x..;-------------..[ControlFlags]..ExcludeFromSelect=....[Manufacturer]..%PAN% = PAN,ntx86,ntamd64,ntarm64....[PAN.ntx86]..%PanGpd.DeviceDesc% = PanGpd.ndi, PanGpd ..[PAN.ntamd64]..%PanGpd.DeviceDesc% = PanGpd.ndi, PanGpd ..[PAN.ntarm64]..%PanGpd.DeviceDesc% = PanGpd.ndi, PanGpd....[PanGpd.ndi]..Characteristics = 0x81 ; NCF_VIRTUAL \| NCF_HAS_UI..;For NDIS 6.x..IfType = 0x6 ; IF_TYPE_ETHERNET_CSMACD..*MediaTy

C:\Windows\System32\DriverStore\Temp\{bde618de-3b74-034f-b443-966861a24834}\pangpd.sys (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	78712
Entropy (8bit):	6.731129659479318
Encrypted:	false
SSDEEP:	1536:aaqBCIdZxkzMsEG66LS5+e8ouaA6e9C/TpGTAIJaw4A7eJ6FPx8xKUxzeO6:afBCWZxkzMsEG61+Z2A6e9C9GsIJawzh
MD5:	6CA91596CFAE2079BA66BFBB099F41E6
SHA1:	12729569CA22D782630E988C56A6472D8CFB96AA
SHA-256:	9CC08F70555E3958E1676FBA56B12D482EF961F8FDBBA9E69DB7A44F3B007A02
SHA-512:	F06F785AA445C1F77D6B3553D3DB99C1373F99FF55505BEA71763F15B62334EBE1DD77550110179942FBB44B85EE7330EE59F888E409C8600F6DF7A7611B8ACE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.u.)...)...)... ...*... ...+...)...{...L...,...L...,...L...-......-......(......(...Rich)...................PE..d....<.d.........."............................@.............................@......;v....`A................................................t...P.... ..`.......4.......xQ...0..$......8............................................................................text...o}.......~.................. ..h.rdata..............................@..H.data...............................@....pdata..4...........................@..HPAGE.....0.......2.................. ..`INIT................................ ..b.rsrc...`.... ......................@..B.reloc..$....0......................@..B................................................................................................................................................................................

C:\Windows\System32\DriverStore\Temp\{bde618de-3b74-034f-b443-966861a24834}\pangpd64.cat (copy)

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	data
Category:	dropped
Size (bytes):	11096
Entropy (8bit):	7.297347328750378
Encrypted:	false
SSDEEP:	192:ewinWnVyXJCCramyKQFWQFgjI+yGI+X01k9z3AGRkt6yXX:hY18FRcNrR9zXRc6yn
MD5:	6F4E74E781E6BCF142DD838CFEBB41C7
SHA1:	F4943F6168827C6E6E5CB4F9E7D34B35398D66C9
SHA-256:	F6F9275BE2DA16360F7498DD1B4631F9B19FFF816D8A025B0146C20572B1A1EA
SHA-512:	6FE8ED0041CB9E9F0ED350DF512738164B1F26A475A50DB2F9691E7855D6E5AE1DE590CAB13E190EBD66765A722B39153C90E913CFA00835C0FC3CCE347BAA85
Malicious:	false
Preview:	0.+T...H........+E0.+A...1.0...`.H.e......0.....+.....7......0...0...+.....7........Y...J..........230303031743Z0...+.....7.....0..G0... .O8Y...\|dO...Nz.\|.\....Y.)..HB1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...10(...F.i.l.e........p.a.n.g.p.d...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .O8Y...\|dO...Nz.\|.\....Y.)..HB0....&.....c...-.SO.H.hCG1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...10(...F.i.l.e........p.a.n.g.p.d...s.y.s...0.....M....k=....So.Sm;-1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...10(...F.i.l.e........p.a.n.g.p.d...i.n.f...0.... .}.K.~..I..H.f.4...<TN%.H..._..1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...08..+.....7...1*0(...F.i.l.e........p.a.n.g.p.d...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... .}.K.~..I..H.f.4...<TN%.H..._.....g0..c0J..+.....7....<0:.&

C:\Windows\System32\PanCredProv.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67872
Entropy (8bit):	6.127107568597681
Encrypted:	false
SSDEEP:	1536:iVZZbf/F2lfQqrZuPVZtjxfVL97gOspnR70Wx5:uZbHF2Ngbtjx9DenRoi
MD5:	2F54AB56578EB5DB2C0983B9BC8CF551
SHA1:	64920DB9524D80A54D3704D4CB28D56E701FBB3F
SHA-256:	444DB74438AC9E3EC34B5A86220CA10477C508CD7942A2D2BD6C390953F408E6
SHA-512:	4F7DA70C1CF13BCA64B639F564158C2D2617A5E376E237605CD1272A47A7A6367AB0449773635CE64F0D2A53A1E1A80CC27ACC56BC5484C1490DDCED8B1E37FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........o..@<..@<..@<...<..@<..A=..@<..E=..@<..D=..@<..C=..@<..D=..@<..A=..@<..A<..@<6.E=..@<6.@=..@<6..<..@<...<..@<6.B=..@<Rich..@<........................PE..d......f.........." .....n...z.......p....................................... .......q....`A................................................8...........@............... )..........0...T...............................................x............................text...Fl.......n.................. ..`.rdata..zT.......V...r..............@..@.data...P...........................@....pdata..............................@..@.rsrc...@...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Windows\System32\PanPlapApp.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6576928
Entropy (8bit):	6.8550446591931715
Encrypted:	false
SSDEEP:	98304:K+0BFp4dbVDdysW6ySCbt6QhM2YWn0gcFLOAkGkzdnEVomFHKnPB:KJpkVQvZt6QhfYW4FLOyomFHKnPB
MD5:	19C40266DA093A844F705ADFB1A3714F
SHA1:	62127320BB7434CB0676C83D9CD2A03DE0FF13A7
SHA-256:	CE91CFFEA5A1C7AF2185AB5767EBBC42A7E26044AC5A7632727DEDE239899AFA
SHA-512:	3431E048294706805A9C3A80A720903014B11BB2B0B81B2A00C20793A708C7BA05D7ABB3914636870A915CC37C2945DFFA02575CA60E5D15464ABE8103C84AA5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p[.T.5.T.5.T.5.1w6.@.5.1w1.~.5.1w0..5.1w3.W.5..y1.w.5..y6.^.5..y0...5.T.5.I.5..x1.R.5.1w4.o.5.T.4...5..x<.a.5..x..U.5.T...U.5..x7.U.5.RichT.5.........PE..d...`..f..........".......6..$........2........@............................. e.....A.d...`..................................................?J......PN..w....L..K...2d. )....c.PO....E.p...................0.E.(...0.E...............6.x............................text...`.6.......6................. ..`.rdata..D.....6.......6.............@..@.data....`....J......zJ.............@....pdata...K....L..L....K.............@..@.rsrc....w...PN..x...jM.............@..@.reloc..PO....c..P....b.............@..B........................................................................................................................................................................................................................

C:\Windows\System32\PanPlapProvider.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8626464
Entropy (8bit):	6.40633483898784
Encrypted:	false
SSDEEP:	98304:m+IRx/ENoGDITKb6MTNvMsXgBoHg6slJPlRjz3+SF:mV/ENo2TfpvMs8o9sPPl53+SF
MD5:	3BC7B4D80073FA4151A7588EED0323C7
SHA1:	8BB08CEE1E07963C463A2D4FE56508A9A585F93E
SHA-256:	2430132E3FE9236138FF92A2576CF68CBE1C88B4B48042A40C446F34594A0A12
SHA-512:	8C33E562EE33DFAC1760E6D53FFFCA50882A7DB6E93A4C58FB492520961250FF0BC3E9D72B430723EE38E5DCDA1BCD36FAD7A0B95A70E203CC2C5BDD06E18D39
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......zt..>..Y>..Y>..Y[s.X*..Y[s.X...Y[s.X...Y[s.X=..Yl}.X...Yl}.X4..Yl}.XI..Y[s.X...Y>..Y...Y>..Y#..Y.\|.X8..Y.\|.X...Y.\|.X?..Y.\|.Y?..Y>.`Y?..Y.\|.X?..YRich>..Y................PE..d......f.........." .....XV...m..... ]L............................................._'....`A.........................................{t.t...D\|t.l...................x.. )......X.....l.T...................@.l.(...@.l..............pV. ............................text....VV......XV................. ..`.rdata...o...pV..p...\V.............@..@.data...\|.A...t..$....t.............@....pdata...............u.............@..@.rsrc.................z.............@..@.reloc..X..........................@..B........................................................................................................................................................................................................

C:\Windows\System32\PanV2CredProv.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2786080
Entropy (8bit):	6.2590160733420594
Encrypted:	false
SSDEEP:	49152:bXMhqUp030Yr2gea/ZBnXWSKqzJ/x+MmaGJJPvc:ItVwxWSNF/9mRJJnc
MD5:	5AEFA5E1319125EF192224F380154474
SHA1:	67D1DD502C5CABBF0A8E864570CC52E87E4B8A0C
SHA-256:	97D138C2013A10D9652D85E80D56846457CD74C4D4AF6EF1D98EE3FB33692B6A
SHA-512:	342E8239DC859B63EB80026580913BA00A02E82D46082250E069805DFC0BC786AE811B9640BA5061C6D212A953D2474E2BA9CF522B88A80524243AF905C8AD07
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..............@...@...@...A.@...A...@...A.@...A...@..A.@..A.@..A...@E.A.@...A..@...@...@E.A...@E.A.@E.W@.@..?@.@E.A.@Rich...@................PE..d......f.........." .....&...........H....................................... +.....$....`A........................................0P'......P'.........%....(..S...Z. )...0. ... .$.T.....................$.(.....$..............@...............................text...\|$.......&.................. ..`.rdata..dU...@...V.................@..@.data...D.....'..x....'.............@....pdata...S....(..T....'.............@..@.rsrc....%......&...L).............@..@.reloc.. ....0*......r).............@..B................................................................................................................................................................................................................

C:\Windows\System32\catroot2\dberr.txt

Download File

Process:	C:\Windows\System32\drvinst.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	3474
Entropy (8bit):	5.366944509653966
Encrypted:	false
SSDEEP:	96:QO00eO00erMwUgWUg0B1kE3ZhpJp8ZpkRepk3YpgpNU:QO00eO00erMwmkB1kAq
MD5:	8ACBFD5F49464C88861E69803B969CD9
SHA1:	327354B5979DF6308FFC169E83AAFF5DC11D89C3
SHA-256:	F25CFE4E480EDEDBB936D1A6B57FAC6B9276D5F0765F8A98599405D9A766EDC6
SHA-512:	DAD223DA09A2E60E07E0445031085B9F4ECD462357B7B4F1D6423FFFA19DE663BED1F1AF0593EE7F93CB49D7C9134745BE11DBBDC93E0E92D77F25EE738C97D2
Malicious:	false
Preview:	CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2083 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2459 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: SyncAllDBs Corruption or Schema Change..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #891 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #1307 encountered JET error -1601..CatalogDB: 08:57:12 03/10/2023: SyncDB:: Sync sta

C:\Windows\System32\drivers\SET80A6.tmp

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	78712
Entropy (8bit):	6.731129659479318
Encrypted:	false
SSDEEP:	1536:aaqBCIdZxkzMsEG66LS5+e8ouaA6e9C/TpGTAIJaw4A7eJ6FPx8xKUxzeO6:afBCWZxkzMsEG61+Z2A6e9C9GsIJawzh
MD5:	6CA91596CFAE2079BA66BFBB099F41E6
SHA1:	12729569CA22D782630E988C56A6472D8CFB96AA
SHA-256:	9CC08F70555E3958E1676FBA56B12D482EF961F8FDBBA9E69DB7A44F3B007A02
SHA-512:	F06F785AA445C1F77D6B3553D3DB99C1373F99FF55505BEA71763F15B62334EBE1DD77550110179942FBB44B85EE7330EE59F888E409C8600F6DF7A7611B8ACE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.u.)...)...)... ...*... ...+...)...{...L...,...L...,...L...-......-......(......(...Rich)...................PE..d....<.d.........."............................@.............................@......;v....`A................................................t...P.... ..`.......4.......xQ...0..$......8............................................................................text...o}.......~.................. ..h.rdata..............................@..H.data...............................@....pdata..4...........................@..HPAGE.....0.......2.................. ..`INIT................................ ..b.rsrc...`.... ......................@..B.reloc..$....0......................@..B................................................................................................................................................................................

C:\Windows\System32\drivers\SET8C10.tmp

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	136208
Entropy (8bit):	6.7163880773155205
Encrypted:	false
SSDEEP:	3072:D9/cqmeDhWZWaHW1i9O5LY2GEyZAzTcfx8+:D9/XD4ZTW1i059yyzgl
MD5:	D9B1F383AD60E687B7A8347241683C50
SHA1:	293FE84008105EFF5AB9ED1D0338EEA32138A3D5
SHA-256:	8E438A6E3C6FFE966644E02691CF15D1FAABC522AEF8BA1D6E969A4FB0B650EA
SHA-512:	DBF7EABAF8054028885D183CCA190E00371D7320A2ED01438B2A46AC55A8C09685B524F47C7E057F90EF945AC946FC841DDC3D802DABD7941BB2EBBBAE59B874
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U...4...4...4..._...4..._...4..=C@..4..._...4...4...4..._...4..._...4...@...4...@...4...@...4..Rich.4..........................PE..d.....e.........."..........@......@..........@............................. ......0G.....A................................................0...d...............`........T......,.......8........................... ...................h............................text....\|.......~.................. ..h.rdata..T...........................@..H.data...............................@....pdata..`...........................@..HPAGE................................ ..`INIT................................ ..b.rsrc...............................@..B.reloc..,...........................@..B................................................................................................................................................................

C:\Windows\Temp\~DF0981B5E01843200F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.21908930559937237
Encrypted:	false
SSDEEP:	96:9x6yawbYwX70yWC56SEC5wlawCYwX70yWC56SEC5wpR:9YyvbFX70mOlvCFX70mOf
MD5:	3C4D0950B22D56AE5BBA5C737CB5CCEA
SHA1:	BFA21148E15C6AAEFABCFA9FA4B0EBED79B1DF31
SHA-256:	77A96463DE3776C2C8589A20D05A539C3FD0739048E7DF17C2B5DA0B2045CE9E
SHA-512:	BDDB36000ED9C4DA8617CE72D41B18C234BDB23895FEE5890593F17C0510F15B1B6805746CCD8DF59B4641EACD77618275C5CD556B4E5E2CF5AEDCDA46C80E52
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0F22FB38899BB3B8.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2EC06EA81B9E3334.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.0765741474986683
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOR0f1zgBm/GNDXtyVky6lX:2F0i8n0itFzDHFRaBIPX
MD5:	7804997E52F15578A9BAF5BA5D81A218
SHA1:	FA85116C1FAED0250A96B3F3B802F48B74BA44F5
SHA-256:	0EE3AA3CC6C6D369A31C1C33DFBF2CAA10845B1A8DAF848827C4E3B4AA046D43
SHA-512:	7D3CD052144F96FBB8726309B0163EC616DBC5B0007F10C19D097B57E345EA6732C6E8DE5049B6EFCD55089D579109B20D7D1A2FEB7810FABD44558E0D6BDE9E
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF380A7CB120EF4C7A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5A0A920D2F3BE035.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.3900026596265092
Encrypted:	false
SSDEEP:	96:BEMLTLnPawCYwX70yWC56SEC5wtawbYwX70yWC56SEC5wUcx:uMLnPvCFX70mOtvbFX70mOUc
MD5:	2676F06467A49AB96B2369C9CC64DC46
SHA1:	741626920BBCF225AA7714171BF938031A273294
SHA-256:	D0F56ABFE4E955CD0AC09941C2403D70160D9612EA11807BD1F6F59772DC030D
SHA-512:	706D6D2F48A0CFECE5DA68BFED38034405A7EE73E435A92B3274A5E1600ADC5E6C9B2607D45BE7956CF3EA962219DEACD60B8BD47E951C897FE49AF5777C9D04
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF79BBCA1BF33F4953.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF79EABA0770A75668.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAFC09F7479ED9054.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB53D8F4708B8E4A1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.7518825966616176
Encrypted:	false
SSDEEP:	96:5hs1/nTPnPawCYwX70yWC56SEC5wtawbYwX70yWC56SEC5wUcx:g1fLPvCFX70mOtvbFX70mOUc
MD5:	9957C355E6CE6DE7530AEB38AF187848
SHA1:	CA7270B555B270C001C174DE71A2134055ED7D71
SHA-256:	2E5EC0A392A8F42808CF22952EB13BBDD43D99D641D3D6156DD18CCEA60DED7D
SHA-512:	3B4943AACEE4CA25E4EB14B1B90EA7862B2560101DF48B62340C9AB6E7A882F0928826AA7E33EB0C7BF24EB656647AB4831B379741C14B51518C72E0C773AB83
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD5389E53CA5B1B3C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.3900026596265092
Encrypted:	false
SSDEEP:	96:BEMLTLnPawCYwX70yWC56SEC5wtawbYwX70yWC56SEC5wUcx:uMLnPvCFX70mOtvbFX70mOUc
MD5:	2676F06467A49AB96B2369C9CC64DC46
SHA1:	741626920BBCF225AA7714171BF938031A273294
SHA-256:	D0F56ABFE4E955CD0AC09941C2403D70160D9612EA11807BD1F6F59772DC030D
SHA-512:	706D6D2F48A0CFECE5DA68BFED38034405A7EE73E435A92B3274A5E1600ADC5E6C9B2607D45BE7956CF3EA962219DEACD60B8BD47E951C897FE49AF5777C9D04
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE1050C7D393D2678.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.7518825966616176
Encrypted:	false
SSDEEP:	96:5hs1/nTPnPawCYwX70yWC56SEC5wtawbYwX70yWC56SEC5wUcx:g1fLPvCFX70mOtvbFX70mOUc
MD5:	9957C355E6CE6DE7530AEB38AF187848
SHA1:	CA7270B555B270C001C174DE71A2134055ED7D71
SHA-256:	2E5EC0A392A8F42808CF22952EB13BBDD43D99D641D3D6156DD18CCEA60DED7D
SHA-512:	3B4943AACEE4CA25E4EB14B1B90EA7862B2560101DF48B62340C9AB6E7A882F0928826AA7E33EB0C7BF24EB656647AB4831B379741C14B51518C72E0C773AB83
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF240446CD32224F7.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.3900026596265092
Encrypted:	false
SSDEEP:	96:BEMLTLnPawCYwX70yWC56SEC5wtawbYwX70yWC56SEC5wUcx:uMLnPvCFX70mOtvbFX70mOUc
MD5:	2676F06467A49AB96B2369C9CC64DC46
SHA1:	741626920BBCF225AA7714171BF938031A273294
SHA-256:	D0F56ABFE4E955CD0AC09941C2403D70160D9612EA11807BD1F6F59772DC030D
SHA-512:	706D6D2F48A0CFECE5DA68BFED38034405A7EE73E435A92B3274A5E1600ADC5E6C9B2607D45BE7956CF3EA962219DEACD60B8BD47E951C897FE49AF5777C9D04
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\system32\DRIVERS\gpfltdrv.sys (copy)

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	136208
Entropy (8bit):	6.7163880773155205
Encrypted:	false
SSDEEP:	3072:D9/cqmeDhWZWaHW1i9O5LY2GEyZAzTcfx8+:D9/XD4ZTW1i059yyzgl
MD5:	D9B1F383AD60E687B7A8347241683C50
SHA1:	293FE84008105EFF5AB9ED1D0338EEA32138A3D5
SHA-256:	8E438A6E3C6FFE966644E02691CF15D1FAABC522AEF8BA1D6E969A4FB0B650EA
SHA-512:	DBF7EABAF8054028885D183CCA190E00371D7320A2ED01438B2A46AC55A8C09685B524F47C7E057F90EF945AC946FC841DDC3D802DABD7941BB2EBBBAE59B874
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U...4...4...4..._...4..._...4..=C@..4..._...4...4...4..._...4..._...4...@...4...@...4...@...4..Rich.4..........................PE..d.....e.........."..........@......@..........@............................. ......0G.....A................................................0...d...............`........T......,.......8........................... ...................h............................text....\|.......~.................. ..h.rdata..T...........................@..H.data...............................@....pdata..`...........................@..HPAGE................................ ..`INIT................................ ..b.rsrc...............................@..B.reloc..,...........................@..B................................................................................................................................................................

C:\Windows\system32\DRIVERS\pangpd.sys (copy)

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	78712
Entropy (8bit):	6.731129659479318
Encrypted:	false
SSDEEP:	1536:aaqBCIdZxkzMsEG66LS5+e8ouaA6e9C/TpGTAIJaw4A7eJ6FPx8xKUxzeO6:afBCWZxkzMsEG61+Z2A6e9C9GsIJawzh
MD5:	6CA91596CFAE2079BA66BFBB099F41E6
SHA1:	12729569CA22D782630E988C56A6472D8CFB96AA
SHA-256:	9CC08F70555E3958E1676FBA56B12D482EF961F8FDBBA9E69DB7A44F3B007A02
SHA-512:	F06F785AA445C1F77D6B3553D3DB99C1373F99FF55505BEA71763F15B62334EBE1DD77550110179942FBB44B85EE7330EE59F888E409C8600F6DF7A7611B8ACE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.u.)...)...)... ...*... ...+...)...{...L...,...L...,...L...-......-......(......(...Rich)...................PE..d....<.d.........."............................@.............................@......;v....`A................................................t...P.... ..`.......4.......xQ...0..$......8............................................................................text...o}.......~.................. ..h.rdata..............................@..H.data...............................@....pdata..4...........................@..HPAGE.....0.......2.................. ..`INIT................................ ..b.rsrc...`.... ......................@..B.reloc..$....0......................@..B................................................................................................................................................................................

\Device\Mup\user-PC\PIPE\samr

Download File

Process:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
File Type:	GLS_BINARY_LSB_FIRST
Category:	dropped
Size (bytes):	160
Entropy (8bit):	4.438743916256937
Encrypted:	false
SSDEEP:	3:rmHfvtH//STGlA1yqGlYUGk+ldyHGlgZty:rmHcKtGFlqty
MD5:	E467C82627F5E1524FDB4415AF19FC73
SHA1:	B86E3AA40E9FBED0494375A702EABAF1F2E56F8E
SHA-256:	116CD35961A2345CE210751D677600AADA539A66F046811FA70E1093E01F2540
SHA-512:	2A969893CC713D6388FDC768C009055BE1B35301A811A7E313D1AEEC1F75C88CCDDCD8308017A852093B1310811E90B9DA76B6330AACCF5982437D84F553183A
Malicious:	false
Preview:	................................xW4.4.....#Eg.......]..........+.H`........xW4.4.....#Eg......3.qq..7I......6........xW4.4.....#Eg......,..l..@E............

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: x64;1033, Number of Pages: 200, Revision Number: {EE37356D-D07C-43F6-8D20-35139031CF9B}, Title: GlobalProtect64, Author: Palo Alto Networks, Comments: GlobalProtect 64bit, Number of Words: 2, Last Saved Time/Date: Wed Sep 11 00:50:57 2024, Last Printed: Wed Sep 11 00:50:57 2024
Entropy (8bit):	7.995639510217381
TrID:	Generic OLE2 / Multistream Compound File (8008/1) 100.00%
File name:	GlobalProtect64-6.3.1.msi
File size:	66'512'384 bytes
MD5:	ee67a64e6eec29580597358a7860c706
SHA1:	493877cd3362a44d59eda084b444455f755c3d29
SHA256:	eaa5e4fb71791a360bbabdf007f50861213ead504c649c26482d6529d9fb50dc
SHA512:	155b773109ea2a85c1b17287f370a4946a3b22b5e77ade0c2d99189fed2ff4faa573d5c2ca5602f4d6031f491605b0f8b9d3e466eb0e9e1cee10be35b2a0e04d
SSDEEP:	1572864:+7lnBQ8U4BfikZwJgJAxw2TrW3TByP+4nVW9ijr1PBrB0OyQjnDXN:GBQr8ietJKwUWK+xg/1PBSOnvXN
TLSH:	E1E733BF751A1F2BD28AF9F43572170A4FA53E2809ACC0886652FF71B07D560A1B75C2
File Content Preview:	........................>...................................8...................x..............................................................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 15:16:16.394383907 CET	51418	53	192.168.2.5	1.1.1.1
Oct 28, 2024 15:16:16.401232958 CET	53	51418	1.1.1.1	192.168.2.5
Oct 28, 2024 15:16:16.402924061 CET	51418	53	192.168.2.5	1.1.1.1
Oct 28, 2024 15:16:16.409670115 CET	53	51418	1.1.1.1	192.168.2.5
Oct 28, 2024 15:16:17.009251118 CET	51418	53	192.168.2.5	1.1.1.1
Oct 28, 2024 15:16:17.015443087 CET	53	51418	1.1.1.1	192.168.2.5
Oct 28, 2024 15:16:17.015510082 CET	51418	53	192.168.2.5	1.1.1.1
Oct 28, 2024 15:17:41.007802963 CET	51650	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:41.007846117 CET	443	51650	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:41.008030891 CET	51650	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:41.008342981 CET	51650	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:41.008357048 CET	443	51650	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:41.430685043 CET	51651	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:41.430793047 CET	443	51651	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:41.430879116 CET	51651	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:41.443063974 CET	51651	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:41.443101883 CET	443	51651	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:41.676348925 CET	443	51650	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:41.676954031 CET	51650	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:41.676965952 CET	443	51650	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:41.678599119 CET	443	51650	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:41.678675890 CET	51650	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:41.684149981 CET	51650	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:41.684237957 CET	443	51650	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:41.684427023 CET	51650	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:41.728851080 CET	51650	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:41.728879929 CET	443	51650	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:41.775722027 CET	51650	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:41.809545994 CET	51653	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:41.809601068 CET	443	51653	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:41.809758902 CET	51653	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:41.810080051 CET	51653	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:41.810097933 CET	443	51653	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:41.814064980 CET	443	51650	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:41.814131975 CET	443	51650	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:41.814189911 CET	51650	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:41.814476013 CET	51650	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:41.814490080 CET	443	51650	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:41.903033972 CET	51654	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:41.903083086 CET	443	51654	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:41.903161049 CET	51654	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:41.916781902 CET	51654	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:41.916806936 CET	443	51654	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.053482056 CET	443	51651	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.053929090 CET	51651	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.053958893 CET	443	51651	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.057502985 CET	443	51651	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.057580948 CET	51651	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.080413103 CET	51651	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.080632925 CET	443	51651	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.080671072 CET	51651	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.127335072 CET	443	51651	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.135107994 CET	51651	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.135142088 CET	443	51651	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.181979895 CET	51651	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.213485956 CET	443	51651	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.213587046 CET	443	51651	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.213641882 CET	51651	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.214646101 CET	51651	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.214669943 CET	443	51651	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.423449993 CET	443	51653	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.423944950 CET	51653	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.423974991 CET	443	51653	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.427520990 CET	443	51653	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.427642107 CET	51653	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.428164959 CET	51653	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.428350925 CET	443	51653	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.428379059 CET	51653	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.475358009 CET	443	51653	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.478849888 CET	51653	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.478861094 CET	443	51653	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.518342972 CET	443	51654	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.519058943 CET	51654	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.519073963 CET	443	51654	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.520526886 CET	443	51654	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.520608902 CET	51654	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.521064997 CET	51654	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.521145105 CET	443	51654	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.521275997 CET	51654	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.525711060 CET	51653	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.558917999 CET	443	51653	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.559083939 CET	443	51653	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.560029030 CET	51653	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.560141087 CET	51653	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.560159922 CET	443	51653	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.567329884 CET	443	51654	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.572621107 CET	51654	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.572632074 CET	443	51654	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.619472027 CET	51654	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.647695065 CET	443	51654	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.647846937 CET	443	51654	162.159.61.3	192.168.2.5
Oct 28, 2024 15:17:42.648019075 CET	51654	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.648228884 CET	51654	443	192.168.2.5	162.159.61.3
Oct 28, 2024 15:17:42.648246050 CET	443	51654	162.159.61.3	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 15:16:16.391932011 CET	53	53749	1.1.1.1	192.168.2.5
Oct 28, 2024 15:17:40.998085976 CET	53493	53	192.168.2.5	1.1.1.1
Oct 28, 2024 15:17:40.998085976 CET	49423	53	192.168.2.5	1.1.1.1
Oct 28, 2024 15:17:41.006865025 CET	53	53493	1.1.1.1	192.168.2.5
Oct 28, 2024 15:17:41.006877899 CET	53	49423	1.1.1.1	192.168.2.5
Oct 28, 2024 15:17:41.068730116 CET	61669	53	192.168.2.5	1.1.1.1
Oct 28, 2024 15:17:41.069000006 CET	53770	53	192.168.2.5	1.1.1.1
Oct 28, 2024 15:17:41.429611921 CET	53	61669	1.1.1.1	192.168.2.5
Oct 28, 2024 15:17:41.429625988 CET	53	53770	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 28, 2024 15:17:40.998085976 CET	192.168.2.5	1.1.1.1	0xb927	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Oct 28, 2024 15:17:40.998085976 CET	192.168.2.5	1.1.1.1	0x8a0f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 15:17:41.068730116 CET	192.168.2.5	1.1.1.1	0x1732	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Oct 28, 2024 15:17:41.069000006 CET	192.168.2.5	1.1.1.1	0xcdaa	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 28, 2024 15:17:41.006865025 CET	1.1.1.1	192.168.2.5	0xb927	No error (0)	chrome.cloudflare-dns.com		65	IN (0x0001)	false
Oct 28, 2024 15:17:41.006877899 CET	1.1.1.1	192.168.2.5	0x8a0f	No error (0)	chrome.cloudflare-dns.com	162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 15:17:41.006877899 CET	1.1.1.1	192.168.2.5	0x8a0f	No error (0)	chrome.cloudflare-dns.com	172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 15:17:41.429611921 CET	1.1.1.1	192.168.2.5	0x1732	No error (0)	chrome.cloudflare-dns.com	162.159.61.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 15:17:41.429611921 CET	1.1.1.1	192.168.2.5	0x1732	No error (0)	chrome.cloudflare-dns.com	172.64.41.3	A (IP address)	IN (0x0001)	false
Oct 28, 2024 15:17:41.429625988 CET	1.1.1.1	192.168.2.5	0xcdaa	No error (0)	chrome.cloudflare-dns.com		65	IN (0x0001)	false

HTTP Request Dependency Graph

chrome.cloudflare-dns.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	51650	162.159.61.3	443	1476	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 14:17:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-28 14:17:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-28 14:17:41 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 28 Oct 2024 14:17:41 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8d9b8d03ee8c2e1b-DFW alt-svc: h3=":443"; ma=86400
2024-10-28 14:17:41 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 e9 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	51651	162.159.61.3	443	1476	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 14:17:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-28 14:17:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-28 14:17:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 28 Oct 2024 14:17:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8d9b8d066c55e983-DFW alt-svc: h3=":443"; ma=86400
2024-10-28 14:17:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 58 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomXs^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	51653	162.159.61.3	443	1476	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 14:17:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-28 14:17:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-28 14:17:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 28 Oct 2024 14:17:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8d9b8d089f566b83-DFW alt-svc: h3=":443"; ma=86400
2024-10-28 14:17:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2b 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom+s^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	51654	162.159.61.3	443	1476	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-28 14:17:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-10-28 14:17:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-10-28 14:17:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 28 Oct 2024 14:17:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8d9b8d092ef8e5fa-DFW alt-svc: h3=":443"; ma=86400
2024-10-28 14:17:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ac 00 04 8e fa 73 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcoms^)

Target ID:	0
Start time:	10:15:59
Start date:	28/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\GlobalProtect64-6.3.1.msi"
Imagebase:	0x7ff762cb0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	10:15:59
Start date:	28/10/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff762cb0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	10:17:22
Start date:	28/10/2024
Path:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe" -commit
Imagebase:	0x7ff674fc0000
File size:	14'137'120 bytes
MD5 hash:	D9A82015A96F7EBEBD1B30F6B0BA1F86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:17:22
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:17:31
Start date:	28/10/2024
Path:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe"
Imagebase:	0x7ff62bf80000
File size:	13'805'856 bytes
MD5 hash:	300C8D493829B89674AB840CF163A111
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	10:17:33
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=0 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5408.6692.18028064762265798369
Imagebase:	0x7ff6e4f90000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	10:17:34
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=117.0.5938.132 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=117.0.2045.47 --initial-client-data=0x110,0x160,0x164,0x140,0x16c,0x7ff8a7a58e88,0x7ff8a7a58e98,0x7ff8a7a58ea8
Imagebase:	0x7ff6e4f90000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	10:17:34
Start date:	28/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	10:17:34
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=MojoIpcz /prefetch:2
Imagebase:	0x7ff6e4f90000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	10:17:34
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=2516 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=MojoIpcz /prefetch:3
Imagebase:	0x7ff6e4f90000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	10:17:34
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-GB --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --mojo-platform-channel-handle=3000 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=MojoIpcz /prefetch:8
Imagebase:	0x7ff6e4f90000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	10:17:35
Start date:	28/10/2024
Path:	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\117.0.2045.47\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\user\AppData\Local\Palo Alto Networks\GlobalProtect\GPAEdge\CaptivePortalUrl\EBWebView" --webview-exe-name=PanGPA.exe --webview-exe-version=6.3.1-376 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=0 --disable-nacl --first-renderer-process --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en_CH" --time-ticks-at-unix-epoch=-1730120263967503 --launch-time-ticks=4791055134 --mojo-platform-channel-handle=3408 --field-trial-handle=1800,i,11688773997540430424,5847246775237165280,262144 --enable-features=MojoIpcz /prefetch:1
Imagebase:	0x7ff6e4f90000
File size:	3'749'328 bytes
MD5 hash:	9909D978B39FB7369F511D8506C17CA0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	10:17:56
Start date:	28/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	10:17:56
Start date:	28/10/2024
Path:	C:\Windows\System32\drvinst.exe
Wow64 process (32bit):	false
Commandline:	DrvInst.exe "4" "1" "C:\Program Files\Palo Alto Networks\GlobalProtect\pangpd.inf" "9" "4473c0673" "0000000000000158" "WinSta0\Default" "0000000000000168" "208" "C:\Program Files\Palo Alto Networks\GlobalProtect"
Imagebase:	0x7ff713bd0000
File size:	337'920 bytes
MD5 hash:	294990C88B9D1FE0A54A1FA8BF4324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:17:58
Start date:	28/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s NetSetupSvc
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	10:18:03
Start date:	28/10/2024
Path:	C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPS.exe"
Imagebase:	0x7ff674fc0000
File size:	14'137'120 bytes
MD5 hash:	D9A82015A96F7EBEBD1B30F6B0BA1F86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.6%
Total number of Nodes:	560
Total number of Limit Nodes:	6

Executed Functions

Function 00007FF8B8AF3B59 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 114
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8AF1C41), ref: 00007FF8B8AF3B7E
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8AF1C41), ref: 00007FF8B8AF3B96
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8AF1C41), ref: 00007FF8B8AF3BD4
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8AF1C41), ref: 00007FF8B8AF3BE2
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8AF1C41), ref: 00007FF8B8AF3C02
OutputDebugStringW.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8AF1C41), ref: 00007FF8B8AF3C64
OutputDebugStringW.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8AF1C41), ref: 00007FF8B8AF3C72
OutputDebugStringW.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8AF1C41), ref: 00007FF8B8AF3C7C
OutputDebugStringW.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8AF1C41), ref: 00007FF8B8AF3C82
OutputDebugStringW.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8AF1C41), ref: 00007FF8B8AF3C8C
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8AF1C41), ref: 00007FF8B8AF3C9C
OutputDebugStringW.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8AF1C41), ref: 00007FF8B8AF3CFE
OutputDebugStringW.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8AF1C41), ref: 00007FF8B8AF3D0C
OutputDebugStringW.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,00000000,00007FF8B8AF1C41), ref: 00007FF8B8AF3D16

