PanGPA.exe
Summary
Palo Alto Networks GlobalProtect Agent - VPN client for GlobalProtect cloud and on-prem gateways.
PanGPA.exe is the 1127th most commonly executed Windows program in EchoTrail's dataset, observed 1,536 times across enterprise environments. It typically runs from C:\Program Files\Palo Alto Networks\GlobalProtect and it is most often launched by explorer.exe.
Behavior
Top Paths
- C:\Program Files\Palo Alto Networks\GlobalProtect96.88%
- C:\Program Files\Palo Alto Networks\GlobalProtect202207073.12%
Top Hashes (SHA256)
- 06f7febb756b3d2f49285929c1d24975e2a1426c3a2256665f2bfc6f2f7aa93636%
- 0060521196040cbcbd33d9da83f2a0450fd3a1088d5997bc0a1d288b1fdbe04735.68%
- 3186cdbe55b5418ef1f98284e58fe61232d8b1b75d40ed3e09e48ed667386db18.66%
- ae7cd9ed65cd37a6bb614d2022b88503df896846d2ec1eeb823c8bae8449c3645.99%
- e9dc4ea245c5ba009981f1423dc2dbc81ac5031a0f14b428cbd61202364cb4555.01%
- 6c8ad628c73d88be77ddd642f1ac1bc227965eef29dca0c659360baca99414b12.93%
- 432415c5ec797edc9d9e1bf5df5d42c35e512e3d26e6106e62ab0c68545af4cb2.47%
- 265c7f1f4fb6605764345655de856188ea59ce77a0ba37baf3d298cdd2a681d61.69%
- 9515350c97f117ae09f522bd9dc0b073a99b00fab81202f1515ff3239680458b1.11%
- 6edf67d14c836e54092f9d164203cd54cd89202a360b7d6616c8a5495d2887ed0.39%
Process Ancestry
Top Grandparents
- userinit.exe86.15%
- services.exe12.31%
- winlogon.exe1.54%
Top Parents
- explorer.exe70.83%
- PanGPS.exe28.84%
Top Children
- ipconfig.exe21.43%
- NETSTAT.EXE21.43%
- ROUTE.EXE21.43%
- WerFault.exe14.29%
- netsh.exe7.14%
- systeminfo.exe7.14%
- WMIC.exe7.14%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about PanGPA.exe
Rocky answers questions about PanGPA.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.