Malware INFOLocal-first Windows incident analysis
InformationalAPI Tracer

Analysis Results

GlobalProtect.exe

Curated Deep API Trace evidence for GlobalProtect.exe. Collection is partial and the source assessment is inconclusive; this is not a malware verdict.

Sample SHA-256
33d696728101c9caf6ebb215ba176bbb94e5cc16218b574029b622fd6e3bee8c
Analyzed
September 23, 2026 at 06:33 AM UTC
Status
Partial
Malware INFO version
1.2.2.0
Package size
4.00 KB
Package SHA-256
85593252dc9e3f912d08bfa01722a2a7a9f87daeed8b45faa9124ccfb36015b0

Reports & Evidence

  • The source export retained 2,814 exact API calls and 1,081 NotApiCall events; its integrity check was Verified, while collection coverage remained Partial.
  • Nineteen HTTP request records were retained. Remote delivery, server acceptance, and remote effects were NotVerified.
  • Startup timing, at least one API return completion, and final telemetry drain have explicit gaps; zero reported dropped events does not close those gaps.
  • Semantic behavior-sequence analysis was not admitted because event order and continuity were not established.
  • The downloadable four-file package is a newly authored public summary. It contains no original source-export file or raw evidence.
Download