Strings

WebView2: CoreWebView2Environment failed when trying to LoadLibrary: hr=0x, xrefs: 00007FF8B8AF3C56
DllCanUnloadNow, xrefs: 00007FF8B8AF3BCA
path=, xrefs: 00007FF8B8AF3C75
WebView2: CoreWebView2Environment failed when trying to call into EmbeddedBrowserWebView.dll. hr=0x, xrefs: 00007FF8B8AF3CF0
CreateWebViewEnvironmentWithOptionsInternal, xrefs: 00007FF8B8AF3B8C

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: DebugOutputString$AddressErrorLastLibraryProc$FreeLoad
String ID: path=$CreateWebViewEnvironmentWithOptionsInternal$DllCanUnloadNow$WebView2: CoreWebView2Environment failed when trying to LoadLibrary: hr=0x$WebView2: CoreWebView2Environment failed when trying to call into EmbeddedBrowserWebView.dll. hr=0x
API String ID: 4262069778-2002646390
Opcode ID: 12f7f8cb43e1abf50f34ef4c27df96bede92c8bac871124f03455c88546cf877
Instruction ID: a387fd5396a190e0efaddb52fae62c52c44c17c1d0f0902cf30a862376faaad5
Opcode Fuzzy Hash: 12f7f8cb43e1abf50f34ef4c27df96bede92c8bac871124f03455c88546cf877
Instruction Fuzzy Hash: 8E417C31A09A4282EB10EB7AA9516F963D0EF85BC0F441135EF0E97761EF3CE4479309

Function 00007FF8B8AF13BB Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OutputDebugStringA.KERNEL32 ref: 00007FF8B8AF1519
OutputDebugStringW.KERNEL32 ref: 00007FF8B8AF1526
OutputDebugStringA.KERNEL32 ref: 00007FF8B8AF1533
OutputDebugStringA.KERNEL32 ref: 00007FF8B8AF154C

Strings

\, xrefs: 00007FF8B8AF1426
WebView2: Failed to find the app exe path., xrefs: 00007FF8B8AF1545
WebView2: Failed to find the WebView2 client dll at: , xrefs: 00007FF8B8AF150B
\, xrefs: 00007FF8B8AF141A

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: DebugOutputString
String ID: WebView2: Failed to find the WebView2 client dll at: $WebView2: Failed to find the app exe path.$\$\
API String ID: 1166629820-2806058147
Opcode ID: 55e0c8d33e79a8d238b2c227a52a1044ecd75587dd36358f365e3028ea74084f
Instruction ID: c0d6117ea6494e11df96d72f035bdd90b35e864b0bd2ebe60373da9171126667
Opcode Fuzzy Hash: 55e0c8d33e79a8d238b2c227a52a1044ecd75587dd36358f365e3028ea74084f
Instruction Fuzzy Hash: 01419C51B0A54342EF15BB2E98631F95690AF85BC4F446135DF4E8B3D6EF2CE543830A

Function 00007FF8B8AF123B Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 44
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF8B8AF126A
CreateFileW.KERNEL32 ref: 00007FF8B8AF12AA
CloseHandle.KERNEL32 ref: 00007FF8B8AF12B9
OutputDebugStringA.KERNEL32 ref: 00007FF8B8AF12D1
OutputDebugStringW.KERNEL32 ref: 00007FF8B8AF12D6
OutputDebugStringA.KERNEL32 ref: 00007FF8B8AF12E3

Strings

EBWebView\x64\EmbeddedBrowserWebView.dll, xrefs: 00007FF8B8AF1250
WebView2: skipped inaccessible , xrefs: 00007FF8B8AF12C3

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: DebugOutputString$File$AttributesCloseCreateHandle
String ID: EBWebView\x64\EmbeddedBrowserWebView.dll$WebView2: skipped inaccessible
API String ID: 2768512592-3018534981
Opcode ID: 43b53751067fc877cb938cb47dba527014ffa7987f2ef1524b37fc513ed74878
Instruction ID: 9c0825eb30986ae018ab1ae9485590664760b8a0394686ebb03b8998b167b42e
Opcode Fuzzy Hash: 43b53751067fc877cb938cb47dba527014ffa7987f2ef1524b37fc513ed74878
Instruction Fuzzy Hash: CA118E20F0D54242FB00ABB9E829BB82750AF51BE0F445330DA6E977F5DF6CA54B8709

Function 00007FF8B8AF4A20 Relevance: 12.1, APIs: 8, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_initialize_crt.LIBCMT ref: 00007FF8B8AF4899
__scrt_acquire_startup_lock.LIBCMT ref: 00007FF8B8AF48A6
_RTC_Initialize.LIBCMT ref: 00007FF8B8AF48D4
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8B8AF48FA
__scrt_release_startup_lock.LIBCMT ref: 00007FF8B8AF4925

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_initialize_crt__scrt_release_startup_lock
String ID:
API String ID: 2924237428-0
Opcode ID: d4a03eac3de38847b71cfbf38955c74ab6b11d060a1ade4abda77bdbeb7704da
Instruction ID: 7ba7a7209dd3af342c85448352feb07bf6aeb18aa26941f1a44df4b6fc1e7d8f
Opcode Fuzzy Hash: d4a03eac3de38847b71cfbf38955c74ab6b11d060a1ade4abda77bdbeb7704da
Instruction Fuzzy Hash: 83515E21E0F64387F610AB7CA4D32BA2298AF453C4F546135DB4C976A7CF2DE547860E

Function 00007FF8B8AF1B7E Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 147
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 00007FF8B8AF1CC4
_Init_thread_header.LIBCMT ref: 00007FF8B8AF1DC8
LoadLibraryExW.KERNEL32 ref: 00007FF8B8AF1DE9

Part of subcall function 00007FF8B8AF13BB: OutputDebugStringA.KERNEL32 ref: 00007FF8B8AF1519
Part of subcall function 00007FF8B8AF13BB: OutputDebugStringW.KERNEL32 ref: 00007FF8B8AF1526
Part of subcall function 00007FF8B8AF13BB: OutputDebugStringA.KERNEL32 ref: 00007FF8B8AF1533

Strings

EventRegister, xrefs: 00007FF8B8AF1CBD
ADVAPI32.dll, xrefs: 00007FF8B8AF1DDA

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: DebugOutputString$AddressInit_thread_headerLibraryLoadProc
String ID: ADVAPI32.dll$EventRegister
API String ID: 2689812674-1617240376
Opcode ID: 2f046f2a20f4de0ddd0858d0692cf4b5bd261f0d3a3d4b3448c006bcc9e0d610
Instruction ID: 3659c12da9d27c19dee3f4d258efdb74b1616c568d930287f9e1bca9e220041e
Opcode Fuzzy Hash: 2f046f2a20f4de0ddd0858d0692cf4b5bd261f0d3a3d4b3448c006bcc9e0d610
Instruction Fuzzy Hash: C1616032A1AB8286F761DB6DE8527A637A0FF447D4F441135DB4D866A0EF3CE046C709

Function 00007FF8B8AFF384 Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(?,?,00000000,00007FF8B8AFD1EE,?,?,00000001,00007FF8B8AFF299,?,?,?,?,00007FF8B8AFE4FC), ref: 00007FF8B8AFF3D9

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: af9667d4f1f246ace184cb74f01f7ea88888c64fbe3cb6b7782e16932f59253a
Instruction ID: a500920379990b6f6aebe61c5ec54a180c43887f96df37171c21e6ddd754683f
Opcode Fuzzy Hash: af9667d4f1f246ace184cb74f01f7ea88888c64fbe3cb6b7782e16932f59253a
Instruction Fuzzy Hash: 5CF06D44B1A60383FE55676A99522B952805F88BC0F086531CB1EC63D6EF2CE487821A

Non-executed Functions

Function 00007FF8B8AF2035 Relevance: 30.1, APIs: 12, Strings: 5, Instructions: 312
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00007FF8B8AF2252
HeapFree.KERNEL32 ref: 00007FF8B8AF2260
OutputDebugStringA.KERNEL32 ref: 00007FF8B8AF23BD
_Init_thread_header.LIBCMT ref: 00007FF8B8AF2543
GetModuleHandleW.KERNEL32 ref: 00007FF8B8AF255C
GetProcAddress.KERNEL32 ref: 00007FF8B8AF256C
_Init_thread_header.LIBCMT ref: 00007FF8B8AF2591
GetModuleHandleW.KERNEL32 ref: 00007FF8B8AF25AA
GetProcAddress.KERNEL32 ref: 00007FF8B8AF25BA
_Init_thread_header.LIBCMT ref: 00007FF8B8AF25DF
GetModuleHandleW.KERNEL32 ref: 00007FF8B8AF25F8
GetProcAddress.KERNEL32 ref: 00007FF8B8AF2608

Part of subcall function 00007FF8B8AF3E98: EnterCriticalSection.KERNEL32(?,?,?,00007FF8B8AF17A9,?,?,?,00007FF8B8AF15A2), ref: 00007FF8B8AF3EA8
Part of subcall function 00007FF8B8AF3E98: LeaveCriticalSection.KERNEL32(?,?,?,00007FF8B8AF17A9,?,?,?,00007FF8B8AF15A2), ref: 00007FF8B8AF3EE8

Strings

kernelbase.dll, xrefs: 00007FF8B8AF2555, 00007FF8B8AF25A3, 00007FF8B8AF25F1
AddPackageDependency, xrefs: 00007FF8B8AF25B3
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation., xrefs: 00007FF8B8AF23B6
GetCurrentPackageInfo, xrefs: 00007FF8B8AF2601
TryCreatePackageDependency, xrefs: 00007FF8B8AF2565

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: AddressHandleInit_thread_headerModuleProc$CriticalHeapSection$DebugEnterFreeLeaveOutputProcessString
String ID: AddPackageDependency$GetCurrentPackageInfo$TryCreatePackageDependency$WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.$kernelbase.dll
API String ID: 2275306934-2537964033
Opcode ID: 41dacc906399f40a22a0c2e3e683beb1ba05551d93a2989722910d59186e36c2
Instruction ID: 2122b7d4ee3c3e5f695c60ca2d92698b4d38e8bcbcd73e2fcfd06f74ba4d70a1
Opcode Fuzzy Hash: 41dacc906399f40a22a0c2e3e683beb1ba05551d93a2989722910d59186e36c2
Instruction Fuzzy Hash: 2CE19225A19A8382E720AB29E4667BA73A0FF847C4F405135DB8D877A5DF3CE447C709

Function 00007FF8B8AF438C Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8B8AF43A8
RtlCaptureContext.KERNEL32 ref: 00007FF8B8AF43D5
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8B8AF43EF
RtlVirtualUnwind.KERNEL32 ref: 00007FF8B8AF4430
IsDebuggerPresent.KERNEL32 ref: 00007FF8B8AF4484
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8B8AF44A5
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8B8AF44B0

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 1c387452c6bd20d9bd0b26e6a3e5af98d0f0a8ed461161c49348229e332161bf
Instruction ID: 1e70a002ee4f3cb30cf6bb673bd26487afdc661254d13b809c75678024f6483b
Opcode Fuzzy Hash: 1c387452c6bd20d9bd0b26e6a3e5af98d0f0a8ed461161c49348229e332161bf
Instruction Fuzzy Hash: 34316C7270AB818AEB608F64E8807ED7364FB84784F44403ADB4E97B98EF38D549C714

Function 00007FF8B8AFE648 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF8B8AFE6C1
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8B8AFE6D9
RtlVirtualUnwind.KERNEL32 ref: 00007FF8B8AFE714
IsDebuggerPresent.KERNEL32 ref: 00007FF8B8AFE74D
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8B8AFE757
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8B8AFE762

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 0fd7f48f63b6739c0bf18d43cfacde1b32162cf46eb811c58cb904b60a33be4e
Instruction ID: b8b12f1f0b7229a27bbe2e5d10774d8ac4fd7414f299b1d7c8d2a59dab7b3d65
Opcode Fuzzy Hash: 0fd7f48f63b6739c0bf18d43cfacde1b32162cf46eb811c58cb904b60a33be4e
Instruction Fuzzy Hash: 6F317136609B8196DB60CF79E8416AE73A4FB88794F500136EB8D47BA8DF3CD156CB04

Function 00007FF8B8AFFAD4 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 236fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32 ref: 00007FF8B8AFFC44
FindNextFileW.KERNEL32 ref: 00007FF8B8AFFD7A
FindClose.KERNEL32 ref: 00007FF8B8AFFDBA
FindClose.KERNEL32 ref: 00007FF8B8AFFDE6

Strings

C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe, xrefs: 00007FF8B8AFFAD7

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe
API String ID: 1164774033-4002431106
Opcode ID: bcd3fcb9144ee8511b469d74575613067d94b30b0e5d16f188c3da072200e329
Instruction ID: 358cde79cb24312edba244419c604650ba413af9370d6a1f9bd624764c80abbb
Opcode Fuzzy Hash: bcd3fcb9144ee8511b469d74575613067d94b30b0e5d16f188c3da072200e329
Instruction Fuzzy Hash: 1BA1E822B096824BFB208B7994412BD6BA1AB41BD8F145135DF8DAB695DF3CD443C70A

Function 00007FF8B8AFF950 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B8AFF384: HeapAlloc.KERNEL32(?,?,00000000,00007FF8B8AFD1EE,?,?,00000001,00007FF8B8AFF299,?,?,?,?,00007FF8B8AFE4FC), ref: 00007FF8B8AFF3D9

Part of subcall function 00007FF8B8B02FF0: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8B8B03023

FindFirstFileExW.KERNEL32 ref: 00007FF8B8AFFC44

Part of subcall function 00007FF8B8AFE4C8: HeapFree.KERNEL32 ref: 00007FF8B8AFE4DE
Part of subcall function 00007FF8B8AFE4C8: GetLastError.KERNEL32 ref: 00007FF8B8AFE4E8

Strings

C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe, xrefs: 00007FF8B8AFFAD7

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: Heap$AllocErrorFileFindFirstFreeLast_invalid_parameter_noinfo
String ID: C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe
API String ID: 2436724071-4002431106
Opcode ID: de8c149f0ae7a12d0aa6c30c4c6680b5fa73d7be7db69601966e87329974bca1
Instruction ID: b0aa503b99460d742c50f769f17160f08bb44610d22abb1e6328fa8594c3c867
Opcode Fuzzy Hash: de8c149f0ae7a12d0aa6c30c4c6680b5fa73d7be7db69601966e87329974bca1
Instruction Fuzzy Hash: 4C81E622B0AA8286EB20DB29A45217EB791EB45BD0F045235DFAD97795DF3CE043C705

Function 00007FF8B8B05168 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 00007FF8B8B053B7
RaiseException.KERNEL32 ref: 00007FF8B8B053C8

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: de106c2c89efbc54d07ff03eb7aea0bd319d8747356b88b76a4c7a9a8ee01d36
Instruction ID: 585cc19d7d94c6680a7929e670c898658cd52461be1d5adeebb94ba7f0fed4de
Opcode Fuzzy Hash: de106c2c89efbc54d07ff03eb7aea0bd319d8747356b88b76a4c7a9a8ee01d36
Instruction Fuzzy Hash: 8CB13873604B898AEB15CF2DC84676C7BA0F784B88F148925DB5E97BB8CB39D452C704

Function 00007FF8B8AF27AF Relevance: 2.6, Strings: 2, Instructions: 127COMMON

Download Yara Rule

Strings

EBWebView, xrefs: 00007FF8B8AF286A
location, xrefs: 00007FF8B8AF2863

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID:
String ID: EBWebView$location
API String ID: 0-1419719847
Opcode ID: 6baa15de914bf11356d5aa687519856015fbf890a51d41359f0798bb6d54c190
Instruction ID: 46e400771754031456079437b2ed01249deb7308fbea26c8ee10288e6c3afda7
Opcode Fuzzy Hash: 6baa15de914bf11356d5aa687519856015fbf890a51d41359f0798bb6d54c190
Instruction Fuzzy Hash: 8D41C62171DA4342FA609B2AA8566BAB390EF447C0F446035EF4D47B54DF7CD107C709

Function 00007FF8B8AFCF80 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF8B8AFCF84

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: ec139f25899eda4c4fa2edf4d9fcb5fd7f9377f1a5b717b656b58f01995c0af8
Instruction ID: a4b8911b8dd8bfeba403ef6f91453a5c44890c7ed583c8dd7561b0f89e5e1328
Opcode Fuzzy Hash: ec139f25899eda4c4fa2edf4d9fcb5fd7f9377f1a5b717b656b58f01995c0af8
Instruction Fuzzy Hash: 59B09220F17B02C6EA483B296C82A1822A8BF48740F954178C21C51330EF2C20A69704

Function 00007FF8B8AF7468 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 45ba9855f37e36195743d9b33156e4397b15c40fed7f4c2562bba8a3c720457c
Instruction ID: 26aa8757d7669f64a2a1d21ad851033a5e87648575abb195d81f4c4db2822794
Opcode Fuzzy Hash: 45ba9855f37e36195743d9b33156e4397b15c40fed7f4c2562bba8a3c720457c
Instruction Fuzzy Hash: E241E262B15A9582EF04CF2ED91556A73A1BB48FD0F09A136EF4D87B68DF3CD1428304

Function 00007FF8B8B04F80 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b7a311bcaeda3ba39ee8b30109c4e254aae3beb64b2592ed2caaf621b198ddd
Instruction ID: 49c3fb47fcb1a98624f2f7d29f0b01a2c84ea99bcc7e1ccc56da035aba29e752
Opcode Fuzzy Hash: 9b7a311bcaeda3ba39ee8b30109c4e254aae3beb64b2592ed2caaf621b198ddd
Instruction Fuzzy Hash: C6F018727286559ADBA49F3DA45362A7BD0E7483C4F508039D68D87F18D73C94518F08

Function 00007FF8B8AF4F94 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 195
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DloadAcquireSectionWriteAccess.DELAYIMP ref: 00007FF8B8AF4FB9

Part of subcall function 00007FF8B8AF4E54: DloadProtectSection.DELAYIMP ref: 00007FF8B8AF4EC5

RaiseException.KERNEL32 ref: 00007FF8B8AF503B
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF8B8AF5027

Part of subcall function 00007FF8B8AF4F00: DloadProtectSection.DELAYIMP ref: 00007FF8B8AF4F5F

LoadLibraryExA.KERNEL32 ref: 00007FF8B8AF50DA
GetLastError.KERNEL32 ref: 00007FF8B8AF50E8
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00007FF8B8AF511A
RaiseException.KERNEL32 ref: 00007FF8B8AF512E

Strings

MZx, xrefs: 00007FF8B8AF4FC2
H, xrefs: 00007FF8B8AF5008

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: DloadSection$AccessWrite$ExceptionProtectRaiseRelease$AcquireErrorLastLibraryLoad
String ID: H$MZx
API String ID: 282135826-3879308991
Opcode ID: 2f5d7b71edcd8466ca14cfffaa112b020ec6140e5287d9de4535a44ea4261994
Instruction ID: 077baaa57d17ca80ba08a4726a42074c326120d86ab702feef87ce663a8acdb4
Opcode Fuzzy Hash: 2f5d7b71edcd8466ca14cfffaa112b020ec6140e5287d9de4535a44ea4261994
Instruction Fuzzy Hash: D3914632F16B128AEB00DFA9D8856A833A1BB08BC8F055539DF0D57B54EF38E446C349

Function 00007FF8B8AF2C58 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 111libraryloaderCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF8B8AF2D3C
_Init_thread_header.LIBCMT ref: 00007FF8B8AF2D9C
GetModuleHandleW.KERNEL32 ref: 00007FF8B8AF2DB5
GetProcAddress.KERNEL32 ref: 00007FF8B8AF2DC5
_Init_thread_header.LIBCMT ref: 00007FF8B8AF2DEA

Part of subcall function 00007FF8B8AF3E30: EnterCriticalSection.KERNEL32(?,?,?,00007FF8B8AF175E,?,?,?,00007FF8B8AF15A2), ref: 00007FF8B8AF3E40

LoadLibraryExW.KERNEL32 ref: 00007FF8B8AF2E0D
GetProcAddress.KERNEL32 ref: 00007FF8B8AF2E22

Strings

GetCurrentApplicationUserModelId, xrefs: 00007FF8B8AF2DBB
shell32.dll, xrefs: 00007FF8B8AF2DFC
GetCurrentProcessExplicitAppUserModelID, xrefs: 00007FF8B8AF2E18
Kernel32.dll, xrefs: 00007FF8B8AF2DAE

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: AddressInit_thread_headerProc$CriticalEnterErrorHandleLastLibraryLoadModuleSection
String ID: GetCurrentApplicationUserModelId$GetCurrentProcessExplicitAppUserModelID$Kernel32.dll$shell32.dll
API String ID: 70475090-1491551679
Opcode ID: 7d824359f2b93e701cd657d860bb2db54cc266a21098c3a5d9b9ae86b7e62872
Instruction ID: 56fa1cc843a1905c75bd4d17c99e1f2336337ef4488fd3c21aaa57090f471673
Opcode Fuzzy Hash: 7d824359f2b93e701cd657d860bb2db54cc266a21098c3a5d9b9ae86b7e62872
Instruction Fuzzy Hash: 0F514326A1DA0383FB10EB2DE8626B62791BF88BD0F541131CB5D873A4DF6CE5478719

Function 00007FF8B8AF3D60 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 52libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8B8AF3D76
GetModuleHandleW.KERNEL32 ref: 00007FF8B8AF3D83
GetModuleHandleW.KERNEL32 ref: 00007FF8B8AF3D98
GetProcAddress.KERNEL32 ref: 00007FF8B8AF3DB0
GetProcAddress.KERNEL32 ref: 00007FF8B8AF3DC3
CreateEventW.KERNEL32 ref: 00007FF8B8AF3DEF

Strings

SleepConditionVariableCS, xrefs: 00007FF8B8AF3DA6
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00007FF8B8AF3D7C
kernel32.dll, xrefs: 00007FF8B8AF3D91
WakeAllConditionVariable, xrefs: 00007FF8B8AF3DB6

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: AddressHandleModuleProc$CountCreateCriticalEventInitializeSectionSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 4003212759-3242537097
Opcode ID: 6f3b8be8d1348d1aac0b654d4ceb45f93a520f9b6ae3c2bf047234035a775ebc
Instruction ID: b534abd2d0cf4f2fd81f2676ee8ef6a6133c3ea32faec62082f6c6c91705bed6
Opcode Fuzzy Hash: 6f3b8be8d1348d1aac0b654d4ceb45f93a520f9b6ae3c2bf047234035a775ebc
Instruction Fuzzy Hash: 0021ED24F1EB0382FF55AB38E9959B562A0AF497C0F945435CB0E467B5EF3CE4878209

Function 00007FF8B8AFCCFC Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00007FF8B8AFCE78
GetProcAddress.KERNEL32 ref: 00007FF8B8AFCE84

Strings

MZx, xrefs: 00007FF8B8AFCD1B, 00007FF8B8AFCE01, 00007FF8B8AFCE61
ext-ms-, xrefs: 00007FF8B8AFCDD5
api-ms-, xrefs: 00007FF8B8AFCDC2

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: MZx$api-ms-$ext-ms-
API String ID: 3013587201-2431898299
Opcode ID: 8da1cbac18084b33459029f9fbcf2cabb1278f52b64451b4b18480fc78f4571c
Instruction ID: c74375b27b9c04db9bdf704e274a32a81f6f77ed656ce37436937795d3dd1644
Opcode Fuzzy Hash: 8da1cbac18084b33459029f9fbcf2cabb1278f52b64451b4b18480fc78f4571c
Instruction Fuzzy Hash: 98412521B1AA1293EA26CB2E98006B92391BF44BE0F085135DF0D97798EF3CE407D708

Function 00007FF8B8AFB144 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMONLIBRARYCODE

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF8B8AFB1A1

Part of subcall function 00007FF8B8AF9984: __GetUnwindTryBlock.LIBCMT ref: 00007FF8B8AF99C7
Part of subcall function 00007FF8B8AF9984: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF8B8AF99EC

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF8B8AFB279
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF8B8AFB4CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B8AFB5DA

Strings

csm, xrefs: 00007FF8B8AFB29C
csm, xrefs: 00007FF8B8AFB222
csm, xrefs: 00007FF8B8AFB1BB

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 91ac7ab477fe959004793c113cf7664fdc944e04a7e39ae93e2fa725a5558e56
Instruction ID: d25f29bfdb18590a58d2096cdab2fd8ba8dde8c88348688f9e5abffd7c5f4f62
Opcode Fuzzy Hash: 91ac7ab477fe959004793c113cf7664fdc944e04a7e39ae93e2fa725a5558e56
Instruction Fuzzy Hash: 99E18072A097468BEB209B69D4422AD77B0FB55BD8F102135EF4D97B95CF38E082C706

Function 00007FF8B8B00950 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00007FF8B8B009D5
GetLastError.KERNEL32 ref: 00007FF8B8B009E3
LoadLibraryExW.KERNEL32 ref: 00007FF8B8B00A0D
FreeLibrary.KERNEL32 ref: 00007FF8B8B00A53
GetProcAddress.KERNEL32 ref: 00007FF8B8B00A5F

Strings

MZx, xrefs: 00007FF8B8B0096E, 00007FF8B8B00A1E, 00007FF8B8B00A3C
api-ms-, xrefs: 00007FF8B8B009F5

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: MZx$api-ms-
API String ID: 2559590344-259127448
Opcode ID: ba125442e0abb95d703510ae50efba27243c008c9cd2c64364e7ecde246d4901
Instruction ID: a92cb11213db29e136d860e1e2f750e54bc66135a29a05884488523fee3afe5a
Opcode Fuzzy Hash: ba125442e0abb95d703510ae50efba27243c008c9cd2c64364e7ecde246d4901
Instruction Fuzzy Hash: FE31E121B1EB42D5EE219B6AA810AB52394FF48BE0F495535DF1D6B3A0DF3CE4438308

Function 00007FF8B8AF81B8 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 494COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8B8AF81FB
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8B8AF85E8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8B8AF8884

Strings

f, xrefs: 00007FF8B8AF831D
p, xrefs: 00007FF8B8AF8325
p, xrefs: 00007FF8B8AF82AD

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 7ec5e5d70397ff4a41551d3031dfc58c8a2dfe3f5ad8bff1884a6bbe0fe0d2fd
Instruction ID: 2f523e5dbd63aa2ebb787c2eff10f1f1f44e26b24e398fb9da93bd6e9a0e3d7f
Opcode Fuzzy Hash: 7ec5e5d70397ff4a41551d3031dfc58c8a2dfe3f5ad8bff1884a6bbe0fe0d2fd
Instruction Fuzzy Hash: A712A562E0E14387FB609A18D15637EF691FB407D0F84A135E799876C8DF3CE882874A

Function 00007FF8B8AFB61C Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 316COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF8B8AFB7BA
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B8AFBADD

Strings

MZx, xrefs: 00007FF8B8AFB6C5, 00007FF8B8AFB9AB
csm, xrefs: 00007FF8B8AFB763
csm, xrefs: 00007FF8B8AFB7E1
csm, xrefs: 00007FF8B8AFB701

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: MZx$csm$csm$csm
API String ID: 3523768491-2572334722
Opcode ID: 65519f6508c52ec0d79fee6755b74ed9d74d9bc47e143ed949cf3a7773e7a134
Instruction ID: 76a9f6b959cebf23962eb5d74d084c332c4b197d7ede84524fcecfd6ab00e8b7
Opcode Fuzzy Hash: 65519f6508c52ec0d79fee6755b74ed9d74d9bc47e143ed949cf3a7773e7a134
Instruction Fuzzy Hash: 1DE1AE72A096828BE7109B28D4823AD77B0FB547D8F146135EB8D87696DF38E487C706

Function 00007FF8B8AFD014 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF8B8AFD023
FlsGetValue.KERNEL32 ref: 00007FF8B8AFD038
FlsSetValue.KERNEL32 ref: 00007FF8B8AFD059
FlsSetValue.KERNEL32 ref: 00007FF8B8AFD086
FlsSetValue.KERNEL32 ref: 00007FF8B8AFD097
FlsSetValue.KERNEL32 ref: 00007FF8B8AFD0A8
SetLastError.KERNEL32 ref: 00007FF8B8AFD0C3

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 9915ffd56e6ed5add76546d9c697cb21804a3ce59237cb007c1a608932a2bb9e
Instruction ID: 709102e9896b345362bb2ca1e5a657c0babdfeec951fe15b303024d925ec3556
Opcode Fuzzy Hash: 9915ffd56e6ed5add76546d9c697cb21804a3ce59237cb007c1a608932a2bb9e
Instruction Fuzzy Hash: 78215E20A0E28343FA59A73E554753A61525F44BE0F146734DB3F9BBD6DF2CB443820A

Function 00007FF8B8B0444C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF8B8B0447D
GetLastError.KERNEL32 ref: 00007FF8B8B04489
CloseHandle.KERNEL32 ref: 00007FF8B8B044A1
CreateFileW.KERNEL32 ref: 00007FF8B8B044CC
WriteConsoleW.KERNEL32 ref: 00007FF8B8B044EB

Strings

CONOUT$, xrefs: 00007FF8B8B044AD

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 6f516df89894e54f81e44bc4d79c2f5e144586085513034f161dc59087349922
Instruction ID: 0d01d8ae742e356979597bea36449199df5aff01b8c2bba5f425d032bc87cb68
Opcode Fuzzy Hash: 6f516df89894e54f81e44bc4d79c2f5e144586085513034f161dc59087349922
Instruction Fuzzy Hash: 6411B231B28B4286E7509B6AE84472977A0FB88FE4F004234EF5D977A4CF3CD4468748

Function 00007FF8B8AF4BF0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF8B8AF4C17
GetProcAddress.KERNEL32 ref: 00007FF8B8AF4C34
GetProcAddress.KERNEL32 ref: 00007FF8B8AF4C50

Strings

ReleaseSRWLockExclusive, xrefs: 00007FF8B8AF4C3F
KERNEL32.DLL, xrefs: 00007FF8B8AF4C10
AcquireSRWLockExclusive, xrefs: 00007FF8B8AF4C2A

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: e20d6d823d3d2e87c9591c643e55e8dd20ed86387c2e0c4033fc903612f8ad0b
Instruction ID: b239deb97e622e0da9be04a72109ba41e14be9b621bc949ea6cd0e7d3e80ac14
Opcode Fuzzy Hash: e20d6d823d3d2e87c9591c643e55e8dd20ed86387c2e0c4033fc903612f8ad0b
Instruction Fuzzy Hash: E3116520F0FB0382FE549B2CE58117222A99F087C1F487434CB0D46361EF7CB4879249

Function 00007FF8B8AF1575 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B8AF1706: _Init_thread_header.LIBCMT ref: 00007FF8B8AF1759
Part of subcall function 00007FF8B8AF1706: LoadLibraryExW.KERNEL32(?,?,?,00007FF8B8AF15A2), ref: 00007FF8B8AF1776
Part of subcall function 00007FF8B8AF1706: LoadLibraryExW.KERNEL32(?,?,?,00007FF8B8AF15A2), ref: 00007FF8B8AF1790

GetLastError.KERNEL32 ref: 00007FF8B8AF1628
GetLastError.KERNEL32 ref: 00007FF8B8AF1662

Strings

\StringFileInfo\040904B0\ProductVersion, xrefs: 00007FF8B8AF16BE
VerQueryValueW, xrefs: 00007FF8B8AF15B4
GetFileVersionInfoSizeW, xrefs: 00007FF8B8AF1596
GetFileVersionInfoW, xrefs: 00007FF8B8AF15A5

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: ErrorLastLibraryLoad$Init_thread_header
String ID: GetFileVersionInfoSizeW$GetFileVersionInfoW$VerQueryValueW$\StringFileInfo\040904B0\ProductVersion
API String ID: 1713935634-1241276684
Opcode ID: 9c72912cb40bb2cb18329608d5eaa998f439010d61883c82f402a47cef3fd1d2
Instruction ID: b8ba7fab372520b05f963046535eacbb4bd19c0c23093775586ffea8e2b2bb6f
Opcode Fuzzy Hash: 9c72912cb40bb2cb18329608d5eaa998f439010d61883c82f402a47cef3fd1d2
Instruction Fuzzy Hash: 3541B321B1A64646EB42AB2AD8526BA77D0AF44BC0F485131EF4DC73A1EF3CE5078709

Function 00007FF8B8AFD18C Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000001,00007FF8B8AFF299,?,?,?,?,00007FF8B8AFE4FC), ref: 00007FF8B8AFD19B
FlsSetValue.KERNEL32(?,?,00000001,00007FF8B8AFF299,?,?,?,?,00007FF8B8AFE4FC), ref: 00007FF8B8AFD1D1
FlsSetValue.KERNEL32(?,?,00000001,00007FF8B8AFF299,?,?,?,?,00007FF8B8AFE4FC), ref: 00007FF8B8AFD1FE
FlsSetValue.KERNEL32(?,?,00000001,00007FF8B8AFF299,?,?,?,?,00007FF8B8AFE4FC), ref: 00007FF8B8AFD20F
FlsSetValue.KERNEL32(?,?,00000001,00007FF8B8AFF299,?,?,?,?,00007FF8B8AFE4FC), ref: 00007FF8B8AFD220
SetLastError.KERNEL32(?,?,00000001,00007FF8B8AFF299,?,?,?,?,00007FF8B8AFE4FC), ref: 00007FF8B8AFD23B

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 7c53be71c3e7253b617fcc9f5609d0daabaf35f7e0f1dcfe8c9f07dd68ee0453
Instruction ID: f5379fed98d8697f79316a45a97f6c8a7e47b51eb17d190f21c6e321b742b135
Opcode Fuzzy Hash: 7c53be71c3e7253b617fcc9f5609d0daabaf35f7e0f1dcfe8c9f07dd68ee0453
Instruction Fuzzy Hash: 25118E20B0A29243FA59E77E555613A62425F487F0F006334EB3E877E6EF2CF443824A

Function 00007FF8B8B02278 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF8B8B022F7
WriteFile.KERNEL32 ref: 00007FF8B8B025BF
WriteFile.KERNEL32 ref: 00007FF8B8B02605
GetLastError.KERNEL32 ref: 00007FF8B8B026BB

Strings

MZx, xrefs: 00007FF8B8B022CE, 00007FF8B8B0234F, 00007FF8B8B02404

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID: MZx
API String ID: 2718003287-2575928145
Opcode ID: bb9356310b9d82c72f2c8e1bcbb65324215734dd029ddd4dc592915150751541
Instruction ID: 58bf7d5a2e46d39c5e239240063e102f95c8e8e5a7ba1b327cf033660a9542f6
Opcode Fuzzy Hash: bb9356310b9d82c72f2c8e1bcbb65324215734dd029ddd4dc592915150751541
Instruction Fuzzy Hash: 85D1D022B18A8289E712CF79D4406AC37A1EB447D8F148236DF5DA7BA9DF38D51BC344

Function 00007FF8B8AFBEDC Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 191COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF8B8AFBF4C
_CallSETranslator.LIBVCRUNTIME ref: 00007FF8B8AFBF97

Strings

MZx, xrefs: 00007FF8B8AFBFFA, 00007FF8B8AFC104
RCC, xrefs: 00007FF8B8AFBF68
MOC, xrefs: 00007FF8B8AFBF60

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$MZx$RCC
API String ID: 3544855599-2476776655
Opcode ID: fdf7a9f8b25788c72ab9bb10a8a5de6fbe61c938e9bfa1772e14379d6c5b4358
Instruction ID: 548b710d923f6fc448fa1b97a0988870219140d41cb78ceabc9802f5cd9984e7
Opcode Fuzzy Hash: fdf7a9f8b25788c72ab9bb10a8a5de6fbe61c938e9bfa1772e14379d6c5b4358
Instruction Fuzzy Hash: 2991E073A09B918AE710CB69D8812AC7BB0FB447C8F14512AEB8D87B55DF3CD196CB05

