ekrn.exe
by ESET
Endpoint Security
Summary
ESET Kernel Service - core protection service for ESET endpoint security.
ekrn.exe is the 928th most commonly executed Windows program in EchoTrail's dataset, observed 2,558 times across enterprise environments. It typically runs from C:\Program Files\ESET\ESET Endpoint Antivirus\x86 and it is most often launched by services.exe.
928th
most commonly executed Windows program
2,558
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Program Files\ESET\ESET Endpoint Antivirus\x8669.59%
- C:\Program Files\ESET\ESET Endpoint Security\x8623.3%
- C:\Program Files\ESET\ESET Security6.1%
- C:\Program Files\ESET\ESET Endpoint Antivirus0.63%
- C:\Program Files\ESET\ESET Endpoint Security0.39%
Top Hashes (SHA256)
- 314e519166503b32286267b5f948814e6a508c0a1b14dde1e3b6d8e380e6380252.97%
- 6e2be95204265dd17a31734c1e906795e2cbe1a449434f1e5b1698b9d6c6199a39.91%
- e43cf891632434b035143e57b0cb6629d7d934199a788e18e07a5c94531c76176.49%
- a545214135da70a8719012c5351b39c6283556b7a524f7c265cf12fd6a595a380.39%
- a011c806e57c727ca8dc30c2d83fbfdeeffe96878392c3f353b7e187f72811b30.23%
Process Ancestry
Top Grandparents
- wininit.exe100%
Top Parents
- services.exe100%
Top Children
- appcmd.exe38.86%
- egui.exe38.63%
- rundll32.exe19.32%
- cmd.exe3.12%
- regsvr32.exe0.03%
- conhost.exe0.01%
- WerFault.exe0.01%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about ekrn.exe
Rocky answers questions about ekrn.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.