AXIOMExamine.exe
Summary
Magnet AXIOM Examine — digital forensics evidence review and analysis
AXIOMExamine.exe is the 1645th most commonly executed Windows program in EchoTrail's dataset, observed 532 times across enterprise environments. It typically runs from C:\Program Files\Magnet Forensics\Magnet AXIOM\AXIOM Examine and it is most often launched by explorer.exe.
Behavior
Top Paths
- C:\Program Files\Magnet Forensics\Magnet AXIOM\AXIOM Examine96.43%
- C:\...2.44%
- C:\Users\...1.13%
Top Hashes (SHA256)
- ef6b831d2b215fe150a0ee059c0e9c040584407ff2a55c267ee0bc57058eac8811.66%
- 5a0593b1047e6f16f4b456fe85975bc30591c75c980917ed3c9ddd562bb091a39.88%
- 5623a929214172413ee8081757a0d710d945d45e9089e8c7c20f9c35da2924fe8.1%
- eebed72e34dfc74fc2d54f2efea17725ea55dadf6a69fabbf7bccdbaa1fbb1aa6.52%
- 49d3ec85d9b31a1cea3e19dd96a111b2286ff753d387988150bf8b856642e1e25.53%
- 19f0b8b1aebe50bc97d40530cf0f0228af125efda7fe379bec917ce9c9801cd05.34%
- 55d9ee13b4d0fb91cab944e4bbc25e5c583bd75761b005a0308e8258af44c2504.94%
- 2249c37860531b2b00bcd1db9541c222968826a138870146938b04a47270f5b44.74%
- 620d5f4b0dd721333405850f14776a789a5ac2b7c043f63144c8e51c8f0b1dbd4.35%
- 025d50071b50bcf7c8c67510ac277262085d9139646479ed155db98b26247c723.95%
Process Ancestry
Top Grandparents
- explorer.exe38.46%
- winlogon.exe34.62%
- userinit.exe23.08%
- wyupdate.exe3.85%
Top Parents
- explorer.exe61.02%
- AXIOMProcess.exe35.4%
- cmd.exe0.38%
- AXIOMExamine.exe0.19%
Top Children
- MagnetAI.exe4.51%
- chrome.exe0.63%
- WerFault.exe0.5%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about AXIOMExamine.exe
Rocky answers questions about AXIOMExamine.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.