Function 00007FF8B8AF5480 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF8B8AF54AB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF8B8AF5540
RtlUnwindEx.KERNEL32 ref: 00007FF8B8AF558F

Strings

f, xrefs: 00007FF8B8AF54BE
csm, xrefs: 00007FF8B8AF5526

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 2002ec42011f0455092b5cd0fb1bd6aca48d1b2a6706e206d147faff4193f48f
Instruction ID: f71d3385e33267ef07fd80fad285d4d70814119f33e034c650beb4d0b40fd7d5
Opcode Fuzzy Hash: 2002ec42011f0455092b5cd0fb1bd6aca48d1b2a6706e206d147faff4193f48f
Instruction Fuzzy Hash: 7451C532A1A6028BDB54CF19E445A3D3796FB44BC8F55A034DB1E87748EF38E842C709

Function 00007FF8B8AF1706 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryCOMMON

Download Yara Rule

APIs

_Init_thread_header.LIBCMT ref: 00007FF8B8AF1759
LoadLibraryExW.KERNEL32(?,?,?,00007FF8B8AF15A2), ref: 00007FF8B8AF1776
LoadLibraryExW.KERNEL32(?,?,?,00007FF8B8AF15A2), ref: 00007FF8B8AF1790

Strings

api-ms-win-core-version-l1-1-0.dll, xrefs: 00007FF8B8AF1767
version.dll, xrefs: 00007FF8B8AF1781

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: LibraryLoad$Init_thread_header
String ID: api-ms-win-core-version-l1-1-0.dll$version.dll
API String ID: 2453750617-4294597371
Opcode ID: 89877388f5bbf7a8bf5167155267a82de7904b5b74c5326782c400c1d5429f60
Instruction ID: 512ce90421a97003a7939c99f0fd5b240c9633a7c4b8469c5131561571bf9467
Opcode Fuzzy Hash: 89877388f5bbf7a8bf5167155267a82de7904b5b74c5326782c400c1d5429f60
Instruction Fuzzy Hash: 8A112521F1E94392F665E76DEC916B23791AF887D0F445235C70D863B4EF2CA4878B09

Function 00007FF8B8AF6D60 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF8B8AF6D85
GetProcAddress.KERNEL32 ref: 00007FF8B8AF6D9B
FreeLibrary.KERNEL32 ref: 00007FF8B8AF6DC2

Strings

mscoree.dll, xrefs: 00007FF8B8AF6D7C
CorExitProcess, xrefs: 00007FF8B8AF6D94

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: a52ed64fc196a485e60f66e0204b8751c3d3b06880ad72fa40a8e96d37360263
Instruction ID: 7990f2dd47b53988f8251820d38b11c6730043306cbfd1c04e2c2c01058cf5c4
Opcode Fuzzy Hash: a52ed64fc196a485e60f66e0204b8751c3d3b06880ad72fa40a8e96d37360263
Instruction Fuzzy Hash: 97F0C261B19B0682FA149B38E4457B92360EF49BE0F840239C76D452F8CF2CD04AC304

Function 00007FF8B8B04D90 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF8B8B04DB8
_set_statfp.LIBCMT ref: 00007FF8B8B04DD3
_set_statfp.LIBCMT ref: 00007FF8B8B04DEF
_set_statfp.LIBCMT ref: 00007FF8B8B04E2B

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 52608bc6d143c9dc7bfa0a8c4855f078bb6d55b13afd5a83babe45fd19c9ed63
Instruction ID: f9bce8660f6c207330788111f9ae95f335ffe58d21859a078f9dc36fede93a92
Opcode Fuzzy Hash: 52608bc6d143c9dc7bfa0a8c4855f078bb6d55b13afd5a83babe45fd19c9ed63
Instruction Fuzzy Hash: 35116D62E58A0B05F66C113CE45637514416F563F8F440A74EBBE766F79F1CA8928208

Function 00007FF8B8AFD298 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF8B8AFD2B7
FlsSetValue.KERNEL32 ref: 00007FF8B8AFD2D6
FlsSetValue.KERNEL32 ref: 00007FF8B8AFD2FE
FlsSetValue.KERNEL32 ref: 00007FF8B8AFD30F
FlsSetValue.KERNEL32 ref: 00007FF8B8AFD320

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 7df978da6715813ef5d24873c54b16d0e11de70242dcaf0aa7cb0e4beb12e4ef
Instruction ID: c3d997c46ac2ce6a9c57d64aefd12bea4d43d6c17d33e61c01131cfeac61be90
Opcode Fuzzy Hash: 7df978da6715813ef5d24873c54b16d0e11de70242dcaf0aa7cb0e4beb12e4ef
Instruction Fuzzy Hash: CF113D20E0E28243FA59E72E955717A61425F847E0F446334DB7EDA6D5DF2CF413824A

Function 00007FF8B8AFD0E8 Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 00007FF8B8AFD0F9
FlsSetValue.KERNEL32 ref: 00007FF8B8AFD118
FlsSetValue.KERNEL32 ref: 00007FF8B8AFD140
FlsSetValue.KERNEL32 ref: 00007FF8B8AFD151
FlsSetValue.KERNEL32 ref: 00007FF8B8AFD162

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 4332fe8aa24bc48e3eafdf23b53ead159182f599ad25738f0433981de1516ab6
Instruction ID: d72069925dbc34c86ea71e71527010ce2bd468ffe8752d816284be101e587f20
Opcode Fuzzy Hash: 4332fe8aa24bc48e3eafdf23b53ead159182f599ad25738f0433981de1516ab6
Instruction Fuzzy Hash: 0711E810E0A28343FA69F23E585717A61424F457E4F146734EB3E9A2E2EF2CB453925E

Function 00007FF8B8AF9C0C Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 299COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF8B8AF9FBA
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF8B8AF9FE6

Strings

MZx, xrefs: 00007FF8B8AF9CD5
csm, xrefs: 00007FF8B8AFA0E6

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: MZx$csm
API String ID: 2558813199-2795018954
Opcode ID: 9133f93aca3ca78d232ba36a9b18439ec35bd39241411b6fd32966424d1c060e
Instruction ID: 857eb8e9c0acb90d30737a172eab5df829d6e661439d8a718cf57b7f0ee9bff4
Opcode Fuzzy Hash: 9133f93aca3ca78d232ba36a9b18439ec35bd39241411b6fd32966424d1c060e
Instruction Fuzzy Hash: BCD1803261A78287E660DB19E4423AEB7A0FB887D4F145135EB8D83B55DF3CE452CB05

Function 00007FF8B8AFAEB0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 163COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF8B8AFAEDA

Strings

MZx, xrefs: 00007FF8B8AFAF41
csm, xrefs: 00007FF8B8AFAEFF
csm, xrefs: 00007FF8B8AFB06E

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: __except_validate_context_record
String ID: MZx$csm$csm
API String ID: 1467352782-1981104119
Opcode ID: a2295d34955f7ca236f04041284ca676121d682cba17de3d44b96e6d02cb8573
Instruction ID: 564f4dac3a1ef3edb03167229ecc4d3a74bd0976dda687cef9ddb3baa8d101d0
Opcode Fuzzy Hash: a2295d34955f7ca236f04041284ca676121d682cba17de3d44b96e6d02cb8573
Instruction Fuzzy Hash: 3971C47290A68187D7608B29D4413B9BBA0FB14BC8F14A135EF9C87A95DF3CD553C70A

Function 00007FF8B8AFBBEC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF8B8AFBC38
_CallSETranslator.LIBVCRUNTIME ref: 00007FF8B8AFBC87

Strings

MOC, xrefs: 00007FF8B8AFBC4C
RCC, xrefs: 00007FF8B8AFBC55

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 42687e3d1100b011887a12009ff3a809648b07e6228d4cc44f16b6b0bd5354d7
Instruction ID: b9e03652bb7a82a09c854d65548b307061efc504305aa0845be73282b759008d
Opcode Fuzzy Hash: 42687e3d1100b011887a12009ff3a809648b07e6228d4cc44f16b6b0bd5354d7
Instruction Fuzzy Hash: 9E615736A09A458BE7208F69D4813AD77B0FB58BC8F045225EF4D57B99DF38E086C706

Function 00007FF8B8AFA408 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF8B8AFACA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF8B8AFAD88

Strings

csm, xrefs: 00007FF8B8AFACC2
csm, xrefs: 00007FF8B8AFADDA

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b5980138f849587dad554ab92783b79ebd463b2c9fb81ddb97acaa4b4d40086e
Instruction ID: 2563edbadad0baa166c83d83b3b8fa788c30e67c19e3e6a61a3f1dd03eb5d4ae
Opcode Fuzzy Hash: b5980138f849587dad554ab92783b79ebd463b2c9fb81ddb97acaa4b4d40086e
Instruction Fuzzy Hash: C1519D329096828BEB648B19D4413AC77A0EB54BC9F146135DB8DC7BD5DF3CF4528B0A

Function 00007FF8B8AF299A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

OutputDebugStringA.KERNEL32 ref: 00007FF8B8AF29DE
OutputDebugStringW.KERNEL32 ref: 00007FF8B8AF29EB
OutputDebugStringA.KERNEL32 ref: 00007FF8B8AF29F8

Strings

WebView2: skipped an incompatible version , xrefs: 00007FF8B8AF29D0

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: DebugOutputString
String ID: WebView2: skipped an incompatible version
API String ID: 1166629820-36545633
Opcode ID: 97675f0e7bb654c8d4c2fc3f04626001e57ddefb56621b28e7ed2025743026ea
Instruction ID: 47120f29216a1cca7a4fecfe76741fdb7de0d733412e1d0fafac61311c2d4a51
Opcode Fuzzy Hash: 97675f0e7bb654c8d4c2fc3f04626001e57ddefb56621b28e7ed2025743026ea
Instruction Fuzzy Hash: E4F03015F1A55782FB05AB6EB8964BC26509F94BD1F805431CB4E973B0DF2CA8878709

Function 00007FF8B8B01E50 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF8B8B02263), ref: 00007FF8B8B01F6C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00007FF8B8B02263), ref: 00007FF8B8B01FF7

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 544f8e17765803190d2aa4dc9a4e5f23fe25dd2c3f8c18e84572b08ce2f64b7a
Instruction ID: 5711b0b52cc9e871c320a6b581564579257d08853d32ca8f78bd53f04b0cb72f
Opcode Fuzzy Hash: 544f8e17765803190d2aa4dc9a4e5f23fe25dd2c3f8c18e84572b08ce2f64b7a
Instruction Fuzzy Hash: A491C022E1865285FB569F7994806BD3BA1BB44BC8F24413ADF0E667A5DF3CD44BC308

Function 00007FF8B8AF12EE Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00007FF8B8AF1326
GetLastError.KERNEL32 ref: 00007FF8B8AF133E
GetModuleFileNameW.KERNEL32 ref: 00007FF8B8AF1372
GetLastError.KERNEL32 ref: 00007FF8B8AF139C

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID:
API String ID: 2776309574-0
Opcode ID: 454abedea7facc2ac7131f75dbf287d56b635748bba10234a62b0f65f887e40a
Instruction ID: 5658d4325d0328b605fc75fa73ee53c757a1dfba23d75a7a34eedff69f4654fc
Opcode Fuzzy Hash: 454abedea7facc2ac7131f75dbf287d56b635748bba10234a62b0f65f887e40a
Instruction Fuzzy Hash: F7113610B0E61243FE99B23B19A26FD56815F89FD0F00A534DE4ECAB96DF2CE543030A

Function 00007FF8B8AFF3FC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 180COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8B8AFF434

Part of subcall function 00007FF8B8AFE600: IsProcessorFeaturePresent.KERNEL32 ref: 00007FF8B8AFE609
Part of subcall function 00007FF8B8AFE600: GetCurrentProcess.KERNEL32 ref: 00007FF8B8AFE62E

Strings

C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe, xrefs: 00007FF8B8AFF40A
*?, xrefs: 00007FF8B8AFF45F

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: *?$C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe
API String ID: 4036615347-3647641450
Opcode ID: 5500192f907ac5c1c8fb367c67d01c3fb1ae65f1c81111a639632851173e77a3
Instruction ID: 49a79166300fec986de4d1c01a830eda5dcb6ef90ac46f06d3ea0b116158bc19
Opcode Fuzzy Hash: 5500192f907ac5c1c8fb367c67d01c3fb1ae65f1c81111a639632851173e77a3
Instruction Fuzzy Hash: 7D51E162F0A65642FF609B6D99022BC2791AF44BE4F046535DF0D9BB99DF3CE443830A

Function 00007FF8B8B02910 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF8B8B02A27
GetLastError.KERNEL32 ref: 00007FF8B8B02A49

Strings

U, xrefs: 00007FF8B8B029D3

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 058d6a17e05cc4c83af5ae2f7826b75b97673fe6e1f03e7fcb563531599a65cb
Instruction ID: 935077c349d535f89bc43c3f315d653200d2537c438464289757e82703c761db
Opcode Fuzzy Hash: 058d6a17e05cc4c83af5ae2f7826b75b97673fe6e1f03e7fcb563531599a65cb
Instruction Fuzzy Hash: DB41B222B18A4282DB219F69E4447AA77A0FB887D4F844031EF4D977A8DF7CD446C744

Function 00007FF8B8AF53E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF8B8AF467F), ref: 00007FF8B8AF5424
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF8B8AF467F), ref: 00007FF8B8AF546A

Strings

csm, xrefs: 00007FF8B8AF5457

Memory Dump Source

Source File: 00000008.00000002.3453129405.00007FF8B8AF1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF8B8AF0000, based on PE: true

Associated: 00000008.00000002.3452905134.00007FF8B8AF0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453424429.00007FF8B8B06000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453614172.00007FF8B8B12000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B14000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3453864174.00007FF8B8B17000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000008.00000002.3454308251.00007FF8B8B1B000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8b8af0000_PanGPA.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 880bb48619a1b1b57b1c403762ed32f9f4ee9c24b735ea80e0cf671cc1f59f26
Instruction ID: 9cfd9451855bba23778aa8b0de6828d23f2889d87d0a5518989e106823a6b6f4
Opcode Fuzzy Hash: 880bb48619a1b1b57b1c403762ed32f9f4ee9c24b735ea80e0cf671cc1f59f26
Instruction Fuzzy Hash: 49115E32A19B8182EB218F29F440269B7A5FB88BD5F584234DF8D07B68DF3CD552CB04

Analysis Process: PanGPS.exePID: 6308, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	6.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	31

Executed Functions

Function 00007FF8B7DFBDB8 Relevance: 105.5, APIs: 47, Strings: 13, Instructions: 523
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFBE29
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFBE72
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFBE61

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFBEA5
SetupDiClassGuidsFromNameExW.SETUPAPI ref: 00007FF8B7DFBF0A
SetupDiGetClassDevsExW.SETUPAPI ref: 00007FF8B7DFBF36
SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF8B7DFBF58
SetupDiEnumDeviceInfo.SETUPAPI ref: 00007FF8B7DFBF7F
CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF8B7DFBFC0
wcsstr.LIBVCRUNTIME ref: 00007FF8B7DFBFE0
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFC00B
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFC04F
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFC060
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFC09F
CM_Get_DevNode_Status_Ex.SETUPAPI ref: 00007FF8B7DFC0D6
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFC103
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFC14F
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFC160
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFC24B
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFC287
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFC298

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DFBBB4, 00007FF8B7DFBC9E, 00007FF8B7DFBCF9, 00007FF8B7DFBE5A, 00007FF8B7DFBE9E, 00007FF8B7DFC048, 00007FF8B7DFC098, 00007FF8B7DFC148, 00007FF8B7DFC1A7, 00007FF8B7DFC280, 00007FF8B7DFC2CF, 00007FF8B7DFC350, 00007FF8B7DFC3A2, 00007FF8B7DFC406, 00007FF8B7DFC442, 00007FF8B7DFC4F9, 00007FF8B7DFC5BD, 00007FF8B7DFC60C, 00007FF8B7DFC622
[%s %4d]: Searching: Valid device id is %s., xrefs: 00007FF8B7DFC5B0, 00007FF8B7DFC5FF
[%s %4d]: Searching: Valid inf file is %s., xrefs: 00007FF8B7DFC921, 00007FF8B7DFC970
[%s %4d]: Searching: Invalid DevNode Status: removed., xrefs: 00007FF8B7DFC47A, 00007FF8B7DFC48E
Net, xrefs: 00007FF8B7DFBF03
[%s %4d]: Searching: Valid instance id is %s., xrefs: 00007FF8B7DFC779, 00007FF8B7DFC85D
[%s %4d]: Searching: Get DevNode Status failed, %d., xrefs: 00007FF8B7DFC4EC, 00007FF8B7DFC53F
[%s %4d]: Searching: Enable Adapter success, count %d., xrefs: 00007FF8B7DFC273, 00007FF8B7DFC2C2
[%s %4d]: Searching: find device %s., xrefs: 00007FF8B7DFC03B, 00007FF8B7DFC08B
[%s %4d]: Searching: Valid MTU is %u., xrefs: 00007FF8B7DFC691, 00007FF8B7DFC6DE
\PANGPD\, xrefs: 00007FF8B7DFBFD2
[%s %4d]: Searching: DevNode Status 0x%x, Problem 0x%x, count %d., xrefs: 00007FF8B7DFC13B, 00007FF8B7DFC19A
[%s %4d]: Searching valid GP adapter., xrefs: 00007FF8B7DFBE4D, 00007FF8B7DFBE91

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$EnterLeaveSetup$ClassCurrentDeviceGet_Info$ByteCharDetailDevice_DevsEnumErrorFromGuidsLastListLocalMultiNameNode_ProcessReleaseSemaphoreStatus_ThreadTimeWidewcsstr
String ID: Net$[%s %4d]: Searching valid GP adapter.$[%s %4d]: Searching: DevNode Status 0x%x, Problem 0x%x, count %d.$[%s %4d]: Searching: Enable Adapter success, count %d.$[%s %4d]: Searching: Get DevNode Status failed, %d.$[%s %4d]: Searching: Invalid DevNode Status: removed.$[%s %4d]: Searching: Valid MTU is %u.$[%s %4d]: Searching: Valid device id is %s.$[%s %4d]: Searching: Valid inf file is %s.$[%s %4d]: Searching: Valid instance id is %s.$[%s %4d]: Searching: find device %s.$[Info 469]: Set debug level as 4$\PANGPD\
API String ID: 412789879-661624258
Opcode ID: 5b6b1272bc2263d50caf73dfa427d12617772585eb971e971be458340730323e
Instruction ID: c40c1fb2346347e86247719892fe1d0e855d590d00d3cbb4eb3d7f1648267122
Opcode Fuzzy Hash: 5b6b1272bc2263d50caf73dfa427d12617772585eb971e971be458340730323e
Instruction Fuzzy Hash: 22521561A18B8286EB21DB18E8405BD73A5FF45BD4F840236DB5D1BAB8DF3CE259C700

Function 00007FF8B7DFD154 Relevance: 105.5, APIs: 45, Strings: 15, Instructions: 511
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetupDiClassGuidsFromNameExW.SETUPAPI ref: 00007FF8B7DFD1B5
SetupDiGetClassDevsExW.SETUPAPI ref: 00007FF8B7DFD1E1
SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF8B7DFD204
SetupDiEnumDeviceInfo.SETUPAPI ref: 00007FF8B7DFD22B
CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF8B7DFD274
wcsstr.LIBVCRUNTIME ref: 00007FF8B7DFD293
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFD2BE
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFD305
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFD316
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFD358
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFD3B5
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFD426
CM_Get_DevNode_Status_Ex.SETUPAPI ref: 00007FF8B7DFD45D
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFD48A
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFD4E6
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFD4D5

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFD533
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFD596
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFD5D9
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFD5EA
SetupDiEnumDeviceInfo.SETUPAPI ref: 00007FF8B7DFD607
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFD64E
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFD689
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFD6C8
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFD6EF
GetLastError.KERNEL32 ref: 00007FF8B7DFD6FF
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFD73E
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFD74F
GetLastError.KERNEL32 ref: 00007FF8B7DFD75A
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFD7DA
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFD81F
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFD830
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFD96B
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFD9CB
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFDB2C
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFDB3D
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFD877

Part of subcall function 00007FF8B7DF2990: GetLocalTime.KERNEL32 ref: 00007FF8B7DF29D4
Part of subcall function 00007FF8B7DF2990: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF2A1F
Part of subcall function 00007FF8B7DF2990: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF2A27
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2A78
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2AAA
Part of subcall function 00007FF8B7DF2990: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF2AE8
Part of subcall function 00007FF8B7DF2990: GetLastError.KERNEL32 ref: 00007FF8B7DF2AF4
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2B12
Part of subcall function 00007FF8B7DF2990: GetModuleFileNameW.KERNEL32 ref: 00007FF8B7DF2B5D

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFD8D2
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFD915
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFD926
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 00007FF8B7DFDB95

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DFD2E8, 00007FF8B7DFD33F, 00007FF8B7DFD41F, 00007FF8B7DFD49F, 00007FF8B7DFD51F, 00007FF8B7DFD5AB, 00007FF8B7DFD66A, 00007FF8B7DFD6B3, 00007FF8B7DFD737, 00007FF8B7DFD804, 00007FF8B7DFD86B, 00007FF8B7DFD8E6, 00007FF8B7DFD95F, 00007FF8B7DFDB25, 00007FF8B7DFDB6B
[%s %4d]: invalid device id (valid is %s)., xrefs: 00007FF8B7DFD3D1, 00007FF8B7DFD3F8
[%s %4d]: Invalid DevNode Status: problem 0x%x., xrefs: 00007FF8B7DFD5A0, 00007FF8B7DFD62D
[%s %4d]: Enable Adapter success., xrefs: 00007FF8B7DFDAAB, 00007FF8B7DFDACE
[%s %4d]: DevNode Status 0x%x, Problem 0x%x., xrefs: 00007FF8B7DFD494, 00007FF8B7DFD4F2
[%s %4d]: Retrive MTU %u., xrefs: 00007FF8B7DFD8DB, 00007FF8B7DFD931
[%s %4d]: Get DevNode Status failed, %d., xrefs: 00007FF8B7DFD716, 00007FF8B7DFD771
[%s %4d]: Disable Adapter failed., xrefs: 00007FF8B7DFDA2D, 00007FF8B7DFDA49
Net, xrefs: 00007FF8B7DFD1AE
[%s %4d]: Invalid DevNode Status: removed., xrefs: 00007FF8B7DFD65B, 00007FF8B7DFD6A8
\PANGPD\, xrefs: 00007FF8B7DFD285
[%s %4d]: enum devevice %s., xrefs: 00007FF8B7DFD2DA, 00007FF8B7DFD330
[%s %4d]: Disable Adapter success., xrefs: 00007FF8B7DFD9D8, 00007FF8B7DFD9FE
[%s %4d]: Enable Adapter failed., xrefs: 00007FF8B7DFDAFA, 00007FF8B7DFDB4D
[%s %4d]: Valid device id is %s., xrefs: 00007FF8B7DFD7F6, 00007FF8B7DFD84A

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$Enter$Leave$Setup$CurrentDeviceErrorInfoLast$ByteCharClassEnumGet_ListLocalMultiNameProcessThreadTimeWide$DestroyDetailDevice_DevsFileFromGuidsModuleNode_ReleaseSemaphoreStatus_wcsstr
String ID: Net$[%s %4d]: DevNode Status 0x%x, Problem 0x%x.$[%s %4d]: Disable Adapter failed.$[%s %4d]: Disable Adapter success.$[%s %4d]: Enable Adapter failed.$[%s %4d]: Enable Adapter success.$[%s %4d]: Get DevNode Status failed, %d.$[%s %4d]: Invalid DevNode Status: problem 0x%x.$[%s %4d]: Invalid DevNode Status: removed.$[%s %4d]: Retrive MTU %u.$[%s %4d]: Valid device id is %s.$[%s %4d]: enum devevice %s.$[%s %4d]: invalid device id (valid is %s).$[Info 469]: Set debug level as 4$\PANGPD\
API String ID: 3058880666-1499210327
Opcode ID: 880c3b99e5220d7016fd364fd05b67a840c6d9b9bec155775e6865b0e354cfe7
Instruction ID: ea7791545a954b9d8c5964cee45b80618029b1964d1bc474c8a700a11e297230
Opcode Fuzzy Hash: 880c3b99e5220d7016fd364fd05b67a840c6d9b9bec155775e6865b0e354cfe7
Instruction Fuzzy Hash: 0B52E771908B8696EB21DF18E8505AD77A0BF45BE8F940335DB6D06AB8DF3CE548D700

Function 00007FF8B7DF1250 Relevance: 98.5, APIs: 43, Strings: 13, Instructions: 475
sleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FF8B7DF128E
CreateEventW.KERNEL32 ref: 00007FF8B7DF12A8
CreateEventW.KERNEL32 ref: 00007FF8B7DF12BC
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF1313
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF1365
GetLastError.KERNEL32 ref: 00007FF8B7DF16DC
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF1819
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF1859
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF186A
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF18A5
Sleep.KERNEL32 ref: 00007FF8B7DF18B4
SetFilePointer.KERNEL32 ref: 00007FF8B7DF1911

Part of subcall function 00007FF8B7DF3AAC: GetLastError.KERNEL32 ref: 00007FF8B7DF3AB0

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF196D
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF19AE
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF19BF
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF19FB
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF1711

Part of subcall function 00007FF8B7DF2990: GetLocalTime.KERNEL32 ref: 00007FF8B7DF29D4
Part of subcall function 00007FF8B7DF2990: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF2A1F
Part of subcall function 00007FF8B7DF2990: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF2A27
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2A78
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2AAA
Part of subcall function 00007FF8B7DF2990: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF2AE8
Part of subcall function 00007FF8B7DF2990: GetLastError.KERNEL32 ref: 00007FF8B7DF2AF4
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2B12
Part of subcall function 00007FF8B7DF2990: GetModuleFileNameW.KERNEL32 ref: 00007FF8B7DF2B5D

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF1354

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF13AE
RegQueryValueExW.ADVAPI32 ref: 00007FF8B7DF13EE
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF1426
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF1489
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF14E1
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF14F2
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF1547
CreateSemaphoreW.KERNEL32 ref: 00007FF8B7DF157A
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF15AA
GetLastError.KERNEL32 ref: 00007FF8B7DF15B7
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF15ED
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF15FE
GetLastError.KERNEL32 ref: 00007FF8B7DF1606
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF163B
GetModuleFileNameW.KERNEL32 ref: 00007FF8B7DF1656
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF1681
GetLastError.KERNEL32 ref: 00007FF8B7DF168E
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF16C3
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF16D4
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF1A29
GetLastError.KERNEL32 ref: 00007FF8B7DF1A36
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF1A78
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF1A89
GetLastError.KERNEL32 ref: 00007FF8B7DF1A91
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF1AD3

Part of subcall function 00007FF8B7DF390C: GetModuleHandleW.KERNEL32 ref: 00007FF8B7DF3941
Part of subcall function 00007FF8B7DF390C: GetProcAddress.KERNEL32 ref: 00007FF8B7DF3956
Part of subcall function 00007FF8B7DF390C: RegCloseKey.ADVAPI32 ref: 00007FF8B7DF39D0

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF134D, 00007FF8B7DF13A7, 00007FF8B7DF14DA, 00007FF8B7DF1540, 00007FF8B7DF15E6, 00007FF8B7DF1634, 00007FF8B7DF16BC, 00007FF8B7DF170A, 00007FF8B7DF1852, 00007FF8B7DF189E, 00007FF8B7DF19A7, 00007FF8B7DF19F4, 00007FF8B7DF1A71, 00007FF8B7DF1ACC
DebugLevel, xrefs: 00007FF8B7DF13E3
[%s %4d]: Load driver debug log level %s., xrefs: 00007FF8B7DF14CD, 00007FF8B7DF1533
[%s %4d]: Cannot read debug log level: %d!!!!, xrefs: 00007FF8B7DF1438, 00007FF8B7DF1450
;, xrefs: 00007FF8B7DF1AA8
[%s %4d]: GetModuleFileName fails with error %d!!!!, xrefs: 00007FF8B7DF16AF, 00007FF8B7DF16FD
[%s %4d]: GetModuleFileName fails with name %s!!!!, xrefs: 00007FF8B7DF199A, 00007FF8B7DF19E7
debug_drv.log, xrefs: 00007FF8B7DF17CB
[%s %4d]: Create event fails with error %d!!!!, xrefs: 00007FF8B7DF1A5E, 00007FF8B7DF1AB9
[%s %4d]: Cannot open config reg log key: %d!!!!, xrefs: 00007FF8B7DF1325, 00007FF8B7DF137C
[%s %4d]: Create log file fails with error %d!, xrefs: 00007FF8B7DF1845, 00007FF8B7DF1891
SOFTWARE\Palo Alto Networks\GlobalProtect\DrvCtrl, xrefs: 00007FF8B7DF12DC
[%s %4d]: Create log semaphore with error %d!!!!, xrefs: 00007FF8B7DF15D9, 00007FF8B7DF1627

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$ErrorLast$Enter$Leave$Current$CreateFileModule$ByteCharEventLocalMultiNameProcessSemaphoreThreadTimeWide$AddressCloseHandleInitializePointerProcQueryReleaseSleepValue
String ID: ;$DebugLevel$SOFTWARE\Palo Alto Networks\GlobalProtect\DrvCtrl$[%s %4d]: Cannot open config reg log key: %d!!!!$[%s %4d]: Cannot read debug log level: %d!!!!$[%s %4d]: Create event fails with error %d!!!!$[%s %4d]: Create log file fails with error %d!$[%s %4d]: Create log semaphore with error %d!!!!$[%s %4d]: GetModuleFileName fails with error %d!!!!$[%s %4d]: GetModuleFileName fails with name %s!!!!$[%s %4d]: Load driver debug log level %s.$[Info 469]: Set debug level as 4$debug_drv.log
API String ID: 2533304878-3645263054
Opcode ID: 0930def1bdf89990e80db767272fec9741fb0551b77656e9a910b8698fdf12f7
Instruction ID: df5eb4bb74fb04e308bb867775d5dc1dd8f1f26435a4b875f3e254670c3e8f9e
Opcode Fuzzy Hash: 0930def1bdf89990e80db767272fec9741fb0551b77656e9a910b8698fdf12f7
Instruction Fuzzy Hash: 19324871A18B4282EB10DB29E8456AE33A5FF44BE4F850235DB6D47AB8DF3DE548C700

Function 00007FF8B7DFBBB0 Relevance: 84.4, APIs: 38, Strings: 10, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetupDiGetDeviceRegistryPropertyW.SETUPAPI ref: 00007FF8B7DFBC2A
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFBC56
GetLastError.KERNEL32 ref: 00007FF8B7DFBC66
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFBCB6
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFC1AE
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFC09F

Part of subcall function 00007FF8B7DF2990: GetLocalTime.KERNEL32 ref: 00007FF8B7DF29D4
Part of subcall function 00007FF8B7DF2990: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF2A1F
Part of subcall function 00007FF8B7DF2990: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF2A27
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2A78
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2AAA
Part of subcall function 00007FF8B7DF2990: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF2AE8
Part of subcall function 00007FF8B7DF2990: GetLastError.KERNEL32 ref: 00007FF8B7DF2AF4
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2B12
Part of subcall function 00007FF8B7DF2990: GetModuleFileNameW.KERNEL32 ref: 00007FF8B7DF2B5D

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFBCA5

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

GetLastError.KERNEL32 ref: 00007FF8B7DFBCC1
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFBD00
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8B7DFBDB0
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFBE29
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFBE61
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFBE72
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFBEA5
SetupDiClassGuidsFromNameExW.SETUPAPI ref: 00007FF8B7DFBF0A
SetupDiGetClassDevsExW.SETUPAPI ref: 00007FF8B7DFBF36
SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF8B7DFBF58
SetupDiEnumDeviceInfo.SETUPAPI ref: 00007FF8B7DFBF7F
CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF8B7DFBFC0
wcsstr.LIBVCRUNTIME ref: 00007FF8B7DFBFE0
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFC00B
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFC04F
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFC060
CM_Get_DevNode_Status_Ex.SETUPAPI ref: 00007FF8B7DFC0D6
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFC103
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFC14F
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFC160

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DFBBB4, 00007FF8B7DFBC9E, 00007FF8B7DFBCF9, 00007FF8B7DFBE5A, 00007FF8B7DFBE9E, 00007FF8B7DFC048, 00007FF8B7DFC098, 00007FF8B7DFC148, 00007FF8B7DFC1A7, 00007FF8B7DFC280, 00007FF8B7DFC2CF, 00007FF8B7DFC350, 00007FF8B7DFC3A2, 00007FF8B7DFC406, 00007FF8B7DFC442
[%s %4d]: Searching: Enable Adapter success, count %d., xrefs: 00007FF8B7DFC273, 00007FF8B7DFC2C2
[%s %4d]: Searching: find device %s., xrefs: 00007FF8B7DFC03B, 00007FF8B7DFC08B
[%s %4d]: Searching: Enable Adapter failed., xrefs: 00007FF8B7DFC3E3, 00007FF8B7DFC41F
[%s %4d]: Searching: Invalid DevNode Status: problem 0x%x., xrefs: 00007FF8B7DFC343, 00007FF8B7DFC390
\PANGPD\, xrefs: 00007FF8B7DFBFD2
[%s %4d]: Searching: DevNode Status 0x%x, Problem 0x%x, count %d., xrefs: 00007FF8B7DFC13B, 00007FF8B7DFC19A
Net, xrefs: 00007FF8B7DFBF03
[%s %4d]: Searching valid GP adapter., xrefs: 00007FF8B7DFBE4D, 00007FF8B7DFBE91
[%s %4d]: SetupDiGetDeviceRegistryPropertyW failed, %d., xrefs: 00007FF8B7DFBC8E, 00007FF8B7DFBCE9

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$Setup$CurrentEnterErrorLastLeave$Device$ByteCharClassGet_InfoLocalMultiNameProcessThreadTimeWide$DetailDevice_DevsEnumFileFromGuidsListModuleNode_PropertyRegistryReleaseSemaphoreStatus__invalid_parameter_noinfo_noreturnwcsstr
String ID: Net$[%s %4d]: Searching valid GP adapter.$[%s %4d]: Searching: DevNode Status 0x%x, Problem 0x%x, count %d.$[%s %4d]: Searching: Enable Adapter failed.$[%s %4d]: Searching: Enable Adapter success, count %d.$[%s %4d]: Searching: Invalid DevNode Status: problem 0x%x.$[%s %4d]: Searching: find device %s.$[%s %4d]: SetupDiGetDeviceRegistryPropertyW failed, %d.$[Info 469]: Set debug level as 4$\PANGPD\
API String ID: 495917529-3703803183
Opcode ID: 80e039b12ae921761703899756246c9ba713bb8c7357ace2ba84876999cf6564
Instruction ID: 118b8ef7711e3ce92ad811252b38ddc3d24f02b58234e1f04594c0556d1bacaa
Opcode Fuzzy Hash: 80e039b12ae921761703899756246c9ba713bb8c7357ace2ba84876999cf6564
Instruction Fuzzy Hash: 92324D71A18B4286E721DB18E8446AD77A0FF94BD4F840236DB5D57AB8DF3CE658CB00

Function 00007FF8B7DF90F0 Relevance: 77.4, APIs: 32, Strings: 12, Instructions: 423
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8B7E039A0: EnterCriticalSection.KERNEL32 ref: 00007FF8B7E039D9
Part of subcall function 00007FF8B7E039A0: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E03A1C
Part of subcall function 00007FF8B7E039A0: LeaveCriticalSection.KERNEL32 ref: 00007FF8B7E03A2D

