SuspiciousAPI TracerDump Analyzer
Analysis Results
CallNotes.exe
Full sanitized non-binary Deep API Trace and Payload & Memory Analyzer evidence for CallNotes.exe. Coverage is partial and supports analyst review; it is not a malware verdict.
Reports & Evidence
- Deep API Trace retained 366 accepted runtime events, 158 exact instrumented API calls, and 10 fully attributed evidence sequences.
- Two observed correlation groups were retained; no semantic behavior chain was proven by the available evidence.
- Three memory collection points and 76 payload artifacts were analyzed, but all payload runtime bindings remained ContextOnly.
- The public package preserves 576 HTML, JSON, JSONL, CSV, TXT, and LOG reports. Only 76 raw .mem, .memimg, and .bin files were excluded.
Evidence-bound assessment
Low Observed Risk
No scored high-impact chain was proven. This is not evidence that the sample is benign, and the feature-local BehaviorRiskScore is not a malware score.
- BehaviorRiskScore
- 0
- Evidence confidence
- 69/100
Static context
Subject profile
| Property | Observed value |
|---|---|
| File | CallNotes.exe |
| Size | 61,648 bytes |
| Format | PE32 · x86 · Native · Windows GUI |
| Image base | 0x00400000 |
| Entry point RVA | 0x00001000 |
| PE structure | 4 sections · 1 import module |
| Present | Imports · relocations · certificate table |
| Absent | CLR header · TLS directory |
| Parse completeness | Complete |
| Runtime relationship | CurrentPathSnapshot; RunningImageRelationshipUnverified |
Deep API Trace
Runtime evidence summary
- Accepted events
- 366
- Dropped events
- 6
- Exact API calls
- 158
- Evidence sequences
- 10 / 10 attributed
- Callsite attributions
- 82
- Unknown callsites
- 0
- Observed groups
- 2
- Semantic chains
- 0
- Graph
- 55 nodes · 89 edges
- Resource lineage
- 105 resources · 1 link · 9 closed · 75 orphan
Acquisition
Collection boundary
| Boundary | Recorded state |
|---|---|
| Mode | DeepTrace |
| Session state | Stopped |
| Started | 2026-08-03 03:21:00.027 UTC |
| Stopped | 2026-08-03 03:28:13.456 UTC |
| Stop reason | Analyst requested Stop |
| Snapshots | 3 |
| Early boundary | Verified |
| Before image entry | Debugger, pre-loader, and image-entry boundaries observed |
| Full coverage before entry | No — startup gap remains visible |
| Exactness boundary | Only InstrumentedApi rows are exact API evidence |
Sources
Collector state
| Collector | State | Evidence |
|---|---|---|
| Exact API worker | Stopped | 528 accepted worker records |
| ETW | Stopped | 33 records |
| Guard process | NotStarted | Unavailable in this session |
| Guard file | NotStarted | Unavailable in this session |
| Guard registry | NotStarted | Unavailable in this session |
| Guard network | NotStarted | Unavailable in this session |
| Sysmon | NotStarted | Unavailable in this session |
Observed versus configured
Instrumentation coverage
- Priority APIs
- 19 configured
- Observed
- 1
- Configured / not reported
- 18
- Anti-analysis configured
- 40
- Anti-analysis installed
- 4
- Anti-analysis observed
- 4
- Unavailable / bypass
- 0 / 0
Correlation
Required behavior-chain review
Each row preserves the observed step and the missing evidence boundary. None of these incomplete chains is promoted to a semantic behavior claim.
| Required chain | State | Observed | Missing boundary |
|---|---|---|---|
| Signed host → unsigned sibling load | Incomplete | LoadLibrary observed | Static trust evidence missing |
| Opaque read → executable transition → execution | Incomplete | VirtualProtect observed | Opaque profile/read/execution evidence missing |
| Run/RunOnce write → process start | Incomplete | CreateProcessW observed | Run-key write evidence missing |
| Pipe → child → output → network transfer | Incomplete | CreateProcessW observed | Pipe/output/network evidence missing |
Payload & Memory Analyzer
Artifact coverage
- Artifacts analyzed
- 76 / 76
- Runtime attributable
- 0
- ContextOnly
- 76
- Correlation mismatch
- 0
- Artifact limit reached
- No
- Disk-backed image / region
- 71
- Primary image
- 3
- Executable private region
- 2
Public evidence package
Preserved report inventory
- Source reports preserved
- 576
- Deep API Trace reports
- 41
- Payload Analyzer reports
- 535
- Raw files excluded
- 76
- Raw bytes excluded
- 76,095,488
- ZIP entries
- 579
- Manifested entries
- 578
- ZIP size
- 41,029,298 bytes
Analyst guidance
Coverage limitations
- Session stop was analyst-requested; the report is not a claim of complete process-lifetime coverage.
- Six events were dropped and full coverage before image entry was not achieved.
- Guard and Sysmon collectors were not started, so those evidence sources are unavailable rather than negative.
- Configured-but-unobserved APIs are coverage state, not proof that an API did not execute.
- Payload artifacts are ContextOnly; no runtime attribution or containment authority follows from them.
- Raw memory images and binary payload bytes are intentionally absent from the public ZIP.