CSFalconServiceUninstallTool_x64.exe
Summary
CrowdStrike Falcon service uninstall tool (x64) for removing endpoint protection during decommission
CSFalconServiceUninstallTool_x64.exe is the 2223rd most commonly executed Windows program in EchoTrail's dataset, observed 234 times across enterprise environments. It typically runs from C:\ProgramData\... and it is most often launched by CSFalconServiceUninstallTool_x64.exe.
Behavior
Top Paths
- C:\ProgramData\...100%
Top Hashes (SHA256)
- 2013e4248979c12d9dbb4e82f72bed129e90fea7e05cb41e50ad0c8a4139e6765.42%
- 7eaf310fe990b0906dffbd0b2d5e709af7a15c4f0af056ec4bd10be470a117674.58%
- 149cb54a04d178d94020630a10c874d82affc0e22c67ce01c59a0c1b9a9604402.92%
- c28e7b67144556661a01cb10110e868c31120d6b06938313493507238248b8db2.92%
- 21b86c62604df83fff2b91f073f339ba128ba9c08527177f380fcac80a9471d52.5%
- c2f667e303b903dd62c0b46eac30ef1601027d6f0e9393eea968d3f9488bf5842.5%
- 1fc00b89536cf180948c022447d7cb8f2a398a0b11efe782c1bb2a3f19f9ae842.08%
- 38b1ef496ed1b49718c601c866e1f714e71d4770386efdb79fb5ca041fce92602.08%
- b0fa8f5d82fcf3ec383f2d8b786a6ffff840caa0417769b1fadbf8d43818ba132.08%
- 0110a6ebf49c1b9c4072201c4f5db0c51bd34f816f8ea7cb6ddef924598d4d421.67%
Process Ancestry
Top Parents
Top Children
- conhost.exe47.33%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about CSFalconServiceUninstallTool_x64.exe
Rocky answers questions about CSFalconServiceUninstallTool_x64.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.