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF9184
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF91C7
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF929B
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF933D
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF9375
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF9382
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8B7DF98B3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8B7DF98B9

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF919D, 00007FF8B7DF91E3, 00007FF8B7DF9274, 00007FF8B7DF92ED, 00007FF8B7DF9359, 00007FF8B7DF939F, 00007FF8B7DF9471, 00007FF8B7DF94C4, 00007FF8B7DF95B9, 00007FF8B7DF969F, 00007FF8B7DF97E9, 00007FF8B7DF982F
TunnelPerfDebugFlag, xrefs: 00007FF8B7DF9404
[%s %4d]: Get dirver file version fails with error %d!, xrefs: 00007FF8B7DF9191, 00007FF8B7DF91D7
[%s %4d]: enable perf debug., xrefs: 00007FF8B7DF9462, 00007FF8B7DF94B3
SOFTWARE\Palo Alto Networks\GlobalProtect\PanGPS, xrefs: 00007FF8B7DF93DB
PSV: Cannot create CDebugLog!, xrefs: 00007FF8B7DF9770
[%s %4d]: GlobalProtect requires minimum driver version 6.0.0.2., xrefs: 00007FF8B7DF934A, 00007FF8B7DF9390
[%s %4d]: Out of memory!!!!, xrefs: 00007FF8B7DF97DA, 00007FF8B7DF9820
[%s %4d]: Driver file version is %d.%d.%d.%d., xrefs: 00007FF8B7DF9239, 00007FF8B7DF92D1
PSV: Cannot create event!, xrefs: 00007FF8B7DF9745
[%s %4d]: Init get valid adapter info: %u-%s-%s-%s., xrefs: 00007FF8B7DF958D, 00007FF8B7DF9673
e, xrefs: 00007FF8B7DF9397

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: CriticalSection$EnterLeave_snwprintf_s$_invalid_parameter_noinfo_noreturn
String ID: PSV: Cannot create CDebugLog!$PSV: Cannot create event!$SOFTWARE\Palo Alto Networks\GlobalProtect\PanGPS$TunnelPerfDebugFlag$[%s %4d]: Driver file version is %d.%d.%d.%d.$[%s %4d]: Get dirver file version fails with error %d!$[%s %4d]: GlobalProtect requires minimum driver version 6.0.0.2.$[%s %4d]: Init get valid adapter info: %u-%s-%s-%s.$[%s %4d]: Out of memory!!!!$[%s %4d]: enable perf debug.$[Info 469]: Set debug level as 4$e
API String ID: 1922009084-313889016
Opcode ID: c2b6dcd361523a98a3e2584b4b40689e6991328d2abb6245bf19c62533293399
Instruction ID: d9c6752902e69b13e9c720fbe43888aa39e6839d4140b64be974e2f562270b5c
Opcode Fuzzy Hash: c2b6dcd361523a98a3e2584b4b40689e6991328d2abb6245bf19c62533293399
Instruction Fuzzy Hash: FF222671A08B4286EB10DB29E8556BD33A0BF45BD8F450236DB4D5BAB9DF3CE245D700

Function 00007FF8B7DFA250 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 298
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8B7DF3794: GetProcessHeap.KERNEL32 ref: 00007FF8B7DF37E2
Part of subcall function 00007FF8B7DF3794: _Init_thread_footer.LIBCMT ref: 00007FF8B7DF3817
Part of subcall function 00007FF8B7DF3794: _Init_thread_footer.LIBCMT ref: 00007FF8B7DF3890

GetModuleFileNameW.KERNEL32 ref: 00007FF8B7DFA2FB
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFA32D
GetLastError.KERNEL32 ref: 00007FF8B7DFA339
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFA387
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFA5EC
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFA625
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFA636
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFA675
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFA376

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

GetLastError.KERNEL32 ref: 00007FF8B7DFA38F
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFA3CB
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFA504
GetLastError.KERNEL32 ref: 00007FF8B7DFA510
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFA54C
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFA55D
GetLastError.KERNEL32 ref: 00007FF8B7DFA565
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFA5A1
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFA6AE
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFA6E4
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFA6F5
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFA731

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DFA360, 00007FF8B7DFA3BF, 00007FF8B7DFA540, 00007FF8B7DFA595, 00007FF8B7DFA605, 00007FF8B7DFA65F, 00007FF8B7DFA6CA, 00007FF8B7DFA71C
[%s %4d]: GetModuleFileName fails with error %d!, xrefs: 00007FF8B7DFA351, 00007FF8B7DFA3A6
[%s %4d]: Get driver file version but input parameter is NULL!, xrefs: 00007FF8B7DFA6BB, 00007FF8B7DFA712
[%s %4d]: GetFileVersion fails with error %d!, xrefs: 00007FF8B7DFA527, 00007FF8B7DFA57C
[%s %4d]: GetModuleFileName fails with name %s!, xrefs: 00007FF8B7DFA5F9, 00007FF8B7DFA650

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$ErrorLast$EnterLeave$CurrentInit_thread_footerProcess$ByteCharFileHeapLocalModuleMultiNameReleaseSemaphoreThreadTimeWide
String ID: [%s %4d]: Get driver file version but input parameter is NULL!$[%s %4d]: GetFileVersion fails with error %d!$[%s %4d]: GetModuleFileName fails with error %d!$[%s %4d]: GetModuleFileName fails with name %s!$[Info 469]: Set debug level as 4
API String ID: 3015315395-757298875
Opcode ID: 773d1669ac9589be55ca34a1ae85e88c62c9f1c9cbe83481e025c0d9d69b1af6
Instruction ID: 4f105bdb0761d75f93bcc38a264828532ac8169c94ae9f0fcd9251b7e40a35cb
Opcode Fuzzy Hash: 773d1669ac9589be55ca34a1ae85e88c62c9f1c9cbe83481e025c0d9d69b1af6
Instruction Fuzzy Hash: 70E13772A08B4682EA10DB28E8406AD7360FF85BE4F450236DB5D1BBB8DF3CE645C740

Function 00007FF8B7DFE230 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 224
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,00007FF8B7DF9719), ref: 00007FF8B7DFE288
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFE2D1
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFE506
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFE542
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFE553
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFE591
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFE2C0

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFE304
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFE384
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFE3C0
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFE3D1
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFE40F
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFE453
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFE48B
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFE49C
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFE4D9
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,00007FF8B7DF9719), ref: 00007FF8B7DFE5E6
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFE61E
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFE62F
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFE669

Strings

[%s %4d]: after disable adapter, get adapter status 0x%x, xrefs: 00007FF8B7DFE391, 00007FF8B7DFE3EA
[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DFE2A4, 00007FF8B7DFE2F8, 00007FF8B7DFE39C, 00007FF8B7DFE403, 00007FF8B7DFE46F, 00007FF8B7DFE4CD, 00007FF8B7DFE51E, 00007FF8B7DFE585, 00007FF8B7DFE602, 00007FF8B7DFE65D
[%s %4d]: Disable adapter be called., xrefs: 00007FF8B7DFE295, 00007FF8B7DFE2DF
[%s %4d]: Disable adapter end., xrefs: 00007FF8B7DFE5F3, 00007FF8B7DFE64C
[%s %4d]: after disable adapter, check adapter status failed, %d., xrefs: 00007FF8B7DFE513, 00007FF8B7DFE56C
[%s %4d]: !!!adapter status has improper flag be set!!!3rd party SW may manipulate it., xrefs: 00007FF8B7DFE460, 00007FF8B7DFE4BC

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$EnterLeave$Current$ByteCharErrorLastLocalMultiProcessReleaseSemaphoreThreadTimeWide
String ID: [%s %4d]: !!!adapter status has improper flag be set!!!3rd party SW may manipulate it.$[%s %4d]: Disable adapter be called.$[%s %4d]: Disable adapter end.$[%s %4d]: after disable adapter, check adapter status failed, %d.$[%s %4d]: after disable adapter, get adapter status 0x%x$[Info 469]: Set debug level as 4
API String ID: 3889596832-3911583514
Opcode ID: d487d79b7135ba9dec06cb526946fe181110dab6799abd67102d48c4437b93ec
Instruction ID: 6e99837847b1f431ca05b2ea3af6385e6c66cf4600cd95c6737ff51a92002e2c
Opcode Fuzzy Hash: d487d79b7135ba9dec06cb526946fe181110dab6799abd67102d48c4437b93ec
Instruction Fuzzy Hash: BAC10361908B4786EB21DB18E8446BD77A0BF44BD8F850639DB4D4B6B9DF3CE248DB04

Function 00007FF8B7DFA7C0 Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION ref: 00007FF8B7DFA7E1
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFA818
GetLastError.KERNEL32 ref: 00007FF8B7DFA828
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFA866
GetLastError.KERNEL32 ref: 00007FF8B7DFA870
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFA8AE
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFA8E8
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFA922
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFA933
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFA972
GetFileVersionInfoW.VERSION ref: 00007FF8B7DFA991
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFA9C1
GetLastError.KERNEL32 ref: 00007FF8B7DFA9D1
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFAA0F
GetLastError.KERNEL32 ref: 00007FF8B7DFAA19
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFAA57
VerQueryValueW.VERSION ref: 00007FF8B7DFAA78
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFAAA4
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFAADE
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFAAEF
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFAB2B

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DFA84E, 00007FF8B7DFA8A2, 00007FF8B7DFA904, 00007FF8B7DFA96B, 00007FF8B7DFAA03, 00007FF8B7DFAA4B, 00007FF8B7DFAAC0, 00007FF8B7DFAB18
[%s %4d]: VerQueryValue returns no value!, xrefs: 00007FF8B7DFAAB1, 00007FF8B7DFAB0C
[%s %4d]: GetFileVersionInfo fails with error %d!, xrefs: 00007FF8B7DFA9E8, 00007FF8B7DFAA30
[%s %4d]: Out of Memory!, xrefs: 00007FF8B7DFA8F5, 00007FF8B7DFA953
[%s %4d]: GetFileVersionInfoSize return %d!, xrefs: 00007FF8B7DFA83F, 00007FF8B7DFA887

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$EnterErrorLast$FileInfoLeaveVersion$QuerySizeValue
String ID: [%s %4d]: GetFileVersionInfo fails with error %d!$[%s %4d]: GetFileVersionInfoSize return %d!$[%s %4d]: Out of Memory!$[%s %4d]: VerQueryValue returns no value!$[Info 469]: Set debug level as 4
API String ID: 3186528593-3179374649
Opcode ID: 1688e75de468ebc08927e722380a9f9de3cb64de4805c9c44c2e58ffe7569959
Instruction ID: 56573022ebb351b57477fb7461e035f4199e77bfbf908476b18902f3a5798ffb
Opcode Fuzzy Hash: 1688e75de468ebc08927e722380a9f9de3cb64de4805c9c44c2e58ffe7569959
Instruction Fuzzy Hash: ECA1067190CB4286EB10CB18E8442AD77A1BF85BD4F950236DB5D47AB8DF7CE249C701

Function 00007FF8B7E012E8 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetupDiClassGuidsFromNameExW.SETUPAPI ref: 00007FF8B7E0134A
SetupDiGetClassDevsExW.SETUPAPI ref: 00007FF8B7E01376
SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF8B7E0139C
SetupDiEnumDeviceInfo.SETUPAPI ref: 00007FF8B7E013C7
CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF8B7E013FA
wcsstr.LIBVCRUNTIME ref: 00007FF8B7E0141A
EnterCriticalSection.KERNEL32 ref: 00007FF8B7E01444
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E01486
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7E01497
SetupDiEnumDeviceInfo.SETUPAPI ref: 00007FF8B7E01510
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 00007FF8B7E01524
EnterCriticalSection.KERNEL32 ref: 00007FF8B7E0154D
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E01583
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7E01594
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E015D0

Part of subcall function 00007FF8B7DF2990: GetLocalTime.KERNEL32 ref: 00007FF8B7DF29D4
Part of subcall function 00007FF8B7DF2990: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF2A1F
Part of subcall function 00007FF8B7DF2990: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF2A27
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2A78
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2AAA
Part of subcall function 00007FF8B7DF2990: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF2AE8
Part of subcall function 00007FF8B7DF2990: GetLastError.KERNEL32 ref: 00007FF8B7DF2AF4
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2B12
Part of subcall function 00007FF8B7DF2990: GetModuleFileNameW.KERNEL32 ref: 00007FF8B7DF2B5D

Strings

[%s %4d]: Found pangpd device %s, remove it now., xrefs: 00007FF8B7E0145C, 00007FF8B7E014B1
[Info 469]: Set debug level as 4, xrefs: 00007FF8B7E0146A, 00007FF8B7E014D3, 00007FF8B7E01569, 00007FF8B7E015C4
[%s %4d]: Search only., xrefs: 00007FF8B7E0155A, 00007FF8B7E015B1
\PANGPD\, xrefs: 00007FF8B7E0140C
Net, xrefs: 00007FF8B7E01343

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: Setup_snwprintf_s$CriticalDeviceInfoSection$ClassCurrentEnterEnumLeaveListName$ByteCharDestroyDetailDevice_DevsErrorFileFromGet_GuidsLastLocalModuleMultiProcessThreadTimeWidewcsstr
String ID: Net$[%s %4d]: Found pangpd device %s, remove it now.$[%s %4d]: Search only.$[Info 469]: Set debug level as 4$\PANGPD\
API String ID: 2420904514-1378270649
Opcode ID: f8b204046dd126bdc5c46bd1c920253f58bd11ba99e2f79d12e035e260246520
Instruction ID: efa29ea709de42609bf7bd6f70454bd9f8a11f0455c4b32c835f364a1636a7a7
Opcode Fuzzy Hash: f8b204046dd126bdc5c46bd1c920253f58bd11ba99e2f79d12e035e260246520
Instruction Fuzzy Hash: 1D810A71A08B8296EB61CB59E8416AE73A4FF48BD8F400135DB4D4BAB4DF3CE649C700

Function 00007FF8B7DF2990 Relevance: 30.0, APIs: 13, Strings: 4, Instructions: 269
filetimethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocalTime.KERNEL32 ref: 00007FF8B7DF29D4
GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF2A1F
GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF2A27
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2A78
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2AAA
WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF2AE8
GetLastError.KERNEL32 ref: 00007FF8B7DF2AF4
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2B12
GetModuleFileNameW.KERNEL32 ref: 00007FF8B7DF2B5D
CloseHandle.KERNEL32 ref: 00007FF8B7DF2CB2
SetFilePointer.KERNEL32 ref: 00007FF8B7DF2D06
WriteFile.KERNEL32 ref: 00007FF8B7DF2D33
CloseHandle.KERNEL32 ref: 00007FF8B7DF2D7A

Part of subcall function 00007FF8B7DF3AAC: GetLastError.KERNEL32 ref: 00007FF8B7DF3AB0

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF2A94
debug_drv.log, xrefs: 00007FF8B7DF2C4E
(P%u-T%u)%02d/%02d/%02d %02d:%02d:%02d:%03d, xrefs: 00007FF8B7DF2A59
Convert log to UTF8 fails with error %d, xrefs: 00007FF8B7DF2AFE

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: File_snwprintf_s$CloseCurrentErrorHandleLast$ByteCharLocalModuleMultiNamePointerProcessThreadTimeWideWrite
String ID: (P%u-T%u)%02d/%02d/%02d %02d:%02d:%02d:%03d$Convert log to UTF8 fails with error %d$[Info 469]: Set debug level as 4$debug_drv.log
API String ID: 6139919-72810891
Opcode ID: d22b79e758c130d0296fb721187d85f99748edd2d61c2d61661f963ed13ba4ed
Instruction ID: 4a060ef6766ce5192879d973b568cba751b1e54ba421b1e7cfec591e00b97219
Opcode Fuzzy Hash: d22b79e758c130d0296fb721187d85f99748edd2d61c2d61661f963ed13ba4ed
Instruction Fuzzy Hash: 19C16062A09B8682EB609F29D8416AE7361FB84BE0F444336DB6D477B8DF3CD545CB40

Function 00007FF8B7DF2640 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 188
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegNotifyChangeKeyValue.ADVAPI32 ref: 00007FF8B7DF269A
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF26C4
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF270E
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF26FD

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

WaitForMultipleObjects.KERNEL32 ref: 00007FF8B7DF276C
RegNotifyChangeKeyValue.ADVAPI32 ref: 00007FF8B7DF27A2
RegQueryValueExW.ADVAPI32 ref: 00007FF8B7DF27D7
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF2815
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF286D
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF287E
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF28BF
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2915

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF26DC, 00007FF8B7DF284D, 00007FF8B7DF289A, 00007FF8B7DF2901
DebugLevel, xrefs: 00007FF8B7DF27D0
[%s %4d]: Driver debug level changed to %s, xrefs: 00007FF8B7DF2821, 00007FF8B7DF28D3
[%s %4d]: Cannot set log reg key: %d!, xrefs: 00007FF8B7DF26D1, 00007FF8B7DF288F

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$Value$ChangeCurrentEnterLeaveNotify$ByteCharErrorLastLocalMultiMultipleObjectsProcessQueryReleaseSemaphoreThreadTimeWaitWide
String ID: DebugLevel$[%s %4d]: Cannot set log reg key: %d!$[%s %4d]: Driver debug level changed to %s$[Info 469]: Set debug level as 4
API String ID: 3396396160-1373780096
Opcode ID: a8f45f3fc7d4904e607f5f267d96b0264c9a10abebdde8df6003a34c58baf53e
Instruction ID: 44a9da96d430f6aeafd5e22f9187bab4d08e3880a1fdfb079d057d4c05c8e325
Opcode Fuzzy Hash: a8f45f3fc7d4904e607f5f267d96b0264c9a10abebdde8df6003a34c58baf53e
Instruction Fuzzy Hash: CC911632A08B4696EA20DB19E8456AD73A0FF48BD4F450235DB5E57AB8DF3CE645CB00

Function 00007FF8B7DF1B20 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF1B51
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF1B9D
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF1B8C

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF1BDD
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF1C41
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF1C7B
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF1C8C

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF1B6D, 00007FF8B7DF1BD1, 00007FF8B7DF1C5D, 00007FF8B7DF1CBC
[%s %4d]: Log thead is already started, xrefs: 00007FF8B7DF1B5E, 00007FF8B7DF1BBD
[%s %4d]: Log thread creation error!!!!, xrefs: 00007FF8B7DF1C4E, 00007FF8B7DF1CA9

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$CurrentEnterLeave$ByteCharErrorLastLocalMultiProcessReleaseSemaphoreThreadTimeWide
String ID: [%s %4d]: Log thead is already started$[%s %4d]: Log thread creation error!!!!$[Info 469]: Set debug level as 4
API String ID: 3160802020-162907059
Opcode ID: 5a1c26d09380ca873b7ec569f13518d2109028369766e44a27bfe6270d79d4cd
Instruction ID: 2d5e2923d26a8a81528e11364b03dc83413f4da4eb1e5b23771812df4405d68e
Opcode Fuzzy Hash: 5a1c26d09380ca873b7ec569f13518d2109028369766e44a27bfe6270d79d4cd
Instruction Fuzzy Hash: 7241E561908B4286EB20DB19E8452BD73A0BF44BE8F950335D7AD0A6F9DF3DE259C701

Function 00007FF8B7DF390C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 59
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF8B7DF3941
GetProcAddress.KERNEL32 ref: 00007FF8B7DF3956
RegOpenKeyExW.ADVAPI32 ref: 00007FF8B7DF39BE
RegCloseKey.ADVAPI32 ref: 00007FF8B7DF39D0

Strings

RegOpenKeyTransactedW, xrefs: 00007FF8B7DF394C
Advapi32.dll, xrefs: 00007FF8B7DF393A

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: AddressCloseHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 823179699-3913318428
Opcode ID: 54b7247b56862a0c96e70b9aab7b2add7519bbd60807864f41d51ff1ec2bf6d1
Instruction ID: d0c7b970dc3b7e76ac51707db52577d8002b83769998003532260526471b1889
Opcode Fuzzy Hash: 54b7247b56862a0c96e70b9aab7b2add7519bbd60807864f41d51ff1ec2bf6d1
Instruction Fuzzy Hash: A3212432A18B5182EB508B19E45537DA3A4FB84FE8F598235DB9D0BBA8CF3CE555C700

Function 00007FF8B7E039A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8B7E038D8: OpenSCManagerW.ADVAPI32 ref: 00007FF8B7E0390E

EnterCriticalSection.KERNEL32 ref: 00007FF8B7E039D9
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E03A1C

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

LeaveCriticalSection.KERNEL32 ref: 00007FF8B7E03A2D
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E03A72

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7E039EE, 00007FF8B7E03A66
[%s %4d]: Driver status is: %d., xrefs: 00007FF8B7E039E3, 00007FF8B7E03A46

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalCurrentSection$ByteCharEnterErrorLastLeaveLocalManagerMultiOpenProcessReleaseSemaphoreThreadTimeWide
String ID: [%s %4d]: Driver status is: %d.$[Info 469]: Set debug level as 4
API String ID: 832581751-1601740465
Opcode ID: b6396c6cfdc2c57e8c53073d141def01c08c0fc50f2c95095e09a764c3d39781
Instruction ID: 638769cae0e8a4da1441b468ce98c18e19cf650daf786b98be6d84f9df39332c
Opcode Fuzzy Hash: b6396c6cfdc2c57e8c53073d141def01c08c0fc50f2c95095e09a764c3d39781
Instruction Fuzzy Hash: 6421067190878782EB50DB58E8462AD63A1FF45BA4F80033AE66D866F8DF7CE154CB05

Function 00007FF8B7DF1040 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 56
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF8B7DF106B
GetProcAddress.KERNEL32 ref: 00007FF8B7DF1080
CreateFileW.KERNEL32 ref: 00007FF8B7DF10FD

Strings

kernel32.dll, xrefs: 00007FF8B7DF1064
CreateFileTransactedW, xrefs: 00007FF8B7DF1076

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: AddressCreateFileHandleModuleProc
String ID: CreateFileTransactedW$kernel32.dll
API String ID: 2580138172-2053874626
Opcode ID: fa280db19f60fa5b1ac6b5e189f93aab1b72cc1b7d26f3eaacc672268d924b88
Instruction ID: 018755d74899fd858514dfb748b71e218c7f3df002e548a050fd9888504c43d5
Opcode Fuzzy Hash: fa280db19f60fa5b1ac6b5e189f93aab1b72cc1b7d26f3eaacc672268d924b88
Instruction Fuzzy Hash: CE212432A18B4282FB608B15E45476E76A0FB44BE8F184335D76D06AE8CF7DD445CB01

Function 00007FF8B7DFAB72 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFABAC
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFABF1

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFAC46

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DFABC3, 00007FF8B7DFAC3A
[%s %4d]: Set debug level as %d, xrefs: 00007FF8B7DFABB8, 00007FF8B7DFAC1E

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$Current$ByteCharCriticalEnterErrorLastLocalMultiProcessReleaseSectionSemaphoreThreadTimeWide
String ID: [%s %4d]: Set debug level as %d$[Info 469]: Set debug level as 4
API String ID: 2498388843-3853642116
Opcode ID: 6f5b94a805924919a8c766da4e2183dcb6764e4c0d11fc04d68f2799084a3b82
Instruction ID: 8bc1a2d8db3933d3c2b3150260902a05b5005f1f1a8acf920eeeb732819b6b03
Opcode Fuzzy Hash: 6f5b94a805924919a8c766da4e2183dcb6764e4c0d11fc04d68f2799084a3b82
Instruction Fuzzy Hash: E4212775908B4286EB11CB18E8402AC3361BF957B4F840336D66D46AF8DF3CE248CB00

Function 00007FF8B7E0E9FC Relevance: 7.6, APIs: 5, Instructions: 60threadCOMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8B7E0EA20
CreateThread.KERNEL32 ref: 00007FF8B7E0EA61
GetLastError.KERNEL32 ref: 00007FF8B7E0EA6F
CloseHandle.KERNEL32 ref: 00007FF8B7E0EA8C
FreeLibrary.KERNEL32 ref: 00007FF8B7E0EA9B

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: CloseCreateErrorFreeHandleLastLibraryThread_invalid_parameter_noinfo
String ID:
API String ID: 2067211477-0
Opcode ID: f4f35615507496eba6fff3ecbd1ee84647a7e53ac59d2f404adeb978bf7298e7
Instruction ID: e201e5a63c7f7b539ebcf6624c18ce0ace0453033e9466393fd9a19f60cddfd1
Opcode Fuzzy Hash: f4f35615507496eba6fff3ecbd1ee84647a7e53ac59d2f404adeb978bf7298e7
Instruction Fuzzy Hash: 4E215C25A097428AEE54EBA9A41257EA3A0BF88FD0F084835DF4D07BB5EF3CE4118740

Function 00007FF8B7E0E8D0 Relevance: 3.0, APIs: 2, Instructions: 30threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF8B7E0E8DE
ExitThread.KERNEL32 ref: 00007FF8B7E0E8E6

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 030b60cf63a35b6decc6005f1adc17a5b83391a287e25abf1d55dc356b38c0c3
Instruction ID: bf7af0ec695b5318e8db03cf8eee488178890e5b697c1e17b40721b3ccf6285f
Opcode Fuzzy Hash: 030b60cf63a35b6decc6005f1adc17a5b83391a287e25abf1d55dc356b38c0c3
Instruction Fuzzy Hash: 68F05411E0974286EF94FB79D45757E2661EF54F84F045474DB4A437B2DF2CA5448200

Function 00007FF8B7DF2118 Relevance: 1.5, APIs: 1, Instructions: 31fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF8B7DF2173

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3f0b00e51b31f7ea836b79bb93c70f72d5e084da7137502fde8d20f86bc2e88c
Instruction ID: 9909533e4a820d63bacb5ca7f3f4b4a22e3afea80d552b4fce3c01c0aec68eec
Opcode Fuzzy Hash: 3f0b00e51b31f7ea836b79bb93c70f72d5e084da7137502fde8d20f86bc2e88c
Instruction Fuzzy Hash: D8014861628A8682EB508B65E8457AE6360FF85BC8F441131EB5D4A569DF3CD1058B04

Function 00007FF8B7E072DC Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF8B7E0730C

Part of subcall function 00007FF8B7E08194: std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B7E0819D
Part of subcall function 00007FF8B7E08194: _CxxThrowException.LIBVCRUNTIME ref: 00007FF8B7E081AE

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: Concurrency::cancel_current_taskExceptionThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 1680350287-0
Opcode ID: 57d45eab347d7ae9284259e0ef7ad22549cfdc0f9ebce0f7d703d6207509d103
Instruction ID: 97f24613cd678d73d52e51a2e61a5ffaa3b9b7f36a41fd5a955648bedad4b2f3
Opcode Fuzzy Hash: 57d45eab347d7ae9284259e0ef7ad22549cfdc0f9ebce0f7d703d6207509d103
Instruction Fuzzy Hash: 31E0BD80E0930B82FDA822AA15574BE02844F09BF0F181B30EF3D256F7ED1CA4918254

Function 00007FF8B7E11BF0 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapAlloc.KERNEL32(?,?,?,00007FF8B7E14289,?,?,00000000,00007FF8B7E1070B,?,?,?,00007FF8B7E112EB,?,?,?,00007FF8B7E111E1), ref: 00007FF8B7E11C2E

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 405898f2450fd46b166278858578cbcf206646e682441ec1c065729b83a2d0ef
Instruction ID: 6c6ef23f51bb62d039ecdb126003323af137047117147f52e6cc9c9d1f87ae2e
Opcode Fuzzy Hash: 405898f2450fd46b166278858578cbcf206646e682441ec1c065729b83a2d0ef
Instruction Fuzzy Hash: F5F0F841B1D34741FA98A6BA994337E12905F84FE0F484634EA2E8AAE2DE2CA4418610

Function 00007FF8B7E04A00 Relevance: 1.3, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FF8B7E04A21

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: d651b331d8b666be6ba2c962f4e5ba777e3384f53417d95a8fafa308994edfa3
Instruction ID: e70ed5a1cc2fad934c254c0627f918b57e375b604925bb4ee1be6d4b7006aef6
Opcode Fuzzy Hash: d651b331d8b666be6ba2c962f4e5ba777e3384f53417d95a8fafa308994edfa3
Instruction Fuzzy Hash: E4E04FB2A017008AEBD48F75A84522836E4FB0CF48F551138CB4C97345DB7D90948B04

Non-executed Functions

Function 00007FF8B7DF4750 Relevance: 89.7, APIs: 38, Strings: 13, Instructions: 469registryfileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF47BF
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF4804

Part of subcall function 00007FF8B7DF58F8: EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF5949
Part of subcall function 00007FF8B7DF58F8: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF5984
Part of subcall function 00007FF8B7DF58F8: LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF5995

CreateEventW.KERNEL32 ref: 00007FF8B7DF49C2

Part of subcall function 00007FF8B7DF390C: GetModuleHandleW.KERNEL32 ref: 00007FF8B7DF3941
Part of subcall function 00007FF8B7DF390C: GetProcAddress.KERNEL32 ref: 00007FF8B7DF3956
Part of subcall function 00007FF8B7DF390C: RegCloseKey.ADVAPI32 ref: 00007FF8B7DF39D0

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF4A20
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF4A57
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF4A64
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF4A9B
RegQueryValueExW.ADVAPI32 ref: 00007FF8B7DF4ADF
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF4B20
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF4BD4
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF4BE1
RegQueryValueExW.ADVAPI32 ref: 00007FF8B7DF4C50
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF4CA3
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF4CE1
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF4CEE
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF4D56
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF4DB4
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF4DC1
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF4E3A

Part of subcall function 00007FF8B7DF2990: GetLocalTime.KERNEL32 ref: 00007FF8B7DF29D4
Part of subcall function 00007FF8B7DF2990: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF2A1F
Part of subcall function 00007FF8B7DF2990: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF2A27
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2A78
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2AAA
Part of subcall function 00007FF8B7DF2990: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF2AE8
Part of subcall function 00007FF8B7DF2990: GetLastError.KERNEL32 ref: 00007FF8B7DF2AF4
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2B12
Part of subcall function 00007FF8B7DF2990: GetModuleFileNameW.KERNEL32 ref: 00007FF8B7DF2B5D

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF4EAE
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF4EDF
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF4EEC
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF47F7

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF4841
CreateFileW.KERNEL32 ref: 00007FF8B7DF487A
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF48B5
GetLastError.KERNEL32 ref: 00007FF8B7DF48C2
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF4900
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF490D
GetLastError.KERNEL32 ref: 00007FF8B7DF4918
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF4956
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF4F4C
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF4F72
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF4FA6
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF4FB3
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF4FE3

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF47DB, 00007FF8B7DF482C, 00007FF8B7DF48F4, 00007FF8B7DF494A, 00007FF8B7DF49F7
EnableMonitor, xrefs: 00007FF8B7DF4AC2
[%s %4d]: Start send thread., xrefs: 00007FF8B7DF4F7F, 00007FF8B7DF4FC1
[%s %4d]: Cannot read control monitor: %d!!!!, xrefs: 00007FF8B7DF4B29, 00007FF8B7DF4B50
[%s %4d]: Cannot open config driver control key: %d!!!!, xrefs: 00007FF8B7DF4A29, 00007FF8B7DF4A73
EnableMultiAdapter, xrefs: 00007FF8B7DF4C49
[%s %4d]: Send thread creation error!!!!, xrefs: 00007FF8B7DF4EBB, 00007FF8B7DF4F2A
\\.\PANGPD, xrefs: 00007FF8B7DF4862
[%s %4d]: Load driver control parameter 0x%X., xrefs: 00007FF8B7DF4BA2, 00007FF8B7DF4BED, 00007FF8B7DF4CAF, 00007FF8B7DF4DDC
[%s %4d]: Driver version: 0x%X, MTU: %u, Flags: 0x%X, others: %d-%d-%d., xrefs: 00007FF8B7DF4D5F, 00007FF8B7DF4DEB
SOFTWARE\Palo Alto Networks\GlobalProtect\DrvCtrl, xrefs: 00007FF8B7DF49D3
[%s %4d]: Cannot open device: %d!!!!, xrefs: 00007FF8B7DF48D9, 00007FF8B7DF492F
[%s %4d]: Driver control thead is already started, xrefs: 00007FF8B7DF47CC, 00007FF8B7DF4821

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$EnterLeave$CurrentErrorLast$ByteCharCreateFileLocalModuleMultiProcessQueryThreadTimeValueWide$AddressCloseEventHandleNameProcReleaseSemaphore
String ID: EnableMonitor$EnableMultiAdapter$SOFTWARE\Palo Alto Networks\GlobalProtect\DrvCtrl$[%s %4d]: Cannot open config driver control key: %d!!!!$[%s %4d]: Cannot open device: %d!!!!$[%s %4d]: Cannot read control monitor: %d!!!!$[%s %4d]: Driver control thead is already started$[%s %4d]: Driver version: 0x%X, MTU: %u, Flags: 0x%X, others: %d-%d-%d.$[%s %4d]: Load driver control parameter 0x%X.$[%s %4d]: Send thread creation error!!!!$[%s %4d]: Start send thread.$[Info 469]: Set debug level as 4$\\.\PANGPD
API String ID: 1079873964-73155343
Opcode ID: 5b0808d0e4b9f64f6c1df4864715579c0212621cfda69810e543eb1ebb476324
Instruction ID: 69f76db207f303e930cb8543ebd05588bd4dc9ca2f182205e245dec0aef4fc9e
Opcode Fuzzy Hash: 5b0808d0e4b9f64f6c1df4864715579c0212621cfda69810e543eb1ebb476324
Instruction Fuzzy Hash: 7032F771A1874286E760DF68A8806AD37A5FF44BD8F540636DB5D47AB8DF3CE245CB00

Function 00007FF8B7DF3DB0 Relevance: 80.9, APIs: 31, Strings: 15, Instructions: 429registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B7DFA250: GetModuleFileNameW.KERNEL32 ref: 00007FF8B7DFA2FB
Part of subcall function 00007FF8B7DFA250: EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFA32D
Part of subcall function 00007FF8B7DFA250: GetLastError.KERNEL32 ref: 00007FF8B7DFA339
Part of subcall function 00007FF8B7DFA250: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFA376
Part of subcall function 00007FF8B7DFA250: LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFA387

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF3E38
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF3E84

Part of subcall function 00007FF8B7DF8F08: RegQueryValueExW.ADVAPI32 ref: 00007FF8B7DF8F42

RegCloseKey.ADVAPI32 ref: 00007FF8B7DF423A
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF426C
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF42A1
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF42B2
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF42ED
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF4325
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF435F
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF4370
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF43B0
RegCloseKey.ADVAPI32 ref: 00007FF8B7DF43C2
RegCloseKey.ADVAPI32 ref: 00007FF8B7DF43F6
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF4428
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF4461
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF4472
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF458C
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF44B1

Part of subcall function 00007FF8B7DF2990: GetLocalTime.KERNEL32 ref: 00007FF8B7DF29D4
Part of subcall function 00007FF8B7DF2990: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF2A1F
Part of subcall function 00007FF8B7DF2990: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF2A27
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2A78
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2AAA
Part of subcall function 00007FF8B7DF2990: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF2AE8
Part of subcall function 00007FF8B7DF2990: GetLastError.KERNEL32 ref: 00007FF8B7DF2AF4
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2B12
Part of subcall function 00007FF8B7DF2990: GetModuleFileNameW.KERNEL32 ref: 00007FF8B7DF2B5D

RegCloseKey.ADVAPI32 ref: 00007FF8B7DF44C5
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF4503
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF453C
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF3E73

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF3EF0
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF3F7C
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF3FB7
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF3FC8
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF400C
RegEnumKeyExW.ADVAPI32 ref: 00007FF8B7DF406F
RegQueryValueExW.ADVAPI32 ref: 00007FF8B7DF41C0
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF454D
RegCloseKey.ADVAPI32 ref: 00007FF8B7DF45B7

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF3E6C, 00007FF8B7DF3EE9, 00007FF8B7DF3FB0, 00007FF8B7DF4005, 00007FF8B7DF429A, 00007FF8B7DF42E6, 00007FF8B7DF4358, 00007FF8B7DF43A9, 00007FF8B7DF445A, 00007FF8B7DF44AA, 00007FF8B7DF4535, 00007FF8B7DF4585
[%s %4d]: Open driver reg subkey fails with error: %d!, xrefs: 00007FF8B7DF444C, 00007FF8B7DF449C
PaloAltoNetworks, xrefs: 00007FF8B7DF4172
[%s %4d]: Invalid MAC address in registry, xrefs: 00007FF8B7DF428C, 00007FF8B7DF42D8
pangpd, xrefs: 00007FF8B7DF4122
02:50:41:00:00:01, xrefs: 00007FF8B7DF43DF
MAC, xrefs: 00007FF8B7DF41F2
[%s %4d]: Get dirver file version fails with error %d!, xrefs: 00007FF8B7DF3E5C, 00007FF8B7DF3ED9
[%s %4d]: open registry failed %d!, xrefs: 00007FF8B7DF3FA0, 00007FF8B7DF3FF5
PsvCustomizeMAC, xrefs: 00007FF8B7DF41B1
ComponentId, xrefs: 00007FF8B7DF4109
SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}, xrefs: 00007FF8B7DF3F40, 00007FF8B7DF4082
ProviderName, xrefs: 00007FF8B7DF4159
[%s %4d]: Enum driver reg key fails with error: %d!, xrefs: 00007FF8B7DF4527, 00007FF8B7DF4577
[%s %4d]: Query driver mac fails with error: %d!, xrefs: 00007FF8B7DF434A, 00007FF8B7DF439B

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$EnterLeave$Close$Current$ErrorLast$ByteCharFileLocalModuleMultiNameProcessQueryThreadTimeValueWide$EnumReleaseSemaphore
String ID: 02:50:41:00:00:01$ComponentId$MAC$PaloAltoNetworks$ProviderName$PsvCustomizeMAC$SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}$[%s %4d]: Enum driver reg key fails with error: %d!$[%s %4d]: Get dirver file version fails with error %d!$[%s %4d]: Invalid MAC address in registry$[%s %4d]: Open driver reg subkey fails with error: %d!$[%s %4d]: Query driver mac fails with error: %d!$[%s %4d]: open registry failed %d!$[Info 469]: Set debug level as 4$pangpd
API String ID: 4078888676-479582325
Opcode ID: ce37a528cfcf4a983cb51f793bd8aa9904031b74a91b6f3c2318d1907181188c
Instruction ID: d7dea45674b54a92095da49eaf0e62f1353224c1ee36426433840b76cdafa3f4
Opcode Fuzzy Hash: ce37a528cfcf4a983cb51f793bd8aa9904031b74a91b6f3c2318d1907181188c
Instruction Fuzzy Hash: A5320961A18B4296EB10DB18E8812AD73A1FF84BE4F550336DB6D5AAF8DF3CE545C700

Function 00007FF8B7DFC9D0 Relevance: 80.9, APIs: 36, Strings: 10, Instructions: 363COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFCA3E
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFCA89
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFCE9B
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFCF75
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFCF86
SetupDiEnumDeviceInfo.SETUPAPI ref: 00007FF8B7DFCFA3
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 00007FF8B7DFCFB4
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFD014
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFD073

Part of subcall function 00007FF8B7DF2990: CloseHandle.KERNEL32 ref: 00007FF8B7DF2CB2

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFCD8E

Part of subcall function 00007FF8B7DF2990: GetLocalTime.KERNEL32 ref: 00007FF8B7DF29D4
Part of subcall function 00007FF8B7DF2990: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF2A1F
Part of subcall function 00007FF8B7DF2990: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF2A27
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2A78
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2AAA
Part of subcall function 00007FF8B7DF2990: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF2AE8
Part of subcall function 00007FF8B7DF2990: GetLastError.KERNEL32 ref: 00007FF8B7DF2AF4
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2B12
Part of subcall function 00007FF8B7DF2990: GetModuleFileNameW.KERNEL32 ref: 00007FF8B7DF2B5D

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFD09F
GetLastError.KERNEL32 ref: 00007FF8B7DFD0AF
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFD0ED
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFCA78

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFCABE
SetupDiClassGuidsFromNameExW.SETUPAPI ref: 00007FF8B7DFCAEB
SetupDiGetClassDevsExW.SETUPAPI ref: 00007FF8B7DFCB17
SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF8B7DFCB39
SetupDiEnumDeviceInfo.SETUPAPI ref: 00007FF8B7DFCB60
CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF8B7DFCBA5
wcsstr.LIBVCRUNTIME ref: 00007FF8B7DFCBC5
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFCBF0
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFCC36
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFCC47
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFCC88
CM_Get_DevNode_Status_Ex.SETUPAPI ref: 00007FF8B7DFCCBC
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFCCE7
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFCD31
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFCD42
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFCDFC
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFCE42
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFCE53
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFCF3B
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFD0FE
GetLastError.KERNEL32 ref: 00007FF8B7DFD109
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFD147

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DFCA71, 00007FF8B7DFCAB7, 00007FF8B7DFCC2F, 00007FF8B7DFCC81, 00007FF8B7DFCD2A, 00007FF8B7DFCD87, 00007FF8B7DFCE3B, 00007FF8B7DFCE94, 00007FF8B7DFCF6E, 00007FF8B7DFD06C, 00007FF8B7DFD0E6, 00007FF8B7DFD140
[%s %4d]: Diable adapter: get inf file %s, xrefs: 00007FF8B7DFCE2C, 00007FF8B7DFCE85
[%s %4d]: disable all gp adpater., xrefs: 00007FF8B7DFCA62, 00007FF8B7DFCAA8
[%s %4d]: DevNode Status 0x%x, Problem 0x%x., xrefs: 00007FF8B7DFCD1B, 00007FF8B7DFCD78
\PANGPD\, xrefs: 00007FF8B7DFCBB7
[%s %4d]: Get DevNode Status failed, %d., xrefs: 00007FF8B7DFD0D7, 00007FF8B7DFD131
[%s %4d]: Disable Adapter failed., xrefs: 00007FF8B7DFD033, 00007FF8B7DFD047
[%s %4d]: Disable Adapter success., xrefs: 00007FF8B7DFCF5A, 00007FF8B7DFCFF2
Net, xrefs: 00007FF8B7DFCAE4
[%s %4d]: disable device %s., xrefs: 00007FF8B7DFCC20, 00007FF8B7DFCC72

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$Enter$LeaveSetup$CurrentDeviceErrorInfoLast$ByteCharClassEnumGet_ListLocalMultiNameProcessThreadTimeWide$CloseDestroyDetailDevice_DevsFileFromGuidsHandleModuleNode_ReleaseSemaphoreStatus_wcsstr
String ID: Net$[%s %4d]: DevNode Status 0x%x, Problem 0x%x.$[%s %4d]: Diable adapter: get inf file %s$[%s %4d]: Disable Adapter failed.$[%s %4d]: Disable Adapter success.$[%s %4d]: Get DevNode Status failed, %d.$[%s %4d]: disable all gp adpater.$[%s %4d]: disable device %s.$[Info 469]: Set debug level as 4$\PANGPD\
API String ID: 2393975364-2993292058
Opcode ID: e5436a5666b760269b6e7f725cefa6272572931466123cb6962239532631995a
Instruction ID: 5631f12de2f82c37bdc1f7ed2777725ec416695ed28241006f088b2ae7de3181
Opcode Fuzzy Hash: e5436a5666b760269b6e7f725cefa6272572931466123cb6962239532631995a
Instruction Fuzzy Hash: D6121771918B8286E721DB18E8406AE7764FF44BD8F840236DB8D57AB8DF3CE659D700

Function 00007FF8B7DF8350 Relevance: 72.2, APIs: 31, Strings: 10, Instructions: 401registrythreadCOMMON

Download Yara Rule

APIs

RegNotifyChangeKeyValue.ADVAPI32 ref: 00007FF8B7DF83C3
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF83EF
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF8438
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF8427

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF846F
CreateEventW.KERNEL32 ref: 00007FF8B7DF8501
GetCurrentThread.KERNEL32 ref: 00007FF8B7DF857F
SetThreadPriority.KERNEL32 ref: 00007FF8B7DF858D
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF85B8
GetLastError.KERNEL32 ref: 00007FF8B7DF85C8
GetLastError.KERNEL32 ref: 00007FF8B7DF85F7
GetCurrentThread.KERNEL32 ref: 00007FF8B7DF8630
GetThreadPriority.KERNEL32 ref: 00007FF8B7DF8639
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF865A
WaitForMultipleObjects.KERNEL32 ref: 00007FF8B7DF86D8
ResetEvent.KERNEL32 ref: 00007FF8B7DF8734
CloseHandle.KERNEL32 ref: 00007FF8B7DF8749
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF87B2
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF87EA
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF87FB
RegNotifyChangeKeyValue.ADVAPI32 ref: 00007FF8B7DF8859
RegQueryValueExW.ADVAPI32 ref: 00007FF8B7DF8891
RegQueryValueExW.ADVAPI32 ref: 00007FF8B7DF88F7
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF894E
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF8990
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF89A1
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF89DF
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF8A25
GetLastError.KERNEL32 ref: 00007FF8B7DF8A31
GetLastError.KERNEL32 ref: 00007FF8B7DF8A60
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF8A9C

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF8407, 00007FF8B7DF8451, 00007FF8B7DF87E3, 00007FF8B7DF8965, 00007FF8B7DF89D3, 00007FF8B7DF8A95
[%s %4d]: Driver control parameter changed to 0x%X, xrefs: 00007FF8B7DF895A, 00007FF8B7DF89AF
EnableMonitor, xrefs: 00007FF8B7DF888A
[%s %4d]: Send thread wait failed, %d., xrefs: 00007FF8B7DF8A3D, 00007FF8B7DF8A6C
[%s %4d]: New SendThread priority %d., xrefs: 00007FF8B7DF8667, 00007FF8B7DF86A4
[%s %4d]: SetThreadPriority failed with error %d., xrefs: 00007FF8B7DF85D4, 00007FF8B7DF8603
EnableMultiAdapter, xrefs: 00007FF8B7DF88E8
, xrefs: 00007FF8B7DF84AD
[%s %4d]: Cannot set control reg key: %d!, xrefs: 00007FF8B7DF83FC, 00007FF8B7DF8446
[%s %4d]: Oops!!!Invalid ret %d from WaitForMultipleObjects., xrefs: 00007FF8B7DF87BF, 00007FF8B7DF8817

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: CriticalSection_snwprintf_s$Enter$ErrorLastThread$CurrentValue$Leave$ChangeEventNotifyPriorityQuery$ByteCharCloseCreateHandleLocalMultiMultipleObjectsProcessReleaseResetSemaphoreTimeWaitWide
String ID: $EnableMonitor$EnableMultiAdapter$[%s %4d]: Cannot set control reg key: %d!$[%s %4d]: Driver control parameter changed to 0x%X$[%s %4d]: New SendThread priority %d.$[%s %4d]: Oops!!!Invalid ret %d from WaitForMultipleObjects.$[%s %4d]: Send thread wait failed, %d.$[%s %4d]: SetThreadPriority failed with error %d.$[Info 469]: Set debug level as 4
API String ID: 4078187166-466931406
Opcode ID: 2bf193b42cfdf021ae894943fe2241014ec63254b23f0a31266ca3b4bd7fcaf3
Instruction ID: 8cb484064049f5e370ec26938a45546197d257e211367ea4198266efcfcaaa64
Opcode Fuzzy Hash: 2bf193b42cfdf021ae894943fe2241014ec63254b23f0a31266ca3b4bd7fcaf3
Instruction Fuzzy Hash: DF221736A18B4286EB60DB28E8402AD77A1FF44BD4F540236DB5D57AB8DF3CE549C701

Function 00007FF8B7DFDBD0 Relevance: 66.8, APIs: 30, Strings: 8, Instructions: 330COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFDC41
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFDC8A

Part of subcall function 00007FF8B7DFB490: RegOpenKeyExA.ADVAPI32 ref: 00007FF8B7DFB59A
Part of subcall function 00007FF8B7DFB490: EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFB5C9
Part of subcall function 00007FF8B7DFB490: GetLastError.KERNEL32 ref: 00007FF8B7DFB5D5
Part of subcall function 00007FF8B7DFB490: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFB614
Part of subcall function 00007FF8B7DFB490: LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFB625

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFE189
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFDC7D

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFDCCB
SetupDiClassGuidsFromNameExW.SETUPAPI ref: 00007FF8B7DFDD01
SetupDiGetClassDevsExW.SETUPAPI ref: 00007FF8B7DFDD2D
SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF8B7DFDD4B
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 00007FF8B7DFDD58
SetupDiEnumDeviceInfo.SETUPAPI ref: 00007FF8B7DFDDA7
CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF8B7DFDDFC
wcsstr.LIBVCRUNTIME ref: 00007FF8B7DFDE1B
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFDE42
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFDE82
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFDE8F
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFDED1
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFDF27
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFDF67
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFDF74
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFDFB6
SetupDiEnumDeviceInfo.SETUPAPI ref: 00007FF8B7DFDFD7
SetupDiGetDeviceRegistryPropertyW.SETUPAPI ref: 00007FF8B7DFE030
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFE057
GetLastError.KERNEL32 ref: 00007FF8B7DFE064
GetLastError.KERNEL32 ref: 00007FF8B7DFE093
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFE1C7
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFE1D4
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFE20F
SetupDiDestroyDeviceInfoList.SETUPAPI ref: 00007FF8B7DFE21C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8B7DFE229

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DFDC59, 00007FF8B7DFDCBF, 00007FF8B7DFDDC1
[%s %4d]: set mtu to %d., xrefs: 00007FF8B7DFE195, 00007FF8B7DFE1EE
[%s %4d]: set mtu: enum devevice %s., xrefs: 00007FF8B7DFDE5E, 00007FF8B7DFDEA9
[%s %4d]: Try to set MTU to %d, too small., xrefs: 00007FF8B7DFDC4E, 00007FF8B7DFDCA3
\PANGPD\, xrefs: 00007FF8B7DFDE0D
[%s %4d]: set mtu: invalid device id (valid is %s)., xrefs: 00007FF8B7DFDF43, 00007FF8B7DFDF8E
Net, xrefs: 00007FF8B7DFDCFA
[%s %4d]: SetupDiGetDeviceRegistryPropertyW failed, %d., xrefs: 00007FF8B7DFE070, 00007FF8B7DFE09F

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$Setup$DeviceEnter$InfoLeave$ErrorLast$List$ClassCurrentDestroyEnum$ByteCharDetailDevice_DevsFromGet_GuidsLocalMultiNameOpenProcessPropertyRegistryReleaseSemaphoreThreadTimeWide_invalid_parameter_noinfo_noreturnwcsstr
String ID: Net$[%s %4d]: SetupDiGetDeviceRegistryPropertyW failed, %d.$[%s %4d]: Try to set MTU to %d, too small.$[%s %4d]: set mtu to %d.$[%s %4d]: set mtu: enum devevice %s.$[%s %4d]: set mtu: invalid device id (valid is %s).$[Info 469]: Set debug level as 4$\PANGPD\
API String ID: 2957433310-24599319
Opcode ID: 846c0f1ebf5d5c18960e57df61a8964e0c2d1c34cdbe13d27149b177a79b5090
Instruction ID: 74326cc6158840130bdcd49d864762023ef94e2b1a1a76164eaf2876748b58aa
Opcode Fuzzy Hash: 846c0f1ebf5d5c18960e57df61a8964e0c2d1c34cdbe13d27149b177a79b5090
Instruction Fuzzy Hash: F8022A31A08B8686EB20DB29E8542AD73A4FF45BD8F440636DB5D47AB9DF3CE245D700

Function 00007FF8B7E033D4 Relevance: 65.0, APIs: 28, Strings: 9, Instructions: 261serviceCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B7DF3794: GetProcessHeap.KERNEL32 ref: 00007FF8B7DF37E2
Part of subcall function 00007FF8B7DF3794: _Init_thread_footer.LIBCMT ref: 00007FF8B7DF3817
Part of subcall function 00007FF8B7DF3794: _Init_thread_footer.LIBCMT ref: 00007FF8B7DF3890

OpenSCManagerW.ADVAPI32 ref: 00007FF8B7E03441
OpenServiceW.ADVAPI32 ref: 00007FF8B7E0346B
CloseServiceHandle.ADVAPI32 ref: 00007FF8B7E03871

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7E0352F, 00007FF8B7E035AC, 00007FF8B7E03605, 00007FF8B7E03644, 00007FF8B7E036C1, 00007FF8B7E03710, 00007FF8B7E037F6, 00007FF8B7E0384B
\drivers\, xrefs: 00007FF8B7E0375B
ServicesActive, xrefs: 00007FF8B7E03438
[%s %4d]: Delete driver service return: %d., xrefs: 00007FF8B7E036B4, 00007FF8B7E03703
pangpd.sys, xrefs: 00007FF8B7E0376C
[%s %4d]: Delete driver file return: %d., xrefs: 00007FF8B7E037E9, 00007FF8B7E0383E
[%s %4d]: Driver service is stopped after %d ms., xrefs: 00007FF8B7E0359B, 00007FF8B7E035F4
PANGPD, xrefs: 00007FF8B7E03461
[%s %4d]: Driver service cannot be stopped after %d ms., xrefs: 00007FF8B7E03522, 00007FF8B7E03637

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: Init_thread_footerOpenService$CloseHandleHeapManagerProcess
String ID: PANGPD$ServicesActive$[%s %4d]: Delete driver file return: %d.$[%s %4d]: Delete driver service return: %d.$[%s %4d]: Driver service cannot be stopped after %d ms.$[%s %4d]: Driver service is stopped after %d ms.$[Info 469]: Set debug level as 4$\drivers\$pangpd.sys
API String ID: 79927328-2066155629
Opcode ID: 405739455b2dc1d395834fc3e5c5d612c75861576b442465518dbb74e1c44f02
Instruction ID: c482f6bb6caa69af234641569920b6fa7971798c5c7acbe126de4f8b8746b8d5
Opcode Fuzzy Hash: 405739455b2dc1d395834fc3e5c5d612c75861576b442465518dbb74e1c44f02
Instruction Fuzzy Hash: 92D12765A08B4682EB10DB19E8452AD73A1FF84FD4F85023ADB4D07AB4DF3CE648D704

Function 00007FF8B7E01D40 Relevance: 47.6, APIs: 21, Strings: 6, Instructions: 316COMMON

Download Yara Rule

APIs

GetSystemWindowsDirectoryW.KERNEL32 ref: 00007FF8B7E01DBF
SetupGetInfFileListW.SETUPAPI ref: 00007FF8B7E01DF2
GetLastError.KERNEL32 ref: 00007FF8B7E01E04
EnterCriticalSection.KERNEL32 ref: 00007FF8B7E01E3A
GetLastError.KERNEL32 ref: 00007FF8B7E01E4A
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7E01E92
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E01E81

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

GetLastError.KERNEL32 ref: 00007FF8B7E01E9A
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E01ED1
SetupGetInfFileListW.SETUPAPI ref: 00007FF8B7E01F2F
EnterCriticalSection.KERNEL32 ref: 00007FF8B7E01F59
GetLastError.KERNEL32 ref: 00007FF8B7E01F69
GetLastError.KERNEL32 ref: 00007FF8B7E01F87
EnterCriticalSection.KERNEL32 ref: 00007FF8B7E02061
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E020A0
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7E020B1
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E020F2
EnterCriticalSection.KERNEL32 ref: 00007FF8B7E0220D
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E02247
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7E02258
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E0228D

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7E01E7A, 00007FF8B7E01ECA, 00007FF8B7E02099, 00007FF8B7E020EB, 00007FF8B7E02240, 00007FF8B7E02286
[%s %4d]: enum oem files failed 1. %d., xrefs: 00007FF8B7E01E5C, 00007FF8B7E01EAC
[%s %4d]: enum oem files failed 2. %d., xrefs: 00007FF8B7E01F7B, 00007FF8B7E01F99
\INF\, xrefs: 00007FF8B7E02000
[%s %4d]: No oem .inf existing., xrefs: 00007FF8B7E02231, 00007FF8B7E02277
[%s %4d]: Find %s is still existing., xrefs: 00007FF8B7E0208A, 00007FF8B7E020DC

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$ErrorLast$Enter$Leave$CurrentFileListSetup$ByteCharDirectoryLocalMultiProcessReleaseSemaphoreSystemThreadTimeWideWindows
String ID: [%s %4d]: Find %s is still existing.$[%s %4d]: No oem .inf existing.$[%s %4d]: enum oem files failed 1. %d.$[%s %4d]: enum oem files failed 2. %d.$[Info 469]: Set debug level as 4$\INF\
API String ID: 4224179724-698139844
Opcode ID: 4462cfb883f6beb69f408996184f0df5ce47c2ab32e902731c5f5fe0d1874e64
Instruction ID: e7eee3ab1960e407ce6c2c59e29206b8eaaed0a6a878587d90a0545ac12d72f9
Opcode Fuzzy Hash: 4462cfb883f6beb69f408996184f0df5ce47c2ab32e902731c5f5fe0d1874e64
Instruction Fuzzy Hash: 37F14821A08B4286EB11DB28E8411BE77A4FF84BD4F940536EB4D47AB9DF7CE649C740

Function 00007FF8B7DF5F3C Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF5F90
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF5FCA
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF6008
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF6030
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF6074
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF6085
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF60CB
CreateEventW.KERNEL32 ref: 00007FF8B7DF6105
DeviceIoControl.KERNEL32 ref: 00007FF8B7DF613E
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF616A
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF61A5
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF61B6
GetOverlappedResult.KERNEL32 ref: 00007FF8B7DF61CD
CloseHandle.KERNEL32 ref: 00007FF8B7DF61D8
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF6220
GetLastError.KERNEL32 ref: 00007FF8B7DF622C
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF6255
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF6294
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF62A5
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF62E9

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF5FAC, 00007FF8B7DF5FF3, 00007FF8B7DF6047, 00007FF8B7DF60C4, 00007FF8B7DF6186, 00007FF8B7DF620B, 00007FF8B7DF626D, 00007FF8B7DF62D0
[%s %4d]: Set keepalive fails with empty handle;driver may be restarting., xrefs: 00007FF8B7DF5F9D, 00007FF8B7DF5FE9
[%s %4d]: Device control set keepalive succeeds., xrefs: 00007FF8B7DF6177, 00007FF8B7DF6200
[%s %4d]: Device control set keepalive fails: %d!, xrefs: 00007FF8B7DF6262, 00007FF8B7DF62C1
[%s %4d]: Set keepalive fails with empty handle %d times!, xrefs: 00007FF8B7DF603C, 00007FF8B7DF60A0

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$Enter$Leave$CloseControlCreateDeviceErrorEventHandleLastOverlappedResult
String ID: [%s %4d]: Device control set keepalive fails: %d!$[%s %4d]: Device control set keepalive succeeds.$[%s %4d]: Set keepalive fails with empty handle %d times!$[%s %4d]: Set keepalive fails with empty handle;driver may be restarting.$[Info 469]: Set debug level as 4
API String ID: 536018074-2438912028
Opcode ID: 90b7719114fe23f50378c53df45695e14f159736bf0c9a61ea5336d5b4880480
Instruction ID: 1845d36cd240c7bc9ab3d9f7fa837efdf5e6d94a384a3cb8b834842cf69657aa
Opcode Fuzzy Hash: 90b7719114fe23f50378c53df45695e14f159736bf0c9a61ea5336d5b4880480
Instruction Fuzzy Hash: 71A1E471908B4686EB21CB18E8446BD73A0FF45BE4F550235D76E46AB8DF3CE248CB01

Function 00007FF8B7DFE6A0 Relevance: 40.5, APIs: 18, Strings: 5, Instructions: 294COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFE702
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFE74A
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFEA99
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFE739

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFE77D
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFE803
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFE842
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFE853
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFE894
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFE907
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFE99A
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFE9FE
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFEB15
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFEB50
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFEB61
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFEBD6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8B7DFEC03
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8B7DFEC09

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DFE71E, 00007FF8B7DFE771, 00007FF8B7DFE81B, 00007FF8B7DFE888, 00007FF8B7DFE986, 00007FF8B7DFEA85, 00007FF8B7DFEB31, 00007FF8B7DFEBCF
[%s %4d]: After enable, check adapter device status returns failure, status 0x%x., xrefs: 00007FF8B7DFE810, 00007FF8B7DFE86C
[%s %4d]: Enable adapter be called., xrefs: 00007FF8B7DFE70F, 00007FF8B7DFE758
[%s %4d]: retry valid adapter searching: %u-%s-%s-%s., xrefs: 00007FF8B7DFE950, 00007FF8B7DFEA4F
[%s %4d]: Enable adapter end., xrefs: 00007FF8B7DFEB22, 00007FF8B7DFEBB6

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$EnterLeave$Current_invalid_parameter_noinfo_noreturn$ByteCharErrorLastLocalMultiProcessReleaseSemaphoreThreadTimeWide
String ID: [%s %4d]: After enable, check adapter device status returns failure, status 0x%x.$[%s %4d]: Enable adapter be called.$[%s %4d]: Enable adapter end.$[%s %4d]: retry valid adapter searching: %u-%s-%s-%s.$[Info 469]: Set debug level as 4
API String ID: 4065535631-1790092595
Opcode ID: 04a2c827882fa8fbcba0b328165cfb1b056c2d48ac30aa8edbb0187a62515fa0
Instruction ID: aadef6bca9b06bf29acbd2f1d8cbc9fb882ff57964427088b5490d987b1ddb6b
Opcode Fuzzy Hash: 04a2c827882fa8fbcba0b328165cfb1b056c2d48ac30aa8edbb0187a62515fa0
Instruction Fuzzy Hash: 3CE12A61A08B428AEB11DB68E8816BD3761BF45BE4F850335EB6D066F9DF3CE549C700

Function 00007FF8B7DF45D0 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32 ref: 00007FF8B7DF45DD
CreateEventW.KERNEL32 ref: 00007FF8B7DF45F6
CreateEventW.KERNEL32 ref: 00007FF8B7DF460A
CreateEventW.KERNEL32 ref: 00007FF8B7DF4621
CreateEventW.KERNEL32 ref: 00007FF8B7DF4638
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF468C
GetLastError.KERNEL32 ref: 00007FF8B7DF469C
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF46DA
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF46EB
GetLastError.KERNEL32 ref: 00007FF8B7DF46F3
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF4731

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF46C2, 00007FF8B7DF472A
[%s %4d]: Create event fails with error %d!!!!, xrefs: 00007FF8B7DF46B3, 00007FF8B7DF470A

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: CreateEvent$CriticalSection$ErrorLast_snwprintf_s$EnterInitializeLeave
String ID: [%s %4d]: Create event fails with error %d!!!!$[Info 469]: Set debug level as 4
API String ID: 3903359141-943050856
Opcode ID: ea9d2e497ca4a415a8bb39eef640188ef571b057ad1ab339f65178fcc240a8c1
Instruction ID: 7834c50da9abc8619f63e1031517206891c72ae19f93654fae1cf500978c4f86
Opcode Fuzzy Hash: ea9d2e497ca4a415a8bb39eef640188ef571b057ad1ab339f65178fcc240a8c1
Instruction Fuzzy Hash: 2E418471A08B4282E754CF78E8516BE33A1FF48BE4F550235DB5D46AB8DF3CA1548700

Function 00007FF8B7E04BC8 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32 ref: 00007FF8B7E04C00
EnterCriticalSection.KERNEL32 ref: 00007FF8B7E04C2C
GetLastError.KERNEL32 ref: 00007FF8B7E04C3C
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E04C7B

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

LeaveCriticalSection.KERNEL32 ref: 00007FF8B7E04C8C
GetLastError.KERNEL32 ref: 00007FF8B7E04C94
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E04CD3

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7E04C62, 00007FF8B7E04CC7
[%s %4d]: GetVersionEx failed on error %d!, xrefs: 00007FF8B7E04C53, 00007FF8B7E04CAB

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$ErrorLast$CriticalCurrentSection$ByteCharEnterLeaveLocalMultiProcessReleaseSemaphoreThreadTimeVersionWide
String ID: [%s %4d]: GetVersionEx failed on error %d!$[Info 469]: Set debug level as 4
API String ID: 1407335024-2820726306
Opcode ID: 0a1e299e2bdd6a7dfa360e40a6e857dc163cbb573f9ccca65f25a01f9ad8fb72
Instruction ID: 0dc2a7b2bfc6fc63b9e59d99096060ded4abfa41a84e381f8d87096f173ee5e7
Opcode Fuzzy Hash: 0a1e299e2bdd6a7dfa360e40a6e857dc163cbb573f9ccca65f25a01f9ad8fb72
Instruction Fuzzy Hash: 4331E675958B8282EB60DB18E8453AE7360BF46BA4F910236D66D02AF4DF3CE109DA41

Function 00007FF8B7E0EF30 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF8B7E0EFA9
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF8B7E0EFC1
RtlVirtualUnwind.KERNEL32 ref: 00007FF8B7E0EFFC
IsDebuggerPresent.KERNEL32 ref: 00007FF8B7E0F035
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF8B7E0F03F
UnhandledExceptionFilter.KERNEL32 ref: 00007FF8B7E0F04A

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 01a7ce59c53f18128adb1c2554e56d82c64b4c939a72016560fc06a67df205d6
Instruction ID: a0933fcc343551c1138e63116247a601101d351e26a7af09ddb0021aad528d8f
Opcode Fuzzy Hash: 01a7ce59c53f18128adb1c2554e56d82c64b4c939a72016560fc06a67df205d6
Instruction Fuzzy Hash: 9F313136618B8186DB60CF29E8416AE73A4FF88B98F500135EB9D47B65DF3CD555CB00

Function 00007FF8B7E19B18 Relevance: 7.8, APIs: 5, Instructions: 325fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32 ref: 00007FF8B7E19B87
WriteFile.KERNEL32 ref: 00007FF8B7E19E36
WriteFile.KERNEL32 ref: 00007FF8B7E19E88
GetLastError.KERNEL32 ref: 00007FF8B7E19FCF
GetLastError.KERNEL32 ref: 00007FF8B7E19FE1

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: ErrorFileLastWrite$Console
String ID:
API String ID: 786612050-0
Opcode ID: 2b880e6ad89f832b536583f69cc212b0ffa5400a38014eea19384acb44b6b8f9
Instruction ID: 62655fe8b0c11d7b91d19cbd01ea3f152326fec769f568e1459e239863d55f0c
Opcode Fuzzy Hash: 2b880e6ad89f832b536583f69cc212b0ffa5400a38014eea19384acb44b6b8f9
Instruction Fuzzy Hash: C3E1CC62B18B829AE750CF68D4412EE77B1FB48BC8B544126DB8E57FA9DE3CD156C300

Function 00007FF8B7DFFFD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00007FF8B7E00003
CoCreateInstance.OLE32 ref: 00007FF8B7E00031
CoUninitialize.OLE32 ref: 00007FF8B7E0010A

Strings

PANGPD, xrefs: 00007FF8B7E00069

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: PANGPD
API String ID: 948891078-499889211
Opcode ID: 65c08a614d73bb82ad3ef49e31912458a30d52479465fad6588efe140f1a6e1a
Instruction ID: 62e92664f9508024fadfa7f93bc6ca3544a32d96a61416300f4f341653a65e73
Opcode Fuzzy Hash: 65c08a614d73bb82ad3ef49e31912458a30d52479465fad6588efe140f1a6e1a
Instruction Fuzzy Hash: 5E41C426B08B4A82EB549B5AD4A136E67A0FF98FC8F404432DB4D43774DF6DE844C300

Function 00007FF8B7E1265C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8B7E126C0

Strings

gfffffff, xrefs: 00007FF8B7E1295D

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: b171a70e75948427f7a712be047cdec179550bde20f03507fb9d8f741a760ea6
Instruction ID: 309b3946523e8b8dd7a7128536fc5e8c63e6b2aaad616e9f6b621ff9e4cf3a3d
Opcode Fuzzy Hash: b171a70e75948427f7a712be047cdec179550bde20f03507fb9d8f741a760ea6
Instruction Fuzzy Hash: 28913766B097C686EF51CB2D98023BE6799AF54FC0F058032CB5D4BBA1DA3DE606C301

Function 00007FF8B7E04778 Relevance: 4.5, APIs: 3, Instructions: 47COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32 ref: 00007FF8B7E0479A
LockResource.KERNEL32 ref: 00007FF8B7E047AB
SizeofResource.KERNEL32 ref: 00007FF8B7E047BF

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: 465fd408bcca625105c9a02b9250f4444448e9f6eca72f50cd1626598f543a3f
Instruction ID: 135e862063a7f9c9ed6b33eae21ac52ca959bf5a5ebfc79a4126c3c983c05ef4
Opcode Fuzzy Hash: 465fd408bcca625105c9a02b9250f4444448e9f6eca72f50cd1626598f543a3f
Instruction Fuzzy Hash: 44115E26A15B9282EE54CF1EA50917E62A0AF5BFD4B0D0131DF1D577B4DE3CE441C310

Function 00007FF8B7DFF78C Relevance: 100.2, APIs: 42, Strings: 15, Instructions: 453comCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFF7E4
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,00000000,00000104,00007FF8B7DFE5A0), ref: 00007FF8B7DFF82A
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFFA7B
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFFB2B
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFFB83
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,00000000,00000104,00007FF8B7DFE5A0), ref: 00007FF8B7DFFB90
wcsstr.LIBVCRUNTIME ref: 00007FF8B7DFFC03
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,00000000,00000104,00007FF8B7DFE5A0), ref: 00007FF8B7DFFC45
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFFC7D
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,00000000,00000104,00007FF8B7DFE5A0), ref: 00007FF8B7DFFC8A
CoTaskMemFree.OLE32(?,?,?,?,?,?,00000000,00000000,00000104,00007FF8B7DFE5A0), ref: 00007FF8B7DFFCD6
CoTaskMemFree.OLE32(?,?,?,?,?,?,00000000,00000000,00000104,00007FF8B7DFE5A0), ref: 00007FF8B7DFFCE4
CoTaskMemFree.OLE32(?,?,?,?,?,?,00000000,00000000,00000104,00007FF8B7DFE5A0), ref: 00007FF8B7DFFCEE
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFF81D

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFF85E
CoInitialize.OLE32(?,?,?,?,?,?,00000000,00000000,00000104,00007FF8B7DFE5A0), ref: 00007FF8B7DFF86E
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,00000000,00000104,00007FF8B7DFE5A0), ref: 00007FF8B7DFF89B
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFF8CF
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,00000000,00000104,00007FF8B7DFE5A0), ref: 00007FF8B7DFF8DC
CoUninitialize.OLE32 ref: 00007FF8B7DFF8FF
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFF922
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFF966
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,00000000,00000104,00007FF8B7DFE5A0), ref: 00007FF8B7DFF973
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFF9B0
CoCreateInstance.OLE32 ref: 00007FF8B7DFF9DE
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFFA07

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DFF7CB
[%s %4d]: COM SetAdapterStatus: %d - %s - %s - %d., xrefs: 00007FF8B7DFFB35, 00007FF8B7DFFB9C
[%s %4d]: EnumConnections failed. 0x%x., xrefs: 00007FF8B7DFFA85, 00007FF8B7DFFA9D
U, xrefs: 00007FF8B7DFFE53
[%s %4d]: CoCreateInstance failed. 0x%x., xrefs: 00007FF8B7DFFA11, 00007FF8B7DFFA29
[%s %4d]: disable adapter returns 0x%x., xrefs: 00007FF8B7DFFC52, 00007FF8B7DFFCA3
[%s %4d]: enum netconnnection end., xrefs: 00007FF8B7DFFEFA, 00007FF8B7DFFF57
PANGP Virtual Ethernet Adapter, xrefs: 00007FF8B7DFFBF8
[%s %4d]: EnumConnections next get NULL. 0x%x., xrefs: 00007FF8B7DFFE06, 00007FF8B7DFFE4C
disable, xrefs: 00007FF8B7DFF7BE, 00007FF8B7DFF92F, 00007FF8B7DFFF82
[%s %4d]: COM interface to %s gp adapter., xrefs: 00007FF8B7DFF7F1, 00007FF8B7DFF838
[%s %4d]: GetProperties failed, %d - 0x%x., xrefs: 00007FF8B7DFFD1A, 00007FF8B7DFFD67
[%s %4d]: CoInitialize failed. 0x%x., xrefs: 00007FF8B7DFF8A5, 00007FF8B7DFF982
[%s %4d]: COM interface to %s gp adapter returns 0x%x., xrefs: 00007FF8B7DFF93A, 00007FF8B7DFFF8D
[%s %4d]: pEnumNetConnection next failed, 0x%x., xrefs: 00007FF8B7DFFEAF, 00007FF8B7DFFEC7

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: CriticalSection$_snwprintf_s$Enter$Leave$FreeTask$Current$ByteCharCreateErrorInitializeInstanceLastLocalMultiProcessReleaseSemaphoreThreadTimeUninitializeWidewcsstr
String ID: PANGP Virtual Ethernet Adapter$U$[%s %4d]: COM SetAdapterStatus: %d - %s - %s - %d.$[%s %4d]: COM interface to %s gp adapter returns 0x%x.$[%s %4d]: COM interface to %s gp adapter.$[%s %4d]: CoCreateInstance failed. 0x%x.$[%s %4d]: CoInitialize failed. 0x%x.$[%s %4d]: EnumConnections failed. 0x%x.$[%s %4d]: EnumConnections next get NULL. 0x%x.$[%s %4d]: GetProperties failed, %d - 0x%x.$[%s %4d]: disable adapter returns 0x%x.$[%s %4d]: enum netconnnection end.$[%s %4d]: pEnumNetConnection next failed, 0x%x.$[Info 469]: Set debug level as 4$disable
API String ID: 535026658-4140605041
Opcode ID: 757c73ef34b9eaddf8d8903dca706f83e7e4f2eceab1be384fda9cd4686972dd
Instruction ID: 8b08d66858e8265e1b057b42405ba9397b07761e9f251c3f021b6cb0c0ec9033
Opcode Fuzzy Hash: 757c73ef34b9eaddf8d8903dca706f83e7e4f2eceab1be384fda9cd4686972dd
Instruction Fuzzy Hash: 5032E366908B4686EB60DF69A8805AD77A0FF48BD8F540636EB4D07B78CF3CE145D704

Function 00007FF8B7E03A9C Relevance: 72.2, APIs: 30, Strings: 11, Instructions: 401registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B7DF3794: GetProcessHeap.KERNEL32 ref: 00007FF8B7DF37E2
Part of subcall function 00007FF8B7DF3794: _Init_thread_footer.LIBCMT ref: 00007FF8B7DF3817
Part of subcall function 00007FF8B7DF3794: _Init_thread_footer.LIBCMT ref: 00007FF8B7DF3890

Part of subcall function 00007FF8B7DF390C: GetModuleHandleW.KERNEL32 ref: 00007FF8B7DF3941
Part of subcall function 00007FF8B7DF390C: GetProcAddress.KERNEL32 ref: 00007FF8B7DF3956
Part of subcall function 00007FF8B7DF390C: RegCloseKey.ADVAPI32 ref: 00007FF8B7DF39D0

EnterCriticalSection.KERNEL32 ref: 00007FF8B7E03B94
GetLastError.KERNEL32 ref: 00007FF8B7E03BA0
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7E03BEF
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E03BDE

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

GetLastError.KERNEL32 ref: 00007FF8B7E03BFA
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E03C38
RegEnumKeyExW.ADVAPI32 ref: 00007FF8B7E03C7B
RegQueryValueExW.ADVAPI32 ref: 00007FF8B7E03D65
EnterCriticalSection.KERNEL32 ref: 00007FF8B7E03DA6
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E03DDF
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7E03F9B
RegCloseKey.ADVAPI32 ref: 00007FF8B7E041BB
RegCloseKey.ADVAPI32 ref: 00007FF8B7E041CC

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7E03BD7, 00007FF8B7E03C31, 00007FF8B7E03DD8, 00007FF8B7E03E19, 00007FF8B7E03ECB, 00007FF8B7E03F1A, 00007FF8B7E03F83, 00007FF8B7E03FD1, 00007FF8B7E04036, 00007FF8B7E0408B, 00007FF8B7E040FF, 00007FF8B7E0414E
SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}, xrefs: 00007FF8B7E03B57, 00007FF8B7E03C92, 00007FF8B7E03CA1
[%s %4d]: Set interface characteristics failed with error: %d!, xrefs: 00007FF8B7E03EBE, 00007FF8B7E03F0D
[%s %4d]: Open network class subkey %s failed with error: %d!, xrefs: 00007FF8B7E04029, 00007FF8B7E0407E
[%s %4d]: Enum network class reg key failed with error: %d!, xrefs: 00007FF8B7E040F2, 00007FF8B7E04141
ComponentId, xrefs: 00007FF8B7E03CFF
[%s %4d]: Change interface characteristics., xrefs: 00007FF8B7E03F76, 00007FF8B7E03FC4
[%s %4d]: Open network class reg key failed with error: %d!, xrefs: 00007FF8B7E03BC8, 00007FF8B7E03C22
pangpd, xrefs: 00007FF8B7E03D1B
Characteristics, xrefs: 00007FF8B7E03D59, 00007FF8B7E03E62
[%s %4d]: Query interface characteristics failed with error: %d!, xrefs: 00007FF8B7E03DCB, 00007FF8B7E03E0C

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$CloseErrorLast$CurrentEnterInit_thread_footerLeaveProcess$AddressByteCharEnumHandleHeapLocalModuleMultiProcQueryReleaseSemaphoreThreadTimeValueWide
String ID: Characteristics$ComponentId$SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}$[%s %4d]: Change interface characteristics.$[%s %4d]: Enum network class reg key failed with error: %d!$[%s %4d]: Open network class reg key failed with error: %d!$[%s %4d]: Open network class subkey %s failed with error: %d!$[%s %4d]: Query interface characteristics failed with error: %d!$[%s %4d]: Set interface characteristics failed with error: %d!$[Info 469]: Set debug level as 4$pangpd
API String ID: 2184356301-3788337125
Opcode ID: f59d27197918ab7fb9f1e756dddae255d71d6842b5ea198986f19b64551bf802
Instruction ID: 50e2e4e197ea2efe6a574ea03c59cfdb3a210d5e2f5fa7cadc02ed9ea18565b3
Opcode Fuzzy Hash: f59d27197918ab7fb9f1e756dddae255d71d6842b5ea198986f19b64551bf802
Instruction Fuzzy Hash: 2C223971A08B4682EB10DB18E8415AE77A4FF45BD4F900236EB5D47AB9DF3CE648CB40

Function 00007FF8B7E022F0 Relevance: 70.3, APIs: 30, Strings: 10, Instructions: 338COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B7DFC9D0: EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFCA3E
Part of subcall function 00007FF8B7DFC9D0: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFCA78
Part of subcall function 00007FF8B7DFC9D0: LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFCA89
Part of subcall function 00007FF8B7DFC9D0: SetupDiClassGuidsFromNameExW.SETUPAPI ref: 00007FF8B7DFCAEB
Part of subcall function 00007FF8B7DFC9D0: SetupDiGetClassDevsExW.SETUPAPI ref: 00007FF8B7DFCB17
Part of subcall function 00007FF8B7DFC9D0: SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF8B7DFCB39
Part of subcall function 00007FF8B7DFC9D0: SetupDiEnumDeviceInfo.SETUPAPI ref: 00007FF8B7DFCB60
Part of subcall function 00007FF8B7DFC9D0: CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF8B7DFCBA5
Part of subcall function 00007FF8B7DFC9D0: wcsstr.LIBVCRUNTIME ref: 00007FF8B7DFCBC5
Part of subcall function 00007FF8B7DFC9D0: EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFCBF0

Part of subcall function 00007FF8B7DFFFD0: CoInitialize.OLE32 ref: 00007FF8B7E00003
Part of subcall function 00007FF8B7DFFFD0: CoCreateInstance.OLE32 ref: 00007FF8B7E00031
Part of subcall function 00007FF8B7DFFFD0: CoUninitialize.OLE32 ref: 00007FF8B7E0010A

EnterCriticalSection.KERNEL32(?,?,00000003,?,00000000,00000000,00000001,?,?,00007FF8B7E00446), ref: 00007FF8B7E02363
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7E023AB
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E0239E

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E023EF
EnterCriticalSection.KERNEL32(?,?,00000003,?,00000000,00000000,00000001,?,?,00007FF8B7E00446), ref: 00007FF8B7E02469
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E024A2
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7E024AF
EnterCriticalSection.KERNEL32(?,?,00000003,?,00000000,00000000,00000001,?,?,00007FF8B7E00446), ref: 00007FF8B7E02558
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E0258D
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7E0259A
EnterCriticalSection.KERNEL32(?,?,00000003,?,00000000,00000000,00000001,?,?,00007FF8B7E00446), ref: 00007FF8B7E028A3
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E028D8

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7E0237B, 00007FF8B7E023E3, 00007FF8B7E0240D
[%s %4d]: Driver delete fails with error %d!, xrefs: 00007FF8B7E02565, 00007FF8B7E02792
[%s %4d]: Driver delete succeeds., xrefs: 00007FF8B7E027FC, 00007FF8B7E0283E
[%s %4d]: Driver uninstall release net cfg fails with error 0x%X!, xrefs: 00007FF8B7E028B0, 00007FF8B7E028FF
[%s %4d]: Driver uninstall: no additional component., xrefs: 00007FF8B7E02767, 00007FF8B7E02783
[%s %4d]: Driver uninstall apply fails with error 0x%X!, xrefs: 00007FF8B7E025C8, 00007FF8B7E0260F
[%s %4d]: Driver uninstall get net cfg fails with error 0x%X!, xrefs: 00007FF8B7E02370, 00007FF8B7E023C7
[%s %4d]: Driver uninstall component fails with error 0x%X!, xrefs: 00007FF8B7E02644, 00007FF8B7E0265A
[%s %4d]: Driver successfully uninstalled component %d., xrefs: 00007FF8B7E02476, 00007FF8B7E024C9
[%s %4d]: Driver uninstall but component is not existed!, xrefs: 00007FF8B7E026C5, 00007FF8B7E02713

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: CriticalSection$_snwprintf_s$Enter$LeaveSetup$ClassCurrentDeviceInfo$ByteCharCreateDetailDevice_DevsEnumErrorFromGet_GuidsInitializeInstanceLastListLocalMultiNameProcessReleaseSemaphoreThreadTimeUninitializeWidewcsstr
String ID: [%s %4d]: Driver delete fails with error %d!$[%s %4d]: Driver delete succeeds.$[%s %4d]: Driver successfully uninstalled component %d.$[%s %4d]: Driver uninstall apply fails with error 0x%X!$[%s %4d]: Driver uninstall but component is not existed!$[%s %4d]: Driver uninstall component fails with error 0x%X!$[%s %4d]: Driver uninstall get net cfg fails with error 0x%X!$[%s %4d]: Driver uninstall release net cfg fails with error 0x%X!$[%s %4d]: Driver uninstall: no additional component.$[Info 469]: Set debug level as 4
API String ID: 3591891962-2133691996
Opcode ID: 617d3e1fee15ff61ef69fde6e73104699d418c5d08283ebced17882e246cdf4e
Instruction ID: dd84a2bc30a5afd90a8ee2daaa262d61b0bd0ab85b11c2c8be42f8f81d8b0f96
Opcode Fuzzy Hash: 617d3e1fee15ff61ef69fde6e73104699d418c5d08283ebced17882e246cdf4e
Instruction Fuzzy Hash: AC023761908B4786EB22DB19A8451AE77A8FF44FD4F440236EB4D07BB5DF3CE2458B01

Function 00007FF8B7E04D04 Relevance: 70.2, APIs: 27, Strings: 13, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B7E04BC8: GetVersionExW.KERNEL32 ref: 00007FF8B7E04C00
Part of subcall function 00007FF8B7E04BC8: EnterCriticalSection.KERNEL32 ref: 00007FF8B7E04C2C
Part of subcall function 00007FF8B7E04BC8: GetLastError.KERNEL32 ref: 00007FF8B7E04C3C
Part of subcall function 00007FF8B7E04BC8: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E04C7B
Part of subcall function 00007FF8B7E04BC8: LeaveCriticalSection.KERNEL32 ref: 00007FF8B7E04C8C

LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,00007FF8B7DF9727), ref: 00007FF8B7E04D24
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,00007FF8B7DF9727), ref: 00007FF8B7E04D5B
GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF8B7DF9727), ref: 00007FF8B7E04D6B
GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF8B7DF9727), ref: 00007FF8B7E04D9A
GetProcAddress.KERNEL32(?,?,?,?,?,?,?,00007FF8B7DF9727), ref: 00007FF8B7E04DD8
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,00007FF8B7DF9727), ref: 00007FF8B7E04E07
GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF8B7DF9727), ref: 00007FF8B7E04E17
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E050D5
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7E050E6
GetLastError.KERNEL32(?,?,?,?,?,?,?,00007FF8B7DF9727), ref: 00007FF8B7E050EE
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E0512C

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7E050CE, 00007FF8B7E05120
GetIpInterfaceTable, xrefs: 00007FF8B7E0504D
GetIpInterfaceEntry, xrefs: 00007FF8B7E04F0F
[%s %4d]: GetFuncGetInfEntry failed on error %d!, xrefs: 00007FF8B7E04F5F, 00007FF8B7E04F8A
[%s %4d]: GetFuncGetInfTblFunc failed on error %d!, xrefs: 00007FF8B7E050A1, 00007FF8B7E05105
[%s %4d]: GetFuncSetInfEntry failed on error %d!, xrefs: 00007FF8B7E04FFE, 00007FF8B7E05029
[%s %4d]: GetFuncFreeMibTbl failed on error %d!, xrefs: 00007FF8B7E04E21, 00007FF8B7E04E4C
SetIpInterfaceEntry, xrefs: 00007FF8B7E04FAE
GetIfTable2, xrefs: 00007FF8B7E04E70
FreeMibTable, xrefs: 00007FF8B7E04DCE
[%s %4d]: LoadLibraryIphlpapi failed on error %d!, xrefs: 00007FF8B7E04D82, 00007FF8B7E04DB1
iphlpapi.dll, xrefs: 00007FF8B7E04D1D
[%s %4d]: GetFuncGetIfTbl2 failed on error %d!, xrefs: 00007FF8B7E04EC0, 00007FF8B7E04EEB

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: CriticalErrorLastSection$Enter_snwprintf_s$Leave$AddressLibraryLoadProcVersion
String ID: FreeMibTable$GetIfTable2$GetIpInterfaceEntry$GetIpInterfaceTable$SetIpInterfaceEntry$[%s %4d]: GetFuncFreeMibTbl failed on error %d!$[%s %4d]: GetFuncGetIfTbl2 failed on error %d!$[%s %4d]: GetFuncGetInfEntry failed on error %d!$[%s %4d]: GetFuncGetInfTblFunc failed on error %d!$[%s %4d]: GetFuncSetInfEntry failed on error %d!$[%s %4d]: LoadLibraryIphlpapi failed on error %d!$[Info 469]: Set debug level as 4$iphlpapi.dll
API String ID: 946388449-1040112269
Opcode ID: 16f29a257b6225159ba25fbf48f2bdf61b92cd8a1ed2fe23f3ed73d81465b420
Instruction ID: d019a5a46c7f78eb8ac5381a499e217d432f018153fb2a2d3755ad0d2665d208
Opcode Fuzzy Hash: 16f29a257b6225159ba25fbf48f2bdf61b92cd8a1ed2fe23f3ed73d81465b420
Instruction Fuzzy Hash: 48C1127194DB4386EB61CB18E8555BE33A1BF49BD8F510136D78E02AB4EF3CA248C791

Function 00007FF8B7DF6F14 Relevance: 65.0, APIs: 30, Strings: 7, Instructions: 269sleepCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32 ref: 00007FF8B7DF6F74
DeviceIoControl.KERNEL32 ref: 00007FF8B7DF6FA2
GetLastError.KERNEL32 ref: 00007FF8B7DF6FB0
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF6FE0
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7022
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF7033
Sleep.KERNEL32 ref: 00007FF8B7DF705C
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF7088
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF70BF
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF70D0
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7117
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7151
GetOverlappedResult.KERNEL32 ref: 00007FF8B7DF7174
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF719F
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF71DF
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF71F0
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7235
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF725C
GetLastError.KERNEL32 ref: 00007FF8B7DF726C
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF72AC
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF72BD
GetLastError.KERNEL32 ref: 00007FF8B7DF72C5
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF73BC
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF73EB
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7423
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7458
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7305

Part of subcall function 00007FF8B7DF2990: GetLocalTime.KERNEL32 ref: 00007FF8B7DF29D4
Part of subcall function 00007FF8B7DF2990: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF2A1F
Part of subcall function 00007FF8B7DF2990: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF2A27
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2A78
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2AAA
Part of subcall function 00007FF8B7DF2990: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF2AE8
Part of subcall function 00007FF8B7DF2990: GetLastError.KERNEL32 ref: 00007FF8B7DF2AF4
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2B12
Part of subcall function 00007FF8B7DF2990: GetModuleFileNameW.KERNEL32 ref: 00007FF8B7DF2B5D

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF7340
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7378
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF7389

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF6FF8, 00007FF8B7DF70A4, 00007FF8B7DF70F7, 00007FF8B7DF713B, 00007FF8B7DF71B4, 00007FF8B7DF7229, 00007FF8B7DF72A0, 00007FF8B7DF72FE, 00007FF8B7DF735C, 00007FF8B7DF73A6, 00007FF8B7DF7407, 00007FF8B7DF7442
[%s %4d]: Device control put packet fails 2: %d!!!! frame size: %d, xrefs: 00007FF8B7DF7278, 00007FF8B7DF72D1
[%s %4d]: Device control retry put packet..., xrefs: 00007FF8B7DF7095, 00007FF8B7DF712C
[%s %4d]: Put packet after driver halted!, xrefs: 00007FF8B7DF734D, 00007FF8B7DF7397
[%s %4d]: Put packet fails with empty handle!, xrefs: 00007FF8B7DF73F8, 00007FF8B7DF7433
[%s %4d]: Device control put packet succeeds, size %d., xrefs: 00007FF8B7DF71A9, 00007FF8B7DF7201
[%s %4d]: Device control put packet fails 1: %d!!!! frame size: %d, xrefs: 00007FF8B7DF6FED, 00007FF8B7DF70EC

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$Enter$Leave$ErrorLast$Current$ByteCharControlDeviceEventFileLocalModuleMultiNameOverlappedProcessResetResultSleepThreadTimeWide
String ID: [%s %4d]: Device control put packet fails 1: %d!!!! frame size: %d$[%s %4d]: Device control put packet fails 2: %d!!!! frame size: %d$[%s %4d]: Device control put packet succeeds, size %d.$[%s %4d]: Device control retry put packet...$[%s %4d]: Put packet after driver halted!$[%s %4d]: Put packet fails with empty handle!$[Info 469]: Set debug level as 4
API String ID: 2221552806-29212769
Opcode ID: 761c67931729e41c7214d7cbc653c416af4ed2cda99514805ca5be0f2dda8022
Instruction ID: 90a6ab1db617a3aaf81a33e0776b3d5378ed9604101cb5e9186a970578eb5ed3
Opcode Fuzzy Hash: 761c67931729e41c7214d7cbc653c416af4ed2cda99514805ca5be0f2dda8022
Instruction Fuzzy Hash: 47E1F461908B4296EB21DB18F8445AE77A4FF44BD8F950236DB4D57AB8DF3CE249C700

Function 00007FF8B7DF5000 Relevance: 58.0, APIs: 27, Strings: 6, Instructions: 219synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 00007FF8B7DF503D
WaitForSingleObject.KERNEL32 ref: 00007FF8B7DF504F
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF507D
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF50B4
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF50C1
CloseHandle.KERNEL32 ref: 00007FF8B7DF532D
CloseHandle.KERNEL32 ref: 00007FF8B7DF53E7
CloseHandle.KERNEL32 ref: 00007FF8B7DF53FB

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF5099, 00007FF8B7DF50E9, 00007FF8B7DF5132
[%s %4d]: Send thread stops., xrefs: 00007FF8B7DF508A, 00007FF8B7DF50DE
[%s %4d]: Wait for Send thread failed, %d., xrefs: 00007FF8B7DF5216, 00007FF8B7DF5251
[%s %4d]: Send thread stops timeout!, xrefs: 00007FF8B7DF5159, 00007FF8B7DF519A
[%s %4d]: Wait for Send thread: running(%d)., xrefs: 00007FF8B7DF5367, 00007FF8B7DF53AE
[%s %4d]: Wait for Send thread: stopped., xrefs: 00007FF8B7DF52B0, 00007FF8B7DF52F2

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: CloseHandle$CriticalSection$EnterEventLeaveObjectSingleWait_snwprintf_s
String ID: [%s %4d]: Send thread stops timeout!$[%s %4d]: Send thread stops.$[%s %4d]: Wait for Send thread failed, %d.$[%s %4d]: Wait for Send thread: running(%d).$[%s %4d]: Wait for Send thread: stopped.$[Info 469]: Set debug level as 4
API String ID: 2452122876-2982910163
Opcode ID: 820e05c7a4a59c2f9ea704a39760426afa6be609f304bcc2a0d2ced7d083afbc
Instruction ID: 52a8ab007be341ac5675eaebe08db64dd7b73262c35f82854103d3f704392149
Opcode Fuzzy Hash: 820e05c7a4a59c2f9ea704a39760426afa6be609f304bcc2a0d2ced7d083afbc
Instruction Fuzzy Hash: 30C13831A18B4286EB10DB29A8453AD37A4BF45FD8F550735DA9E0BAB8CF3CE245D700

Function 00007FF8B7E0161C Relevance: 49.2, APIs: 21, Strings: 7, Instructions: 238COMMON

Download Yara Rule

APIs

SetupGetInfInformationW.SETUPAPI ref: 00007FF8B7E0169C
GetLastError.KERNEL32 ref: 00007FF8B7E016AA
EnterCriticalSection.KERNEL32 ref: 00007FF8B7E016DB
GetLastError.KERNEL32 ref: 00007FF8B7E016E7
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E01726
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7E01737
GetLastError.KERNEL32 ref: 00007FF8B7E01742
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E01781

Part of subcall function 00007FF8B7DF2990: GetLocalTime.KERNEL32 ref: 00007FF8B7DF29D4
Part of subcall function 00007FF8B7DF2990: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF2A1F
Part of subcall function 00007FF8B7DF2990: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF2A27
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2A78
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2AAA
Part of subcall function 00007FF8B7DF2990: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF2AE8
Part of subcall function 00007FF8B7DF2990: GetLastError.KERNEL32 ref: 00007FF8B7DF2AF4
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2B12
Part of subcall function 00007FF8B7DF2990: GetModuleFileNameW.KERNEL32 ref: 00007FF8B7DF2B5D

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7E0171F, 00007FF8B7E0177A
PaloAltoNetworks, xrefs: 00007FF8B7E01A06
[%s %4d]: get oem file info failed 1. %d., xrefs: 00007FF8B7E016FE, 00007FF8B7E0174C
[%s %4d]: get oem file ver info failed 1. %d., xrefs: 00007FF8B7E018DA, 00007FF8B7E018FC
[%s %4d]: get oem file ver info failed 2. %d., xrefs: 00007FF8B7E019B9, 00007FF8B7E019EB
Provider, xrefs: 00007FF8B7E0186B, 00007FF8B7E01958
[%s %4d]: get oem file info failed 2. %d., xrefs: 00007FF8B7E01828, 00007FF8B7E0184A

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$ErrorLast$CriticalCurrentSection$ByteCharEnterFileInformationLeaveLocalModuleMultiNameProcessSetupThreadTimeWide
String ID: PaloAltoNetworks$Provider$[%s %4d]: get oem file info failed 1. %d.$[%s %4d]: get oem file info failed 2. %d.$[%s %4d]: get oem file ver info failed 1. %d.$[%s %4d]: get oem file ver info failed 2. %d.$[Info 469]: Set debug level as 4
API String ID: 248885118-1365945008
Opcode ID: 05200eb67494a6602b66bbd23c8896d4dfd260461b609ec614f2c1e8ff0d59ad
Instruction ID: ca0d64e39c58b5feb838fda3a26be9cc5226a386df18eac2acb936ad0ea74138
Opcode Fuzzy Hash: 05200eb67494a6602b66bbd23c8896d4dfd260461b609ec614f2c1e8ff0d59ad
Instruction Fuzzy Hash: BAC12921A18B4286E750CF29E8856AE37A1FF44BE4F50023AEB5E17AB4DF3CE555C740

Function 00007FF8B7DF21A0 Relevance: 47.5, APIs: 21, Strings: 6, Instructions: 254fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B7DF3794: GetProcessHeap.KERNEL32 ref: 00007FF8B7DF37E2
Part of subcall function 00007FF8B7DF3794: _Init_thread_footer.LIBCMT ref: 00007FF8B7DF3817
Part of subcall function 00007FF8B7DF3794: _Init_thread_footer.LIBCMT ref: 00007FF8B7DF3890

CloseHandle.KERNEL32 ref: 00007FF8B7DF225E
DeleteFileW.KERNEL32 ref: 00007FF8B7DF22CE
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF230B
GetLastError.KERNEL32 ref: 00007FF8B7DF2317
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2351
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF2362
GetLastError.KERNEL32 ref: 00007FF8B7DF236A
GetLastError.KERNEL32 ref: 00007FF8B7DF244E
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2494
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2508

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF2519
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF23A4

Part of subcall function 00007FF8B7DF2990: GetLocalTime.KERNEL32 ref: 00007FF8B7DF29D4
Part of subcall function 00007FF8B7DF2990: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF2A1F
Part of subcall function 00007FF8B7DF2990: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF2A27
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2A78
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2AAA
Part of subcall function 00007FF8B7DF2990: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF2AE8
Part of subcall function 00007FF8B7DF2990: GetLastError.KERNEL32 ref: 00007FF8B7DF2AF4
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2B12
Part of subcall function 00007FF8B7DF2990: GetModuleFileNameW.KERNEL32 ref: 00007FF8B7DF2B5D

MoveFileW.KERNEL32 ref: 00007FF8B7DF23B8
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF23E3
GetLastError.KERNEL32 ref: 00007FF8B7DF23EF
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2435
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF2446
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF24D0
GetFileSize.KERNEL32 ref: 00007FF8B7DF2214

Part of subcall function 00007FF8B7DF3AAC: GetLastError.KERNEL32 ref: 00007FF8B7DF3AB0

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF234A, 00007FF8B7DF239D, 00007FF8B7DF242E, 00007FF8B7DF248D, 00007FF8B7DF2501, 00007FF8B7DF2550
[%s %4d]: Delete log file %s fails with error %d!!!!, xrefs: 00007FF8B7DF233D, 00007FF8B7DF2390
debug_drv.log, xrefs: 00007FF8B7DF228B
[%s %4d]: Move log file %s to %s fails with error %d!!!!, xrefs: 00007FF8B7DF2421, 00007FF8B7DF2480
debug_drv_old.log, xrefs: 00007FF8B7DF22B7
[%s %4d]: Recreate log file fails with error %d!!!!, xrefs: 00007FF8B7DF24F4, 00007FF8B7DF2543

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$ErrorLast$CriticalSection$CurrentFile$EnterLeaveProcess$ByteCharInit_thread_footerLocalMultiThreadTimeWide$CloseDeleteHandleHeapModuleMoveNameReleaseSemaphoreSize
String ID: [%s %4d]: Delete log file %s fails with error %d!!!!$[%s %4d]: Move log file %s to %s fails with error %d!!!!$[%s %4d]: Recreate log file fails with error %d!!!!$[Info 469]: Set debug level as 4$debug_drv.log$debug_drv_old.log
API String ID: 2193108007-3825418551
Opcode ID: 6118db1c20408ae6e78a9392cbf91614cf97fbf403b85869d3c60a7992b6e7b1
Instruction ID: 9e9adfa587863c7983eb2e1cdb26973cbb483cc990b1f24fc7894021e5992d41
Opcode Fuzzy Hash: 6118db1c20408ae6e78a9392cbf91614cf97fbf403b85869d3c60a7992b6e7b1
Instruction Fuzzy Hash: 26D14761A08B4292EB14DB29E8516BD7760FF44BE4F850236EB5D4BAB8DF3CE644C740

Function 00007FF8B7DFAC58 Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 207COMMON

Download Yara Rule

APIs

SetupDiSetClassInstallParamsW.SETUPAPI ref: 00007FF8B7DFACCD
SetupDiCallClassInstaller.SETUPAPI ref: 00007FF8B7DFACDF
SetupDiSetClassInstallParamsW.SETUPAPI ref: 00007FF8B7DFAD0F
SetupDiCallClassInstaller.SETUPAPI ref: 00007FF8B7DFAD25
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFAD61
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFAD9D
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFADAE
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFAEC8
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFAEFB
GetLastError.KERNEL32 ref: 00007FF8B7DFAF07
GetLastError.KERNEL32 ref: 00007FF8B7DFAF27
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFAFCC

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFAFDD
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFB029
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFADE6

Part of subcall function 00007FF8B7DF2990: GetLocalTime.KERNEL32 ref: 00007FF8B7DF29D4
Part of subcall function 00007FF8B7DF2990: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF2A1F
Part of subcall function 00007FF8B7DF2990: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF2A27
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2A78
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2AAA
Part of subcall function 00007FF8B7DF2990: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF2AE8
Part of subcall function 00007FF8B7DF2990: GetLastError.KERNEL32 ref: 00007FF8B7DF2AF4
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2B12
Part of subcall function 00007FF8B7DF2990: GetModuleFileNameW.KERNEL32 ref: 00007FF8B7DF2B5D

SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 00007FF8B7DFAE08
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFAE42
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFAE7F
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFAE90

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DFAD7A, 00007FF8B7DFADC8, 00007FF8B7DFAE5B, 00007FF8B7DFAEAA, 00007FF8B7DFAFC0, 00007FF8B7DFB01D
[%s %4d]: SetupDiSetClassInstallParams failed (ctrl code 0x%x), %d., xrefs: 00007FF8B7DFAF92, 00007FF8B7DFAFFC
[%s %4d]: SetupDiCallClassInstaller failed (ctrl code 0x%x), %d., xrefs: 00007FF8B7DFAF11, 00007FF8B7DFAF3E
[%s %4d]: Set adapter ctrl code 0x%x requires reboot., xrefs: 00007FF8B7DFAE4F, 00007FF8B7DFAE9E
[%s %4d]: Set adapter ctrl code 0x%x success., xrefs: 00007FF8B7DFAD6E, 00007FF8B7DFADBC

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$Setup$ClassCurrentErrorLast$EnterInstallLeaveParams$ByteCallCharInstallerLocalMultiProcessThreadTimeWide$DeviceFileModuleNameReleaseSemaphore
String ID: [%s %4d]: Set adapter ctrl code 0x%x requires reboot.$[%s %4d]: Set adapter ctrl code 0x%x success.$[%s %4d]: SetupDiCallClassInstaller failed (ctrl code 0x%x), %d.$[%s %4d]: SetupDiSetClassInstallParams failed (ctrl code 0x%x), %d.$[Info 469]: Set debug level as 4
API String ID: 1171899940-699836497
Opcode ID: fff4ca6120ba19ab3ba4db944303ee46494191c3fe11d47b0be44b11b1b3d31b
Instruction ID: 75f8d63a67a7eececf6b10594e22b82c519194ef79b5574df52f58365b9a7f45
Opcode Fuzzy Hash: fff4ca6120ba19ab3ba4db944303ee46494191c3fe11d47b0be44b11b1b3d31b
Instruction Fuzzy Hash: 0EB1F77190878286E761CF58A8446AEB764FF85BE4F440235EB9D17AB8DF3CE149DB00

Function 00007FF8B7DF9980 Relevance: 47.4, APIs: 20, Strings: 7, Instructions: 200sleepCOMMON

Download Yara Rule

APIs

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF9B20
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF9C15
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF9C5B
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF9C4E

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF9C8F
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF99E3

Part of subcall function 00007FF8B7DF2990: GetLocalTime.KERNEL32 ref: 00007FF8B7DF29D4
Part of subcall function 00007FF8B7DF2990: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF2A1F
Part of subcall function 00007FF8B7DF2990: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF2A27
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2A78
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2AAA
Part of subcall function 00007FF8B7DF2990: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF2AE8
Part of subcall function 00007FF8B7DF2990: GetLastError.KERNEL32 ref: 00007FF8B7DF2AF4
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2B12
Part of subcall function 00007FF8B7DF2990: GetModuleFileNameW.KERNEL32 ref: 00007FF8B7DF2B5D

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF9A0C
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF9A47
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF9A54
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF9ABB
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF9AEF
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF9BA0
Sleep.KERNEL32 ref: 00007FF8B7DF9BE3
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF9CB3
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF9CE7
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF9CF4
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF9D23

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF99CE, 00007FF8B7DF9A28, 00007FF8B7DF9A72
[%s %4d]: Driver control is not created!, xrefs: 00007FF8B7DF9A19
[%s %4d]: Adapter device has problem. 0x%08x, xrefs: 00007FF8B7DF9B67, 00007FF8B7DF9BAE
[%s %4d]: Check adapter device status returns failure., xrefs: 00007FF8B7DF9AC8, 00007FF8B7DF9AFF
[%s %4d]: ----Driver Control is being started, xrefs: 00007FF8B7DF9CC0, 00007FF8B7DF9D02
[%s %4d]: Debug log is not created!, xrefs: 00007FF8B7DF99C3
[%s %4d]: Adapter device started. 0x%08x, xrefs: 00007FF8B7DF9C22, 00007FF8B7DF9C69

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$CurrentEnterLeave$ByteCharErrorLastLocalMultiProcessThreadTimeWide$FileModuleNameReleaseSemaphoreSleep
String ID: [%s %4d]: ----Driver Control is being started$[%s %4d]: Adapter device has problem. 0x%08x$[%s %4d]: Adapter device started. 0x%08x$[%s %4d]: Check adapter device status returns failure.$[%s %4d]: Debug log is not created!$[%s %4d]: Driver control is not created!$[Info 469]: Set debug level as 4
API String ID: 1767906088-3811505718
Opcode ID: 76f3d13b0f8ece05a5ccafc16875186b15333c0a8b9ba3762e113835cef913ca
Instruction ID: 1520c326442105f73eafb46441861647f0548edfd9ba2448d436320b7f5e77a4
Opcode Fuzzy Hash: 76f3d13b0f8ece05a5ccafc16875186b15333c0a8b9ba3762e113835cef913ca
Instruction Fuzzy Hash: DBA1573190874786EB25DB19A8443AD77A4BF45BE8F550232DB5D5BAB8CF3CE284C701

Function 00007FF8B7DF552C Relevance: 47.4, APIs: 22, Strings: 5, Instructions: 199COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF5588
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8B7DF498E), ref: 00007FF8B7DF55CF
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF55C2

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF560B
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF564D
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF5684
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8B7DF498E), ref: 00007FF8B7DF5691
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF56C4
GetHandleInformation.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8B7DF498E), ref: 00007FF8B7DF56EC
CreateEventW.KERNEL32 ref: 00007FF8B7DF571A
DeviceIoControl.KERNEL32 ref: 00007FF8B7DF575C
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF5783
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF57BB
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF57C8
GetOverlappedResult.KERNEL32 ref: 00007FF8B7DF57E2
CloseHandle.KERNEL32 ref: 00007FF8B7DF57ED
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF5830
GetLastError.KERNEL32 ref: 00007FF8B7DF583C
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF5861
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF589E
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF58AB
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF58E6

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF55A4, 00007FF8B7DF5604, 00007FF8B7DF5669, 00007FF8B7DF56AE, 00007FF8B7DF579F, 00007FF8B7DF581A, 00007FF8B7DF587A, 00007FF8B7DF58C8
[%s %4d]: Access driver events., xrefs: 00007FF8B7DF565A, 00007FF8B7DF569F
[%s %4d]: Device control set events returns: %d!, xrefs: 00007FF8B7DF586E, 00007FF8B7DF58BC
[%s %4d]: Set driver event fails with empty handle!, xrefs: 00007FF8B7DF5595, 00007FF8B7DF55EC
[%s %4d]: Device control set driver events., xrefs: 00007FF8B7DF5790, 00007FF8B7DF580B

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$EnterLeave$CurrentErrorHandleLast$ByteCharCloseControlCreateDeviceEventInformationLocalMultiOverlappedProcessReleaseResultSemaphoreThreadTimeWide
String ID: [%s %4d]: Access driver events.$[%s %4d]: Device control set driver events.$[%s %4d]: Device control set events returns: %d!$[%s %4d]: Set driver event fails with empty handle!$[Info 469]: Set debug level as 4
API String ID: 1708348905-1768356309
Opcode ID: 6210be5b552be922e982494c4c96e58fd7b6660451b5f98bdd7fbdb39f670d97
Instruction ID: 08deecdbc2f997399a4b42a29f470ba7ea032f8460340e2825c2dc758eb4dba2
Opcode Fuzzy Hash: 6210be5b552be922e982494c4c96e58fd7b6660451b5f98bdd7fbdb39f670d97
Instruction Fuzzy Hash: 41A12C71A08B8286EB21DB19E8456AD77A4FF45BD4F450235DB5E47AB8CF3CE248C700

Function 00007FF8B7E00E88 Relevance: 44.0, APIs: 18, Strings: 7, Instructions: 205COMMON

Download Yara Rule

APIs

SetupDiGetDeviceInfoListDetailW.SETUPAPI ref: 00007FF8B7E00ECE
CM_Get_Device_ID_ExW.SETUPAPI ref: 00007FF8B7E00EF9
SetupDiSetClassInstallParamsW.SETUPAPI ref: 00007FF8B7E00F9E
SetupDiCallClassInstaller.SETUPAPI ref: 00007FF8B7E00FBC
SetupDiGetDeviceInstallParamsW.SETUPAPI ref: 00007FF8B7E00FE2
EnterCriticalSection.KERNEL32 ref: 00007FF8B7E0101E
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E01055
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7E01066
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E012B4
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E010A2

Part of subcall function 00007FF8B7DF2990: GetLocalTime.KERNEL32 ref: 00007FF8B7DF29D4
Part of subcall function 00007FF8B7DF2990: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF2A1F
Part of subcall function 00007FF8B7DF2990: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF2A27
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2A78
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2AAA
Part of subcall function 00007FF8B7DF2990: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF2AE8
Part of subcall function 00007FF8B7DF2990: GetLastError.KERNEL32 ref: 00007FF8B7DF2AF4
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2B12
Part of subcall function 00007FF8B7DF2990: GetModuleFileNameW.KERNEL32 ref: 00007FF8B7DF2B5D

EnterCriticalSection.KERNEL32 ref: 00007FF8B7E01210
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E0125C
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7E0126D

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7E01036, 00007FF8B7E01082, 00007FF8B7E01103, 00007FF8B7E01135, 00007FF8B7E011C0, 00007FF8B7E01235, 00007FF8B7E0129F
restart, xrefs: 00007FF8B7E00F0A
[%s %4d]: %s: type %d, xrefs: 00007FF8B7E01227, 00007FF8B7E01287
[%s %4d]: failed to %s it, xrefs: 00007FF8B7E0118B, 00007FF8B7E011B4
remove, xrefs: 00007FF8B7E00F13
[%s %4d]: %s device success, xrefs: 00007FF8B7E010D7, 00007FF8B7E01126
[%s %4d]: need reboot, xrefs: 00007FF8B7E0102B, 00007FF8B7E01077

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSectionSetup$ClassCurrentDeviceEnterInstallLeaveParams$ByteCallCharDetailDevice_ErrorFileGet_InfoInstallerLastListLocalModuleMultiNameProcessThreadTimeWide
String ID: [%s %4d]: %s device success$[%s %4d]: %s: type %d$[%s %4d]: failed to %s it$[%s %4d]: need reboot$[Info 469]: Set debug level as 4$remove$restart
API String ID: 533593334-994667543
Opcode ID: 250a2666b169daf419dbf908c38889ec8138045e0b557101d0ed3073fd392389
Instruction ID: 2c9357bc1bdb6b298cc8ca2bf895c007d50e88e46dd88b2fb1828ad8c1251439
Opcode Fuzzy Hash: 250a2666b169daf419dbf908c38889ec8138045e0b557101d0ed3073fd392389
Instruction Fuzzy Hash: E2C1C671908B8286E761CF18E8457ED67A4FF45BA8F410235DA6D4AAF8DF3CE258D700

Function 00007FF8B7DFB0BC Relevance: 40.5, APIs: 17, Strings: 6, Instructions: 217registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF8B7DFB1C9
RegQueryValueExA.ADVAPI32 ref: 00007FF8B7DFB222
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFB24D
GetLastError.KERNEL32 ref: 00007FF8B7DFB259
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFB294
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFB2A5
GetLastError.KERNEL32 ref: 00007FF8B7DFB2AD
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFB375
GetLastError.KERNEL32 ref: 00007FF8B7DFB381
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFB3B7

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFB3C8
GetLastError.KERNEL32 ref: 00007FF8B7DFB3D0
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFB405
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFB2E9

Part of subcall function 00007FF8B7DF2990: GetLocalTime.KERNEL32 ref: 00007FF8B7DF29D4
Part of subcall function 00007FF8B7DF2990: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF2A1F
Part of subcall function 00007FF8B7DF2990: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF2A27
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2A78
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2AAA
Part of subcall function 00007FF8B7DF2990: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF2AE8
Part of subcall function 00007FF8B7DF2990: GetLastError.KERNEL32 ref: 00007FF8B7DF2AF4
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2B12
Part of subcall function 00007FF8B7DF2990: GetModuleFileNameW.KERNEL32 ref: 00007FF8B7DF2B5D

RegQueryValueExA.ADVAPI32 ref: 00007FF8B7DFB34A
RegCloseKey.ADVAPI32 ref: 00007FF8B7DFB422
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8B7DFB488

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DFB28D, 00007FF8B7DFB2E2, 00007FF8B7DFB3B0, 00007FF8B7DFB3FE
[%s %4d]: RegQueryValueExA mtu failed %d., xrefs: 00007FF8B7DFB3A3, 00007FF8B7DFB3F1
[%s %4d]: RegQueryValueExA instance id failed %d., xrefs: 00007FF8B7DFB281, 00007FF8B7DFB2D5
system\currentcontrolset\Control\Class, xrefs: 00007FF8B7DFB0FB
NetCfgInstanceId, xrefs: 00007FF8B7DFB216
MTU, xrefs: 00007FF8B7DFB33E

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$ErrorLast$CriticalCurrentSection$ByteCharEnterLeaveLocalMultiProcessQueryThreadTimeValueWide$CloseFileModuleNameOpenReleaseSemaphore_invalid_parameter_noinfo_noreturn
String ID: MTU$NetCfgInstanceId$[%s %4d]: RegQueryValueExA instance id failed %d.$[%s %4d]: RegQueryValueExA mtu failed %d.$[Info 469]: Set debug level as 4$system\currentcontrolset\Control\Class
API String ID: 3896456519-3716360889
Opcode ID: 55acd90b011ab8d041eb2b77d4b32c8ed244595e4ef2e237a03efd89eacab8e0
Instruction ID: 4e28ee174018cfe4a3a6775278e4e3bc3dba8c98971ac5655d323a5958963bad
Opcode Fuzzy Hash: 55acd90b011ab8d041eb2b77d4b32c8ed244595e4ef2e237a03efd89eacab8e0
Instruction Fuzzy Hash: E9B17C21A08B4286EB20DB29E8456AE7771FF94BD8F840236DB5D47AB9DF3CE145C700

Function 00007FF8B7DFB490 Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 194registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF8B7DFB59A
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFB5C9
GetLastError.KERNEL32 ref: 00007FF8B7DFB5D5
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFB614
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFB625
GetLastError.KERNEL32 ref: 00007FF8B7DFB630
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFB66F

Part of subcall function 00007FF8B7DF2990: GetLocalTime.KERNEL32 ref: 00007FF8B7DF29D4
Part of subcall function 00007FF8B7DF2990: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF2A1F
Part of subcall function 00007FF8B7DF2990: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF2A27
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2A78
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2AAA
Part of subcall function 00007FF8B7DF2990: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF2AE8
Part of subcall function 00007FF8B7DF2990: GetLastError.KERNEL32 ref: 00007FF8B7DF2AF4
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2B12
Part of subcall function 00007FF8B7DF2990: GetModuleFileNameW.KERNEL32 ref: 00007FF8B7DF2B5D

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF8B7DFB80F

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DFB60D, 00007FF8B7DFB668, 00007FF8B7DFB732, 00007FF8B7DFB78A
system\currentcontrolset\Control\Class, xrefs: 00007FF8B7DFB4CD
[%s %4d]: RegSetValueExA mtu failed %d., xrefs: 00007FF8B7DFB722, 00007FF8B7DFB77A
[%s %4d]: RegOpenKeyExA mtu failed %d., xrefs: 00007FF8B7DFB5FD, 00007FF8B7DFB658
MTU, xrefs: 00007FF8B7DFB6B8

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$ErrorLast$CriticalCurrentSection$ByteCharEnterFileLeaveLocalModuleMultiNameOpenProcessThreadTimeWide_invalid_parameter_noinfo_noreturn
String ID: MTU$[%s %4d]: RegOpenKeyExA mtu failed %d.$[%s %4d]: RegSetValueExA mtu failed %d.$[Info 469]: Set debug level as 4$system\currentcontrolset\Control\Class
API String ID: 2279401932-2560007152
Opcode ID: 1bb298f4443c9aa13207e70350fcd3e5ed321463338fe7d5db678971ec31668d
Instruction ID: 1b8edbf1911de55b8af50cee846334b15be2585f5a91c3d02b2aa62d2be4cffa
Opcode Fuzzy Hash: 1bb298f4443c9aa13207e70350fcd3e5ed321463338fe7d5db678971ec31668d
Instruction Fuzzy Hash: 14A12A61A18B8682E610DB28E8411AE7365FF84BE4F540336D7AD57AF9DF3CE545C700

Function 00007FF8B7DF7B84 Relevance: 38.6, APIs: 17, Strings: 5, Instructions: 149COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF7BCF
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000104,00007FF8B7DF4D30), ref: 00007FF8B7DF7C1B
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7C0A

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7C58
CreateEventW.KERNEL32 ref: 00007FF8B7DF7C86
DeviceIoControl.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000104,00007FF8B7DF4D30), ref: 00007FF8B7DF7CC1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000104,00007FF8B7DF4D30), ref: 00007FF8B7DF7CEC
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7D27
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000104,00007FF8B7DF4D30), ref: 00007FF8B7DF7D38
GetOverlappedResult.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000104,00007FF8B7DF4D30), ref: 00007FF8B7DF7D4F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000104,00007FF8B7DF4D30), ref: 00007FF8B7DF7D5A
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7DA9
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000104,00007FF8B7DF4D30), ref: 00007FF8B7DF7DB5
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000104,00007FF8B7DF4D30), ref: 00007FF8B7DF7DE5
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7E24
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000104,00007FF8B7DF4D30), ref: 00007FF8B7DF7E35
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7E76

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF7BEB, 00007FF8B7DF7C51, 00007FF8B7DF7D08, 00007FF8B7DF7D94, 00007FF8B7DF7DFD, 00007FF8B7DF7E5D
[%s %4d]: Get driver stat fails with empty handle!, xrefs: 00007FF8B7DF7BDC, 00007FF8B7DF7C38
P, xrefs: 00007FF8B7DF7CB4
[%s %4d]: Device control get stat fails: %d!!!!, xrefs: 00007FF8B7DF7DF2, 00007FF8B7DF7E4E
[%s %4d]: Device control get stat ends., xrefs: 00007FF8B7DF7CF9, 00007FF8B7DF7D89

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$EnterLeave$CurrentErrorLast$ByteCharCloseControlCreateDeviceEventHandleLocalMultiOverlappedProcessReleaseResultSemaphoreThreadTimeWide
String ID: P$[%s %4d]: Device control get stat ends.$[%s %4d]: Device control get stat fails: %d!!!!$[%s %4d]: Get driver stat fails with empty handle!$[Info 469]: Set debug level as 4
API String ID: 287153219-264761071
Opcode ID: e0a0ce66a521f16669e6ec374153c38f679e757f4bc1faacd3ce38bf1e3ec962
Instruction ID: 72c1c83abaf48d7afb8095ac45bee147fdd3a9e4ab552816999c1b4ff864ca3e
Opcode Fuzzy Hash: e0a0ce66a521f16669e6ec374153c38f679e757f4bc1faacd3ce38bf1e3ec962
Instruction Fuzzy Hash: 8B81C271908B4282EB10DB68E8415AD73A1FF44BA4F950336D7AD46AF8DF3CE659CB01

Function 00007FF8B7DF7484 Relevance: 36.9, APIs: 17, Strings: 4, Instructions: 183COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF74D7
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,[Info 469]: Set debug level as 4), ref: 00007FF8B7DF751F
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF750E

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF755C
CreateEventW.KERNEL32 ref: 00007FF8B7DF758C
DeviceIoControl.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,[Info 469]: Set debug level as 4), ref: 00007FF8B7DF75CD
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,[Info 469]: Set debug level as 4), ref: 00007FF8B7DF75DB
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,[Info 469]: Set debug level as 4), ref: 00007FF8B7DF760A
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7645
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,[Info 469]: Set debug level as 4), ref: 00007FF8B7DF7656
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7697
GetOverlappedResult.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,[Info 469]: Set debug level as 4), ref: 00007FF8B7DF76BC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,[Info 469]: Set debug level as 4), ref: 00007FF8B7DF76E3
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7760
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,[Info 469]: Set debug level as 4), ref: 00007FF8B7DF7771
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF77F3
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,[Info 469]: Set debug level as 4), ref: 00007FF8B7DF7805

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF7490, 00007FF8B7DF74F3, 00007FF8B7DF7555, 00007FF8B7DF7622, 00007FF8B7DF767E, 00007FF8B7DF771A, 00007FF8B7DF77B3
[%s %4d]: Get mac fails with empty handle!, xrefs: 00007FF8B7DF74E4, 00007FF8B7DF753C
[%s %4d]: Device control get mac %02X:%02X:%02X:%02X:%02X:%02X, size %d., xrefs: 00007FF8B7DF7738, 00007FF8B7DF77D5
[%s %4d]: Device control get mac fails: %d!!!!, xrefs: 00007FF8B7DF7617, 00007FF8B7DF766F

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$EnterLeave$CurrentErrorLast$ByteCharCloseControlCreateDeviceEventHandleLocalMultiOverlappedProcessReleaseResultSemaphoreThreadTimeWide
String ID: [%s %4d]: Device control get mac %02X:%02X:%02X:%02X:%02X:%02X, size %d.$[%s %4d]: Device control get mac fails: %d!!!!$[%s %4d]: Get mac fails with empty handle!$[Info 469]: Set debug level as 4
API String ID: 287153219-2761849882
Opcode ID: 890fe7461e9dcc75220950ed012f50050090582fa9ba6c17d89822c44dbebd85
Instruction ID: dcced2b494664dbee64a2d61b2156601fdd40000a0e1db46049c6a3ed9a4687e
Opcode Fuzzy Hash: 890fe7461e9dcc75220950ed012f50050090582fa9ba6c17d89822c44dbebd85
Instruction Fuzzy Hash: 3CA10672918B8286E761CF28F8405AE77A1FB447A4F940335E7AD06AB8DF3CE555CB00

Function 00007FF8B7DF5C18 Relevance: 36.9, APIs: 17, Strings: 4, Instructions: 156COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF5C67
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000004,00007FF8B7DF4D09), ref: 00007FF8B7DF5CB3
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF5CA2

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF5CF0
CreateEventW.KERNEL32 ref: 00007FF8B7DF5D1D
DeviceIoControl.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000004,00007FF8B7DF4D09), ref: 00007FF8B7DF5D57
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000004,00007FF8B7DF4D09), ref: 00007FF8B7DF5D83
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF5DC5
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000004,00007FF8B7DF4D09), ref: 00007FF8B7DF5DD6
GetOverlappedResult.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000004,00007FF8B7DF4D09), ref: 00007FF8B7DF5DEB
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000004,00007FF8B7DF4D09), ref: 00007FF8B7DF5DF5
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF5E4B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000004,00007FF8B7DF4D09), ref: 00007FF8B7DF5E57
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000004,00007FF8B7DF4D09), ref: 00007FF8B7DF5E88
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF5ECE
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000004,00007FF8B7DF4D09), ref: 00007FF8B7DF5EDF
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF5F2A

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF5C83, 00007FF8B7DF5CE9, 00007FF8B7DF5D97, 00007FF8B7DF5E3F, 00007FF8B7DF5E9C, 00007FF8B7DF5F16
[%s %4d]: Set driver control parameter fails with empty handle!, xrefs: 00007FF8B7DF5C74, 00007FF8B7DF5CD0
[%s %4d]: Device control set control parameter as 0x%X., xrefs: 00007FF8B7DF5D8C, 00007FF8B7DF5E1F
[%s %4d]: Device control set control parameter %d fails: %d!!!!, xrefs: 00007FF8B7DF5E91, 00007FF8B7DF5EFA

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$EnterLeave$CurrentErrorLast$ByteCharCloseControlCreateDeviceEventHandleLocalMultiOverlappedProcessReleaseResultSemaphoreThreadTimeWide
String ID: [%s %4d]: Device control set control parameter %d fails: %d!!!!$[%s %4d]: Device control set control parameter as 0x%X.$[%s %4d]: Set driver control parameter fails with empty handle!$[Info 469]: Set debug level as 4
API String ID: 287153219-1190518420
Opcode ID: 4f84a8eb5a6df052ec9cc2bb1337a090418fa76ba3ac94f722ecbfc5e1195fe6
Instruction ID: 0fa737a5e261ad6065173e7028acc5cf2b851d2449e4ab480c7c04d50c341398
Opcode Fuzzy Hash: 4f84a8eb5a6df052ec9cc2bb1337a090418fa76ba3ac94f722ecbfc5e1195fe6
Instruction Fuzzy Hash: D491E671908B4296EB10DB68E8456AD37A0FF44BA8F540336E66E46AF8DF3CE159C740

Function 00007FF8B7DF58F8 Relevance: 36.9, APIs: 17, Strings: 4, Instructions: 150COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF5949
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF5995
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF5984

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF59D2
CreateEventW.KERNEL32 ref: 00007FF8B7DF5A00
DeviceIoControl.KERNEL32 ref: 00007FF8B7DF5A41
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF5A6D
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF5AB0
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF5AC1
GetOverlappedResult.KERNEL32 ref: 00007FF8B7DF5ADB
CloseHandle.KERNEL32 ref: 00007FF8B7DF5AE6
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF5B39
GetLastError.KERNEL32 ref: 00007FF8B7DF5B45
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF5B72
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF5BB1
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF5BC2
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF5C06

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF5965, 00007FF8B7DF59CB, 00007FF8B7DF5A82, 00007FF8B7DF5B2D, 00007FF8B7DF5B8A, 00007FF8B7DF5BED
[%s %4d]: Device control set debug level fails: %d!!!!, xrefs: 00007FF8B7DF5B7F, 00007FF8B7DF5BDE
[%s %4d]: Device control set debug level as %d., xrefs: 00007FF8B7DF5A77, 00007FF8B7DF5B0D
[%s %4d]: Set debug level fails with empty handle!, xrefs: 00007FF8B7DF5956, 00007FF8B7DF59B2

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$EnterLeave$CurrentErrorLast$ByteCharCloseControlCreateDeviceEventHandleLocalMultiOverlappedProcessReleaseResultSemaphoreThreadTimeWide
String ID: [%s %4d]: Device control set debug level as %d.$[%s %4d]: Device control set debug level fails: %d!!!!$[%s %4d]: Set debug level fails with empty handle!$[Info 469]: Set debug level as 4
API String ID: 287153219-4161952853
Opcode ID: d66b97674cc0ea9c10e0c0def8133eb3b555479c0802e432b103fb37efe6fdd4
Instruction ID: bf68135afa7984d41e6e9f7f90b403f4ce76e3a1ee3863ba82c119ad462a1105
Opcode Fuzzy Hash: d66b97674cc0ea9c10e0c0def8133eb3b555479c0802e432b103fb37efe6fdd4
Instruction Fuzzy Hash: C881F771908B4296EB11DB68E8456AD7360FF44BA4F540336D7AE46AF8DF3CE259CB00

Function 00007FF8B7DF78F4 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 122COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF793A
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF7985
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7974

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF79C1
CloseHandle.KERNEL32 ref: 00007FF8B7DF79DD
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF7A16
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7A4D
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF7A5E
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7A91
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF7AD6
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7B12
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF7B23
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7B5A

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF7956, 00007FF8B7DF79BA, 00007FF8B7DF7A32, 00007FF8B7DF7A7B, 00007FF8B7DF7AEE, 00007FF8B7DF7B3C
[%s %4d]: Receive device stop event and close device., xrefs: 00007FF8B7DF7A23, 00007FF8B7DF7A6C
[%s %4d]: Service callback function is called to notify interface removal with return code %d., xrefs: 00007FF8B7DF7AE3, 00007FF8B7DF7B31
[%s %4d]: Receive device stop event but device already closed!, xrefs: 00007FF8B7DF7947, 00007FF8B7DF79A2

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$EnterLeave$Current$ByteCharCloseErrorHandleLastLocalMultiProcessReleaseSemaphoreThreadTimeWide
String ID: [%s %4d]: Receive device stop event and close device.$[%s %4d]: Receive device stop event but device already closed!$[%s %4d]: Service callback function is called to notify interface removal with return code %d.$[Info 469]: Set debug level as 4
API String ID: 3374128888-2852171108
Opcode ID: b3894e48caf0e982e3fce08a9d1f4dbb5d321793e6f5cb03ad0df2735567c227
Instruction ID: 3934d08bd28935614de29282b2b82be603881e88904a7d71aeb6595ca5e7ff62
Opcode Fuzzy Hash: b3894e48caf0e982e3fce08a9d1f4dbb5d321793e6f5cb03ad0df2735567c227
Instruction Fuzzy Hash: 0B611571908B4686EB11DB18E8442BD7760BF45BE4F850235DB5D47AB9DF3CE248C701

Function 00007FF8B7DF7E8C Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 160COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF7EF0
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7F2D
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF7F3E
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF7F9B
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7FF4
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF801F
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF807C
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF80EC
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF80FD
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF8170
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF8182

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF7F12, 00007FF8B7DF7FDF, 00007FF8B7DF80AB, 00007FF8B7DF8135
[%s %4d]: Register returns MAC %02x:%02x:%02x:%02x:%02x:%02x., xrefs: 00007FF8B7DF80C9, 00007FF8B7DF8157
[%s %4d]: Register inSize is too small: %d, xrefs: 00007FF8B7DF7EF8, 00007FF8B7DF7F65
[%s %4d]: Register outSize is too small: %d, xrefs: 00007FF8B7DF7FA3, 00007FF8B7DF7FBF

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: CriticalSection$Enter_snwprintf_s$Leave
String ID: [%s %4d]: Register inSize is too small: %d$[%s %4d]: Register outSize is too small: %d$[%s %4d]: Register returns MAC %02x:%02x:%02x:%02x:%02x:%02x.$[Info 469]: Set debug level as 4
API String ID: 2677837863-3710789241
Opcode ID: a7b3ec41be6f090cb06ddbf134031e1bd8a4cd92be0326d8e069be50c1c8ba2b
Instruction ID: d3862ab562e528ed26abdca116d1d8fe61aa727de6fd13e417f085aa83cf43be
Opcode Fuzzy Hash: a7b3ec41be6f090cb06ddbf134031e1bd8a4cd92be0326d8e069be50c1c8ba2b
Instruction Fuzzy Hash: 44911972908B8286E755CF18E8406AD77A0FB45BE4F540236DBAD47AB8CF3CE554CB10

Function 00007FF8B7E068CC Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 190COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B7E069B4
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E069EF

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

LeaveCriticalSection.KERNEL32 ref: 00007FF8B7E06A00
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E06A43
EnterCriticalSection.KERNEL32 ref: 00007FF8B7E06AFF

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7E068E0, 00007FF8B7E069D4, 00007FF8B7E06A37, 00007FF8B7E06B9C, 00007FF8B7E06BF3
[%s %4d]: SetIpInfFuncCall failed on error %d!, xrefs: 00007FF8B7E06B09, 00007FF8B7E06B21
[%s %4d]: GetIpInfFuncCall failed on error %d!, xrefs: 00007FF8B7E069BE, 00007FF8B7E06A0F
IPv6, xrefs: 00007FF8B7E06B65, 00007FF8B7E06BCC
[%s %4d]: Restore %s strong host model for interface %d, xrefs: 00007FF8B7E06B7A, 00007FF8B7E06BD3
IPv4, xrefs: 00007FF8B7E06B5E, 00007FF8B7E06BC0

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$CurrentEnter$ByteCharErrorLastLeaveLocalMultiProcessReleaseSemaphoreThreadTimeWide
String ID: IPv4$IPv6$[%s %4d]: GetIpInfFuncCall failed on error %d!$[%s %4d]: Restore %s strong host model for interface %d$[%s %4d]: SetIpInfFuncCall failed on error %d!$[Info 469]: Set debug level as 4
API String ID: 2887051932-3559288475
Opcode ID: 082652f297f5598da2b809c6fce9a3e8c44877aebf89fc8bf204f7d6e3bcacbe
Instruction ID: d658f8b07a158c2ac8eb4de943e98f75c550b06ad4b5937de7242f24ff146174
Opcode Fuzzy Hash: 082652f297f5598da2b809c6fce9a3e8c44877aebf89fc8bf204f7d6e3bcacbe
Instruction Fuzzy Hash: 4DA16962A08B4286EB21DB18E8857BD37A1EF85BD4F550136DB4E47AB4DF3CE149C740

Function 00007FF8B7DFB944 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 135COMMON

Download Yara Rule

APIs

SetupDiBuildDriverInfoList.SETUPAPI ref: 00007FF8B7DFB993
SetupDiEnumDriverInfoW.SETUPAPI ref: 00007FF8B7DFB9D3

Part of subcall function 00007FF8B7E0FF28: _invalid_parameter_noinfo.LIBCMT ref: 00007FF8B7E0FF48

SetupDiGetDriverInfoDetailW.SETUPAPI ref: 00007FF8B7DFBA63
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFBA8F
GetLastError.KERNEL32 ref: 00007FF8B7DFBA9F
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFBADC
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFBAED
GetLastError.KERNEL32 ref: 00007FF8B7DFBAF5
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFBB32

Part of subcall function 00007FF8B7DF2990: GetLocalTime.KERNEL32 ref: 00007FF8B7DF29D4
Part of subcall function 00007FF8B7DF2990: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF2A1F
Part of subcall function 00007FF8B7DF2990: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF2A27
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2A78
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2AAA
Part of subcall function 00007FF8B7DF2990: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF2AE8
Part of subcall function 00007FF8B7DF2990: GetLastError.KERNEL32 ref: 00007FF8B7DF2AF4
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2B12
Part of subcall function 00007FF8B7DF2990: GetModuleFileNameW.KERNEL32 ref: 00007FF8B7DF2B5D

SetupDiEnumDriverInfoW.SETUPAPI ref: 00007FF8B7DFBB60

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DFB954, 00007FF8B7DFBAD0, 00007FF8B7DFBB26
PaloAltoNetworks, xrefs: 00007FF8B7DFBA00
PANGP Virtual Ethernet Adapter Secure, xrefs: 00007FF8B7DFB9E7
[%s %4d]: SetupDiGetDriverInfoDetail failed, %d., xrefs: 00007FF8B7DFBAAB, 00007FF8B7DFBB01

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$DriverInfoSetup$ErrorLast$CriticalCurrentEnumSection$BuildByteCharDetailEnterFileLeaveListLocalModuleMultiNameProcessThreadTimeWide_invalid_parameter_noinfo
String ID: PANGP Virtual Ethernet Adapter Secure$PaloAltoNetworks$[%s %4d]: SetupDiGetDriverInfoDetail failed, %d.$[Info 469]: Set debug level as 4
API String ID: 3127819313-2256018993
Opcode ID: d0286f0f838c87e16b2756b316a516824138eb8c1b67819143518283f0bc0b0e
Instruction ID: 80f3a9d5c9f462abfffc99c4d7c58db88a9f4e731a5faf24923d85ad9939b1fe
Opcode Fuzzy Hash: d0286f0f838c87e16b2756b316a516824138eb8c1b67819143518283f0bc0b0e
Instruction Fuzzy Hash: 81518C21A08B8286FA60DF69E8456BE6765BF94BE4F440331DB5D47AB8DF3CE105C704

Function 00007FF8B7E01B4C Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

SetupUninstallOEMInfW.SETUPAPI ref: 00007FF8B7E01B64
EnterCriticalSection.KERNEL32 ref: 00007FF8B7E01B90
GetLastError.KERNEL32 ref: 00007FF8B7E01BAA
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E01BEE
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7E01BFF
GetLastError.KERNEL32 ref: 00007FF8B7E01C11
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E01C55
EnterCriticalSection.KERNEL32 ref: 00007FF8B7E01C84
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E01CCE
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7E01CDF
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7E01D2B

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7E01BCD, 00007FF8B7E01C49, 00007FF8B7E01CB1, 00007FF8B7E01D12
[%s %4d]: Uninstall %s successfully., xrefs: 00007FF8B7E01CA5, 00007FF8B7E01D03
[%s %4d]: Uninstall %s failed 0x%08x., xrefs: 00007FF8B7E01BC1, 00007FF8B7E01C28

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: CriticalSection_snwprintf_s$EnterErrorLastLeave$SetupUninstall
String ID: [%s %4d]: Uninstall %s failed 0x%08x.$[%s %4d]: Uninstall %s successfully.$[Info 469]: Set debug level as 4
API String ID: 2591746515-1975311169
Opcode ID: 7b6865218dfd02d127b861c61ac631eb8a2a83f8b0b811dd5b423c2ef35a8b83
Instruction ID: fd2146e7cc9e775713b5f6f58538e9d242ac220f8ac87c73bbe02a114fec8d46
Opcode Fuzzy Hash: 7b6865218dfd02d127b861c61ac631eb8a2a83f8b0b811dd5b423c2ef35a8b83
Instruction Fuzzy Hash: 7151E571918B4282EB15CB2CE8852AD7361FF45BA4F940235E76D066F8DF3CE258C741

Function 00007FF8B7DF1CF0 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 77synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32 ref: 00007FF8B7DF1D04
WaitForSingleObject.KERNEL32 ref: 00007FF8B7DF1D13
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF1D3F
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF1D8B
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF1D7A

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF1DC8
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF1DFC
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF1E37
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF1E48
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF1E85

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF1D5B, 00007FF8B7DF1DBC, 00007FF8B7DF1E18, 00007FF8B7DF1E79
[%s %4d]: Log thread stops., xrefs: 00007FF8B7DF1D4C, 00007FF8B7DF1DA8
[%s %4d]: Log thread stops timeout!, xrefs: 00007FF8B7DF1E09, 00007FF8B7DF1E65

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$CurrentEnterLeave$ByteCharErrorEventLastLocalMultiObjectProcessReleaseSemaphoreSingleThreadTimeWaitWide
String ID: [%s %4d]: Log thread stops timeout!$[%s %4d]: Log thread stops.$[Info 469]: Set debug level as 4
API String ID: 1175488815-3652924591
Opcode ID: 7ffebcbf5de7d38fa7bc6314b9a1f0b0cdf9f2fe9f41d59c2d74ab2059f04c6c
Instruction ID: df19bdecf1d0d5f04d3014eddca80ad1198aa8f4003b8ee6af92307a49c6a496
Opcode Fuzzy Hash: 7ffebcbf5de7d38fa7bc6314b9a1f0b0cdf9f2fe9f41d59c2d74ab2059f04c6c
Instruction Fuzzy Hash: 3B41E270A48B4682EB10DB28E8452BD3360AF44BF8F950335D66D4A6F8DF7DE289C701

Function 00007FF8B7DF1F54 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 108timethreadCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
GetLastError.KERNEL32 ref: 00007FF8B7DF2098
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF203C
(P%u-T%u)%02d/%02d/%02d %02d:%02d:%02d:%03d, xrefs: 00007FF8B7DF1FDC
Convert log to UTF8 fails with error %d, xrefs: 00007FF8B7DF209E

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$Current$ByteCharErrorLastLocalMultiProcessReleaseSemaphoreThreadTimeWide
String ID: (P%u-T%u)%02d/%02d/%02d %02d:%02d:%02d:%03d$Convert log to UTF8 fails with error %d$[Info 469]: Set debug level as 4
API String ID: 887299508-321631180
Opcode ID: 7c5631741df774f21bdc2438580f4fed470dc08bd2d9ca94a352e7f65f5870dc
Instruction ID: 04029964b87ce2105665293745a6a7df0de95b018a2bdea37ef0807ceeedebc8
Opcode Fuzzy Hash: 7c5631741df774f21bdc2438580f4fed470dc08bd2d9ca94a352e7f65f5870dc
Instruction Fuzzy Hash: 96516C72A08B918AE750CF79E4401AE77A5FB88B98F510226EF4D53B68DF3CD155CB00

Function 00007FF8B7DF9D60 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 93COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B7DF9980: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF99E3

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF9D98
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF9DFF
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF9E40
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF9EF0
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF9F01
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF9F3E

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF9E12, 00007FF8B7DF9E77, 00007FF8B7DF9EE9, 00007FF8B7DF9F32
[%s %4d]: Service callback table is empty!, xrefs: 00007FF8B7DF9DA5, 00007FF8B7DF9DCB
[%s %4d]: Service callback table gets set., xrefs: 00007FF8B7DF9EC2, 00007FF8B7DF9F11
[%s %4d]: Service callback table size %d is too small!, xrefs: 00007FF8B7DF9E07, 00007FF8B7DF9E5B

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$Enter$Leave
String ID: [%s %4d]: Service callback table gets set.$[%s %4d]: Service callback table is empty!$[%s %4d]: Service callback table size %d is too small!$[Info 469]: Set debug level as 4
API String ID: 1851125429-2070865504
Opcode ID: 24c0a5177a46bb72abd0e47b3df26f212a7821c77213ebce9e8415cda70d7f36
Instruction ID: 51d1dc65f7ed94a3215e9d9388f5950544e3b541e3ddf1245c065fb8479c7045
Opcode Fuzzy Hash: 24c0a5177a46bb72abd0e47b3df26f212a7821c77213ebce9e8415cda70d7f36
Instruction Fuzzy Hash: A2510471908B4282EB20CB1CE8406AD7360BF45BE4F950336D66D46AF8CF7CE288C701

Function 00007FF8B7E07CD0 Relevance: 16.7, APIs: 11, Instructions: 235COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF8B7E07CF8
_RTC_Initialize.LIBCMT ref: 00007FF8B7E07D8C
__scrt_initialize_default_local_stdio_options.LIBCMT ref: 00007FF8B7E07D96
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00007FF8B7E07DB2
__scrt_release_startup_lock.LIBCMT ref: 00007FF8B7E07DDD
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 00007FF8B7E07DFC
__scrt_fastfail.LIBCMT ref: 00007FF8B7E07E32
_RTC_Initialize.LIBCMT ref: 00007FF8B7E07E93
__scrt_release_startup_lock.LIBCMT ref: 00007FF8B7E07EA6
__scrt_uninitialize_crt.LIBCMT ref: 00007FF8B7E07EB0
__scrt_fastfail.LIBCMT ref: 00007FF8B7E07EC3

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: Initialize__scrt_fastfail__scrt_release_startup_lock$__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_initialize_default_local_stdio_options__scrt_is_nonwritable_in_current_image__scrt_uninitialize_crt
String ID:
API String ID: 2704328629-0
Opcode ID: 1c56be4a9dfa0662042af022014ec7e088bfc9e0cb11a7f06b8d61f004596aab
Instruction ID: a8bdaea6a5c3708d3d5ffb410ae67ae6581f7f68c86ba78bf624333f8e9a1b4e
Opcode Fuzzy Hash: 1c56be4a9dfa0662042af022014ec7e088bfc9e0cb11a7f06b8d61f004596aab
Instruction Fuzzy Hash: D5918E21E0C7478AFE54AB6DA8426BE6790AF85FC0F544035EB4DA77B6DE3CE8518700

Function 00007FF8B7E12EF4 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 104COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8B7E13062

Strings

INF, xrefs: 00007FF8B7E12F68
NAN, xrefs: 00007FF8B7E12F52
NAN(SNAN), xrefs: 00007FF8B7E12F8A
nan(snan), xrefs: 00007FF8B7E12F95
nan(ind), xrefs: 00007FF8B7E12FBA
nan, xrefs: 00007FF8B7E12F59
NAN(IND), xrefs: 00007FF8B7E12FA0
inf, xrefs: 00007FF8B7E12F7B

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: 79a3a3dc4ee6f9c905ac33904ebdc2dabe8275cd7fbe4b8ae3facb8ac18ad8e9
Instruction ID: 7dc973f5d04973cc5094fd67bf6390f39b6d1c4356efaf10a26d35b6cd4e30e9
Opcode Fuzzy Hash: 79a3a3dc4ee6f9c905ac33904ebdc2dabe8275cd7fbe4b8ae3facb8ac18ad8e9
Instruction Fuzzy Hash: 59416B36B08B4189E750CB69E8527AE33A9FF18B88F404536EB5D17BA9DE3CD525C340

Function 00007FF8B7DF62F8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32 ref: 00007FF8B7DF6357
GetLastError.KERNEL32 ref: 00007FF8B7DF6365
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF6395
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF63D4

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF63E5
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF6426

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF63AD, 00007FF8B7DF641A
[%s %4d]: AsnycReadAdapter: DeviceIoControl fail,error %d, xrefs: 00007FF8B7DF63A2, 00007FF8B7DF63FE

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalCurrentErrorLastSection$ByteCharControlDeviceEnterLeaveLocalMultiProcessReleaseSemaphoreThreadTimeWide
String ID: [%s %4d]: AsnycReadAdapter: DeviceIoControl fail,error %d$[Info 469]: Set debug level as 4
API String ID: 1713224125-921880769
Opcode ID: cabcc259d6f5112d9642cab0d38b184c5c9df7cb690514d7662518173b7fa199
Instruction ID: e8d56b473d81df69908fc02aba693de66ca5c574d85abd054ab1396abb5f3939
Opcode Fuzzy Hash: cabcc259d6f5112d9642cab0d38b184c5c9df7cb690514d7662518173b7fa199
Instruction Fuzzy Hash: 38312562A08B4686E720DF58E4411AE7760FF44BE4F540335EBAD07AB8DF3CE1449B00

Function 00007FF8B7E04814 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 67libraryloaderregistryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,00000001,00007FF8B7E02EB4), ref: 00007FF8B7E04842
GetProcAddress.KERNEL32(?,?,?,?,?,?,00000001,00007FF8B7E02EB4), ref: 00007FF8B7E04857
RegDeleteKeyW.ADVAPI32(?,?,?,?,?,?,00000001,00007FF8B7E02EB4), ref: 00007FF8B7E0488D
GetModuleHandleW.KERNEL32(?,?,?,?,?,?,00000001,00007FF8B7E02EB4), ref: 00007FF8B7E048BA
GetProcAddress.KERNEL32(?,?,?,?,?,?,00000001,00007FF8B7E02EB4), ref: 00007FF8B7E048CF

Strings

RegDeleteKeyExW, xrefs: 00007FF8B7E048C5
RegDeleteKeyTransactedW, xrefs: 00007FF8B7E0484D
Advapi32.dll, xrefs: 00007FF8B7E0483B, 00007FF8B7E048B3

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: AddressHandleModuleProc$Delete
String ID: Advapi32.dll$RegDeleteKeyExW$RegDeleteKeyTransactedW
API String ID: 2668475584-1053001802
Opcode ID: edce9898f3a27a2757000eedf422dd00da7115e395bbd268d22a9176be04e61e
Instruction ID: 1bcba221c033884346bb68c7120419b345167a7db809cbe2e735995d784ef691
Opcode Fuzzy Hash: edce9898f3a27a2757000eedf422dd00da7115e395bbd268d22a9176be04e61e
Instruction Fuzzy Hash: 1C310621A08B8281FB548B19E95573D63A0AF4AFC4F494835DB0E0BBB8DF7CE5559720

Function 00007FF8B7DF81CC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32 ref: 00007FF8B7DF825D
EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF829B
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF82D6
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF82E7
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF833A

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF82B7, 00007FF8B7DF832E
[%s %4d]: Device handle is invalid now., xrefs: 00007FF8B7DF82A8, 00007FF8B7DF831A

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: CriticalSection_snwprintf_s$EnterEventLeaveReset
String ID: [%s %4d]: Device handle is invalid now.$[Info 469]: Set debug level as 4
API String ID: 885793146-1518477555
Opcode ID: 3c7b70b99528c07011082e571dabb9af0fd244ce3d4b20f9fcfa219fd6c2e9de
Instruction ID: d67d04dacda8e4f963a6e51cf45a8b6eca85d24675c43d52f835a06af0b8f7f7
Opcode Fuzzy Hash: 3c7b70b99528c07011082e571dabb9af0fd244ce3d4b20f9fcfa219fd6c2e9de
Instruction Fuzzy Hash: 4A415871A08B4282EA10DB18E8442AD6360AF55BE4F940332DB6D5BAF9DF3CE145C301

Function 00007FF8B7E038D8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 53serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32 ref: 00007FF8B7E0390E
OpenServiceW.ADVAPI32 ref: 00007FF8B7E03933
CloseServiceHandle.ADVAPI32 ref: 00007FF8B7E03975

Strings

ServicesActive, xrefs: 00007FF8B7E03905
PANGPD, xrefs: 00007FF8B7E03929

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: OpenService$CloseHandleManager
String ID: PANGPD$ServicesActive
API String ID: 4136619037-4162728576
Opcode ID: d7529c6138cbc94ff1a336ccbfb07a9e9c2bc86cf04f147216e85d7b554fb240
Instruction ID: e62632bc788e3fbaa1f0a8db446be53b386ffb259bcf46c549214cc2f4df6c1d
Opcode Fuzzy Hash: d7529c6138cbc94ff1a336ccbfb07a9e9c2bc86cf04f147216e85d7b554fb240
Instruction Fuzzy Hash: 43210E31A0975682E664CB1EA54613E67A1FF89FC4B844039DB4D47B78EF3CE5069B04

Function 00007FF8B7DF3B90 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI ref: 00007FF8B7DF3BD7
GetAdaptersAddresses.IPHLPAPI ref: 00007FF8B7DF3C0E
wcsstr.LIBVCRUNTIME ref: 00007FF8B7DF3C4D
wcsstr.LIBVCRUNTIME ref: 00007FF8B7DF3C62

Strings

Switch, xrefs: 00007FF8B7DF3C5B
PANGP Virtual, xrefs: 00007FF8B7DF3C2C, 00007FF8B7DF3C46

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: AdaptersAddresseswcsstr
String ID: PANGP Virtual$Switch
API String ID: 1462488310-814056232
Opcode ID: d2f72310bd293871a6035fbe340699e8168c0af0d4aaea18a1047a72a1e205e4
Instruction ID: 6bf82e9a8dbb8b8bc1ff9ed6255ff9f6ce7d2ab52ee90ffff906b6a0c258084a
Opcode Fuzzy Hash: d2f72310bd293871a6035fbe340699e8168c0af0d4aaea18a1047a72a1e205e4
Instruction Fuzzy Hash: 9B317C21B09B4286EA149F19D5415BD7361EF40FC4F4A4535DF4C0BBB9DF2CE5668710

Function 00007FF8B7DFA040 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFA096
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFA0D1
LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DFA0E2

Part of subcall function 00007FF8B7DF7E8C: EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF7EF0
Part of subcall function 00007FF8B7DF7E8C: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7F2D
Part of subcall function 00007FF8B7DF7E8C: LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF7F3E

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFA11F

Part of subcall function 00007FF8B7DF2990: GetLocalTime.KERNEL32 ref: 00007FF8B7DF29D4
Part of subcall function 00007FF8B7DF2990: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF2A1F
Part of subcall function 00007FF8B7DF2990: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF2A27
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2A78
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2AAA
Part of subcall function 00007FF8B7DF2990: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF2AE8
Part of subcall function 00007FF8B7DF2990: GetLastError.KERNEL32 ref: 00007FF8B7DF2AF4
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2B12
Part of subcall function 00007FF8B7DF2990: GetModuleFileNameW.KERNEL32 ref: 00007FF8B7DF2B5D

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DFA0B2, 00007FF8B7DFA113
[%s %4d]: Register ends., xrefs: 00007FF8B7DFA0A3, 00007FF8B7DFA0FF

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalSection$CurrentEnterLeave$ByteCharErrorFileLastLocalModuleMultiNameProcessThreadTimeWide
String ID: [%s %4d]: Register ends.$[Info 469]: Set debug level as 4
API String ID: 3703070683-412271315
Opcode ID: ffbeec7e6b7518b1a3685aff55abea3adaaa1cbf4b41ec66a0194ac6d849fdd2
Instruction ID: b623caf8da996638b98ae2b15b5e7f6766d08b3b5fe280a3101280f0a8bf285b
Opcode Fuzzy Hash: ffbeec7e6b7518b1a3685aff55abea3adaaa1cbf4b41ec66a0194ac6d849fdd2
Instruction Fuzzy Hash: F4210565908B4392EB10DB1CE8812AE63A0AF59BE4F950335DB6C476F9DF3CE559C700

Function 00007FF8B7E1BBCC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF8B7E1BBFD
GetLastError.KERNEL32 ref: 00007FF8B7E1BC09
CloseHandle.KERNEL32 ref: 00007FF8B7E1BC21
CreateFileW.KERNEL32 ref: 00007FF8B7E1BC4C
WriteConsoleW.KERNEL32 ref: 00007FF8B7E1BC6B

Strings

CONOUT$, xrefs: 00007FF8B7E1BC2D

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: f2b7465675a73b268e3db0874b101e6eddc9425e10f00d0a477c80d06341bd08
Instruction ID: 65ff00aea9765a19004325f3e106b3dd9cd7de5b754854971a1502d8789a3942
Opcode Fuzzy Hash: f2b7465675a73b268e3db0874b101e6eddc9425e10f00d0a477c80d06341bd08
Instruction Fuzzy Hash: F0115B31A18B5286E7908B5AE85632E63A4FF88FE4F044234EB5D87BA4DF7CD9058744

Function 00007FF8B7DF9F60 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF9F82
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF9FBD

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF9FCE
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFA00B

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF9F9E, 00007FF8B7DF9FFF
[%s %4d]: ----Driver Control is being stopped, xrefs: 00007FF8B7DF9F8F, 00007FF8B7DF9FEB

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalCurrentSection$ByteCharEnterErrorLastLeaveLocalMultiProcessReleaseSemaphoreThreadTimeWide
String ID: [%s %4d]: ----Driver Control is being stopped$[Info 469]: Set debug level as 4
API String ID: 1191451920-3635964496
Opcode ID: 463271b82aab8bf3d3dc27dfd07bde5561cf6f75a6dcdabeb681b0f272660177
Instruction ID: 21de26b16c95d6439ce548a5129efa4e8d0185dff2ecab47011198d36a211bd3
Opcode Fuzzy Hash: 463271b82aab8bf3d3dc27dfd07bde5561cf6f75a6dcdabeb681b0f272660177
Instruction Fuzzy Hash: F121C270948B4796EA15DB2CE8452AD27A0AF45BE4F950335D66D4AAF8CF3CE249C700

Function 00007FF8B7DF5440 Relevance: 10.5, APIs: 7, Instructions: 40COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF8B7DF545C
CloseHandle.KERNEL32 ref: 00007FF8B7DF5473
CloseHandle.KERNEL32 ref: 00007FF8B7DF548D
CloseHandle.KERNEL32 ref: 00007FF8B7DF54A7
CloseHandle.KERNEL32 ref: 00007FF8B7DF54BE
CloseHandle.KERNEL32 ref: 00007FF8B7DF54D5
DeleteCriticalSection.KERNEL32 ref: 00007FF8B7DF54E7

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: CloseHandle$CriticalDeleteSection
String ID:
API String ID: 2166061224-0
Opcode ID: 4f53d00099bdc521131582aa34919d9f5a280f25003cb090248e5ffa3446cfcc
Instruction ID: a65bb935278ec69ee9c9cdaf8d68e3763a86af8732d4624fb03d3787525bbdf1
Opcode Fuzzy Hash: 4f53d00099bdc521131582aa34919d9f5a280f25003cb090248e5ffa3446cfcc
Instruction Fuzzy Hash: 6C110622A06B4186FB95DF68D06937D23A0FF40FCAF184235CB0E4E568CF2C94599350

Function 00007FF8B7DF7828 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF7855
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF7890

Part of subcall function 00007FF8B7DF1F54: GetLocalTime.KERNEL32 ref: 00007FF8B7DF1F9B
Part of subcall function 00007FF8B7DF1F54: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF1FCA
Part of subcall function 00007FF8B7DF1F54: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF1FD2
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF201D
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2048
Part of subcall function 00007FF8B7DF1F54: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF208E
Part of subcall function 00007FF8B7DF1F54: GetLastError.KERNEL32 ref: 00007FF8B7DF2098
Part of subcall function 00007FF8B7DF1F54: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF20B5
Part of subcall function 00007FF8B7DF1F54: ReleaseSemaphore.KERNEL32 ref: 00007FF8B7DF20DF

LeaveCriticalSection.KERNEL32 ref: 00007FF8B7DF78A1
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF78DE

Strings

[%s %4d]: Receive device start event but device already opened!, xrefs: 00007FF8B7DF7862, 00007FF8B7DF78BE
[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DF7871, 00007FF8B7DF78D7

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalCurrentSection$ByteCharEnterErrorLastLeaveLocalMultiProcessReleaseSemaphoreThreadTimeWide
String ID: [%s %4d]: Receive device start event but device already opened!$[Info 469]: Set debug level as 4
API String ID: 1191451920-1136374882
Opcode ID: 8bada34be505cb29f86489250a3923ffcd6509a7de82c8b8bf072d2e3e6b8c9b
Instruction ID: 03b3b3716eb08d0689351d719c76fc1cd9dafc7ee68f2e75c3a0d14d8c6351c7
Opcode Fuzzy Hash: 8bada34be505cb29f86489250a3923ffcd6509a7de82c8b8bf072d2e3e6b8c9b
Instruction Fuzzy Hash: 8111D360948B4382EA25DB68E8453BC3360BF44BB8F940335D36D4A6F8CF7CA299D601

Function 00007FF8B7DF1EA0 Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00007FF8B7DF11E8), ref: 00007FF8B7DF1EE3
CloseHandle.KERNEL32(?,?,?,00007FF8B7DF11E8), ref: 00007FF8B7DF1EF7
CloseHandle.KERNEL32(?,?,?,00007FF8B7DF11E8), ref: 00007FF8B7DF1F0B
CloseHandle.KERNEL32(?,?,?,00007FF8B7DF11E8), ref: 00007FF8B7DF1F1F
CloseHandle.KERNEL32(?,?,?,00007FF8B7DF11E8), ref: 00007FF8B7DF1F33
DeleteCriticalSection.KERNEL32(?,?,?,00007FF8B7DF11E8), ref: 00007FF8B7DF1F42

Part of subcall function 00007FF8B7E04A48: DeleteCriticalSection.KERNEL32(?,?,?,00007FF8B7DF1EC8,?,?,?,00007FF8B7DF11E8), ref: 00007FF8B7E04A57

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: CloseHandle$CriticalDeleteSection
String ID:
API String ID: 2166061224-0
Opcode ID: f9cf5e8692f4c79870772766ae2712d2bf1c5bfea114ea5623c31f36f315ae4e
Instruction ID: 9429a2d771b067974c469bdaf476b1699ae8298b8b1edb7ed781ad9c2062c9c1
Opcode Fuzzy Hash: f9cf5e8692f4c79870772766ae2712d2bf1c5bfea114ea5623c31f36f315ae4e
Instruction Fuzzy Hash: 6311B926A19B0586EB95DF69D1A933D2361FF84FC8F184235CB0E0A9A8CF3ED855D344

Function 00007FF8B7E01A60 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 56fileCOMMON

Download Yara Rule

APIs

SetupOpenInfFileW.SETUPAPI ref: 00007FF8B7E01AA8
SetupGetSourceInfoW.SETUPAPI ref: 00007FF8B7E01AF2
SetupCloseInfFile.SETUPAPI ref: 00007FF8B7E01B18

Strings

PANGP Virtual Ethernet Adapter Secure, xrefs: 00007FF8B7E01AFC
Net, xrefs: 00007FF8B7E01A9D

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: Setup$File$CloseInfoOpenSource
String ID: Net$PANGP Virtual Ethernet Adapter Secure
API String ID: 20482238-2944881926
Opcode ID: 62a76398dbb12ce457199824f7ba4c8710c559ae4325be1cf4c0b5d6ffd284db
Instruction ID: 8b712a85aa5c0179c4d48babca69878de8dd3dc2ea6383b6f2da333dbc2134e5
Opcode Fuzzy Hash: 62a76398dbb12ce457199824f7ba4c8710c559ae4325be1cf4c0b5d6ffd284db
Instruction Fuzzy Hash: 5021B632A18B4182EB60CB19E4412AE33A4FF84BD4F544631EB9D43AB4DF3CE509CB40

Function 00007FF8B7DFA140 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B7DFA176
_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFA1B1

Part of subcall function 00007FF8B7DF8190: EnterCriticalSection.KERNEL32 ref: 00007FF8B7DF81A5

_snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DFA202

Part of subcall function 00007FF8B7DF2990: GetLocalTime.KERNEL32 ref: 00007FF8B7DF29D4
Part of subcall function 00007FF8B7DF2990: GetCurrentThreadId.KERNEL32 ref: 00007FF8B7DF2A1F
Part of subcall function 00007FF8B7DF2990: GetCurrentProcessId.KERNEL32 ref: 00007FF8B7DF2A27
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2A78
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2AAA
Part of subcall function 00007FF8B7DF2990: WideCharToMultiByte.KERNEL32 ref: 00007FF8B7DF2AE8
Part of subcall function 00007FF8B7DF2990: GetLastError.KERNEL32 ref: 00007FF8B7DF2AF4
Part of subcall function 00007FF8B7DF2990: _snwprintf_s.LEGACY_STDIO_DEFINITIONS ref: 00007FF8B7DF2B12
Part of subcall function 00007FF8B7DF2990: GetModuleFileNameW.KERNEL32 ref: 00007FF8B7DF2B5D

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7DFA192, 00007FF8B7DFA1F6
[%s %4d]: Unregister ends., xrefs: 00007FF8B7DFA183, 00007FF8B7DFA1E2

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _snwprintf_s$CriticalCurrentEnterSection$ByteCharErrorFileLastLocalModuleMultiNameProcessThreadTimeWide
String ID: [%s %4d]: Unregister ends.$[Info 469]: Set debug level as 4
API String ID: 2712014206-2453299028
Opcode ID: d0d16b47c86237a4a49b755ea1b734fe454088389ceb9a27412f6ec6a865320d
Instruction ID: d45031eb2b8a4961bee913a627e519d7b7402e12154dfe11a9e47030035f6148
Opcode Fuzzy Hash: d0d16b47c86237a4a49b755ea1b734fe454088389ceb9a27412f6ec6a865320d
Instruction Fuzzy Hash: 8211E260908B8392FA21DB1CA8453AD2360AF55BF8F950335D66D466F9CF3CA299C611

Function 00007FF8B7E10B58 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF8B7E10B74
GetProcAddress.KERNEL32 ref: 00007FF8B7E10B8A
FreeLibrary.KERNEL32 ref: 00007FF8B7E10BA7

Strings

mscoree.dll, xrefs: 00007FF8B7E10B6B
CorExitProcess, xrefs: 00007FF8B7E10B83

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: ff591049c2bc3cece13b26654b840b8d51a733f96308f91be26069590edd98f1
Instruction ID: 33bd9b2e9e7ad30e1fe5458cca6498b526ce4fd2ae39a8859fbff4f65d7bdb0d
Opcode Fuzzy Hash: ff591049c2bc3cece13b26654b840b8d51a733f96308f91be26069590edd98f1
Instruction Fuzzy Hash: 60F05EA1B1970681EBD4DB19E88677E2360AF88FD5F041435D65F46970DF2CE588C300

Function 00007FF8B7E1A470 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8B7E1A4B1
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8B7E1A42F,?,?,?,00007FF8B7E1634B), ref: 00007FF8B7E1A570
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8B7E1A42F,?,?,?,00007FF8B7E1634B), ref: 00007FF8B7E1A5F0

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 7e994673a5fd9f8a0ebe8d2728ae62cf05159a5fc90101bc7bc29e897ef0188f
Instruction ID: b068c89ab749ed0954e3f92e29fa3cee7a4fbe70ff031965069d391c4ff51616
Opcode Fuzzy Hash: 7e994673a5fd9f8a0ebe8d2728ae62cf05159a5fc90101bc7bc29e897ef0188f
Instruction Fuzzy Hash: 6D81AA22A1CB5289FB91DB6988526BE67A0BF44FD8F444235DB0E53BB1DE3CA442C310

Function 00007FF8B7E1B638 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00007FF8B7E1B660
_set_statfp.LIBCMT ref: 00007FF8B7E1B67B
_set_statfp.LIBCMT ref: 00007FF8B7E1B697
_set_statfp.LIBCMT ref: 00007FF8B7E1B6D3

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 653bb921f2f61cac03e215ed7f57f66b21811514ef7dbbbb3b987cd90a740ecc
Instruction ID: e2fa4f9ff83414ec6f42e3c8f9e4538443c94667c31b71fe83206327e1d82e6e
Opcode Fuzzy Hash: 653bb921f2f61cac03e215ed7f57f66b21811514ef7dbbbb3b987cd90a740ecc
Instruction Fuzzy Hash: 4D118F22E58B4342F6D8116ED55337F1160AF65FE8F590634EB6E56AFACE1CA8814200

Function 00007FF8B7E0C848 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 176COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8B7E0C880
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8B7E0CAC7

Strings

[Info 469]: Set debug level as 4, xrefs: 00007FF8B7E0C852
*, xrefs: 00007FF8B7E0C98F

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *$[Info 469]: Set debug level as 4
API String ID: 3215553584-1343867596
Opcode ID: 06f61a348ae4d54427a4c5d2b8887536a5bcbf2d6a8c61ad9dac9ff8cf15cea4
Instruction ID: 1c10cd759f292c0c6a8ca9b957d848c9e11d64f52448d0d4d700cd5d72a0f77c
Opcode Fuzzy Hash: 06f61a348ae4d54427a4c5d2b8887536a5bcbf2d6a8c61ad9dac9ff8cf15cea4
Instruction Fuzzy Hash: 54717A729087128AE7688F2C90521BC36B0EF04F98F64153BDB4E462F9DB3CE9A1D714

Function 00007FF8B7E12AA8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 134COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8B7E12AEB

Strings

e+000, xrefs: 00007FF8B7E12B90
-, xrefs: 00007FF8B7E12BE2
gfff, xrefs: 00007FF8B7E12C0D

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$e+000$gfff
API String ID: 3215553584-2620144452
Opcode ID: c9aafc3d0b759529ca4a9c370a1f1d2df772e9da9c315cba1b1b3364b87fbdf0
Instruction ID: c81a5ee033e5d2ef85bc0057e03bff818b2f3837432a337ae95156e7b2d947f7
Opcode Fuzzy Hash: c9aafc3d0b759529ca4a9c370a1f1d2df772e9da9c315cba1b1b3364b87fbdf0
Instruction Fuzzy Hash: F4511362B187C286E7658F3D984276E6B95EB85FD0F089231D79C4BBE6CE2CE544C700

Function 00007FF8B7E0AE4A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B7E09CD0: __vcrt_getptd_noexit.LIBVCRUNTIME ref: 00007FF8B7E09CD4

__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF8B7E0AE72
RaiseException.KERNEL32 ref: 00007FF8B7E0AE9B
__DestructExceptionObject.LIBVCRUNTIME ref: 00007FF8B7E0AEFC

Strings

csm, xrefs: 00007FF8B7E0AECF

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: Exception$DestructObject$Raise__vcrt_getptd_noexit
String ID: csm
API String ID: 2280078643-1018135373
Opcode ID: b903f7c64750f0b48f6445caa1db3e9e8011d0404cbf49978d29ee310627f1b0
Instruction ID: ffdd05ccf62b38cd473fdd27bb975b2dc95bbfa9c6a8809c9cf371c5dc3e74b4
Opcode Fuzzy Hash: b903f7c64750f0b48f6445caa1db3e9e8011d0404cbf49978d29ee310627f1b0
Instruction Fuzzy Hash: 9B21F476A0874586E670DF19A04166EB7A0FB88FA5F000222DF9D437B5CF3DE886CB01

Function 00007FF8B7E07108 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF8B7E07169
IsDebuggerPresent.KERNEL32 ref: 00007FF8B7E07181
OutputDebugStringW.KERNEL32 ref: 00007FF8B7E07192

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF8B7E0718B

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 3682def6e1dd16f220077f0b389bb974e810f406563ff921ffcc499fc78dc00c
Instruction ID: d9cd3fdc877e3571600adcb4c60626d7dca3073a0158b7d824ba470ad6ec2cf7
Opcode Fuzzy Hash: 3682def6e1dd16f220077f0b389bb974e810f406563ff921ffcc499fc78dc00c
Instruction Fuzzy Hash: F4113A32A14B92A6EB44DB2ADA463BE32A5FF44B85F404135C75D82AB0EF3CE465C710

Function 00007FF8B7E0CAD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 171COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF8B7E0CB08
_invalid_parameter_noinfo.LIBCMT ref: 00007FF8B7E0CD42

Strings

*, xrefs: 00007FF8B7E0CC15

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *
API String ID: 3215553584-163128923
Opcode ID: a17599c0590d15916d80fbff3c007cc6e1b9fd49ee7eca2312569b182e6295ca
Instruction ID: 7950cc3b6978d15a615beb00b331611896dc32c1378960da92da6213a1e77d7a
Opcode Fuzzy Hash: a17599c0590d15916d80fbff3c007cc6e1b9fd49ee7eca2312569b182e6295ca
Instruction Fuzzy Hash: E9715C7290875286E7648F2CC0861BD3BA0EF49F98F25213BDB4A562F8DF2CD482D710

Function 00007FF8B7E1A214 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF8B7E1A32B
GetLastError.KERNEL32 ref: 00007FF8B7E1A34D

Strings

U, xrefs: 00007FF8B7E1A2D7

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: ad69c84db16d56f039627f9068bbcfd8226d8d2c6e2f1cf6855a8d6ca4d9994e
Instruction ID: 449b7bd3f391c7e57be3a837ae9d1dfb47f77183dc5386d4e3efbc9f44035069
Opcode Fuzzy Hash: ad69c84db16d56f039627f9068bbcfd8226d8d2c6e2f1cf6855a8d6ca4d9994e
Instruction Fuzzy Hash: 5B418C62A18B4182DBA08F69E4453BE67A1FF88BC4F814031EB4E87BA8DF3CD445C740

Function 00007FF8B7E13C7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF8B7E13CB5
LCMapStringW.KERNEL32(?,?,?,00000058,00007FF8B7E11B98,00007FF8B7E0C490), ref: 00007FF8B7E13D3D

Strings

LCMapStringEx, xrefs: 00007FF8B7E13C98, 00007FF8B7E13CA9

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: e24a4be76b94d709695e9795b36a3990f6e6c2899ec0495a1d34d290ce385ce7
Instruction ID: 6dc306fbfa21d28ac16c34f9cff2b5effb01b834eca2b940801d2d63899aef1e
Opcode Fuzzy Hash: e24a4be76b94d709695e9795b36a3990f6e6c2899ec0495a1d34d290ce385ce7
Instruction Fuzzy Hash: 6111F936608B8186D7A0CB19B4412AEB7A4FB89BD4F544136EF8D97F69CF3CD5508B40

Function 00007FF8B7E13C18 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF8B7E13C49
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00000003,00007FF8B7E13391), ref: 00007FF8B7E13C63

Strings

InitializeCriticalSectionEx, xrefs: 00007FF8B7E13C2A, 00007FF8B7E13C3D

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 33dcb1db6bbe30c371f2ed747fc00e81c81637251a9e970159c8226792a312eb
Instruction ID: 524147040fe3ed401d130db74cd4d6bf0ff85d72184416d220651b7c06140b7c
Opcode Fuzzy Hash: 33dcb1db6bbe30c371f2ed747fc00e81c81637251a9e970159c8226792a312eb
Instruction Fuzzy Hash: 5BF08221F18B4181E7859B49F4424AE6660EF48FC0F985036EB5D07F79CE3CE845C740

Function 00007FF8B7E081B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF8B7E081BD
_CxxThrowException.LIBVCRUNTIME ref: 00007FF8B7E081CE

Part of subcall function 00007FF8B7E09B44: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8B7DF3AA9), ref: 00007FF8B7E09BB9
Part of subcall function 00007FF8B7E09B44: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF8B7DF3AA9), ref: 00007FF8B7E09BEB

Strings

Unknown exception, xrefs: 00007FF8B7E081E5

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: Exception$FileHeaderRaiseThrowstd::bad_alloc::bad_alloc
String ID: Unknown exception
API String ID: 3561508498-410509341
Opcode ID: 4ccaa8bfde2efe37d93b97a37e068fb42fc44c3fa81a7dae03009e6af82dd019
Instruction ID: dadcb9f27d4e12e08e797a710917b12e7728948e949db9470b38092333e73a67
Opcode Fuzzy Hash: 4ccaa8bfde2efe37d93b97a37e068fb42fc44c3fa81a7dae03009e6af82dd019
Instruction Fuzzy Hash: 81D05E22A19B8691EF10EB0CD8863AD6370FF80B88F904031D34C41575DF6CD64AD700

Function 00007FF8B7E0B6B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF8B7E0B6E1
TlsSetValue.KERNEL32(?,?,00000000,00007FF8B7E09D3E,?,?,?,00007FF8B7E09CD9,?,?,?,?,00007FF8B7E0880C), ref: 00007FF8B7E0B6F8

Strings

FlsSetValue, xrefs: 00007FF8B7E0B6C5, 00007FF8B7E0B6CE

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 7b34e05f0366a55b84dd15e59f900160d4c8bf58c273ea8a1933fbff8ac5ac0a
Instruction ID: ef0db4b1f44b3ce4436ea96f5184c6b2846847d1360ce414c16f5538ef4f30f2
Opcode Fuzzy Hash: 7b34e05f0366a55b84dd15e59f900160d4c8bf58c273ea8a1933fbff8ac5ac0a
Instruction Fuzzy Hash: 45E09261A1874291FA449B5DF8024BE2232BF48FC0F484032DB1D06B74DE3CE995D740

Function 00007FF8B7E13D58 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF8B7E13D81
__crtDownlevelLocaleNameToLCID.LIBCPMT ref: 00007FF8B7E13D98

Strings

LocaleNameToLCID, xrefs: 00007FF8B7E13D64, 00007FF8B7E13D6E

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: DownlevelLocaleName__crttry_get_function
String ID: LocaleNameToLCID
API String ID: 404522899-2050040251
Opcode ID: 268596bc7b15f3178a779d455420e5bcbdddaa753e90f7d94ded69cce8185e75
Instruction ID: 22bedf285b25512cd51ea96ac784ca361b4993e48fa032e4178afdd33766cbe5
Opcode Fuzzy Hash: 268596bc7b15f3178a779d455420e5bcbdddaa753e90f7d94ded69cce8185e75
Instruction Fuzzy Hash: F8E06511A0874691EB849758E4430BF2252AF88FC0F584031D70D1EFB5CE3CE845C740

Function 00007FF8B7E13BC4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00007FF8B7E13BED
TlsSetValue.KERNEL32(?,?,000080104E1F36C3,00007FF8B7E1250A,?,?,000080104E1F36C3,00007FF8B7E0F29D,?,?,?,?,00007FF8B7E142A2,?,?,00000000), ref: 00007FF8B7E13C04

Strings

FlsSetValue, xrefs: 00007FF8B7E13BD1, 00007FF8B7E13BDA

Memory Dump Source

Source File: 00000013.00000002.3448914968.00007FF8B7DF1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF8B7DF0000, based on PE: true

Associated: 00000013.00000002.3448644360.00007FF8B7DF0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449273410.00007FF8B7E1D000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449569405.00007FF8B7E32000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000013.00000002.3449783274.00007FF8B7E35000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ff8b7df0000_PanGPS.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 76e86feac8d41f0291ff837b828f2169e6f510e85b841f7f240366702558064c
Instruction ID: e0b678e8d3aa4c303b74ae6b4b049d9908834d74a17f5befc4dc6279a3c5b4a4
Opcode Fuzzy Hash: 76e86feac8d41f0291ff837b828f2169e6f510e85b841f7f240366702558064c
Instruction Fuzzy Hash: 24E06D65A1878391EB849B5CE4024BF6262EF48FD0F885032EB0D0ABB4CE3CE884C750

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Driver: Driver Load, File: File Creation, File: File Modification, Module: Module Load
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Tactics:	Credential Access, Discovery
Data Sources:	Command: Command Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report GlobalProtect64-6.3.1.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Bitcoin Miner

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\48bcea.rbs

C:\Program Files\Palo Alto Networks\GlobalProtect\Connected.bmp

C:\Program Files\Palo Alto Networks\GlobalProtect\ConnectedFail.bmp

C:\Program Files\Palo Alto Networks\GlobalProtect\ConnectedInternal.bmp

C:\Program Files\Palo Alto Networks\GlobalProtect\ConnectedNone.bmp

C:\Program Files\Palo Alto Networks\GlobalProtect\Connecting.avi

C:\Program Files\Palo Alto Networks\GlobalProtect\Connecting.bmp

C:\Program Files\Palo Alto Networks\GlobalProtect\DEM64.msi

C:\Program Files\Palo Alto Networks\GlobalProtect\Decimal-Medium-Pro.otf

C:\Program Files\Palo Alto Networks\GlobalProtect\Lato-Regular.ttf

C:\Program Files\Palo Alto Networks\GlobalProtect\Lato-Semibold.ttf

C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe

C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.ico

C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_CHINESE.dll

C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_CHINESE_TRADITIONAL.dll

C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA_FRENCH.dll

Windows Analysis Report
GlobalProtect64-6.3.1.msi

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre