EPCUserAvatar.exe
Summary
EPC User Avatar - user avatar/profile component for endpoint management.
EPCUserAvatar.exe is the 636th most commonly executed Windows program in EchoTrail's dataset, observed 6,803 times across enterprise environments. It typically runs from C:\Program Files (x86)\Fortinet\FortiClient and it is most often launched by FortiTray.exe.
Behavior
Top Paths
- C:\Program Files (x86)\Fortinet\FortiClient97.65%
- C:\Program Files\Fortinet\FortiClient2.35%
Top Hashes (SHA256)
- e9af23dc3c9fbfa0e5d24e8602abbbba91689d620caf522e9e3a6332420a2df850.76%
- 3ad3910e052b33bfc7ad586683558e60180dad4e0dfb150312e2a44d5e5ef71a13.77%
- c39a1bc939fcb567817f075a6fdbcb41f556eb2b0ea5be4713d78a43c5cdf4b010.14%
- 97c0fe7a26e8577bc3d441eb3bd9d4c57567bfe1a9cf71c5f535607fc954c25c9.38%
- 16bcaef65e67f6411a5aafd5e1bfdb986c72557e2732cef3fb6416cc95de61004.15%
- d1674a725971955658488a4b58a3bc35495303f2de078f81962141274d55c17e3.31%
- d0f1413801ce1ce3a92394f2f4b2e26385b469b6a43d4be8184978a82466d2b62.79%
- 49d127fe130e403353d87d91aa8ab54cb400faeca4bbd3e5baa4bbdf41445bad1.85%
- 741bbcdfcf1f9f150364944c3ab1769c86ea3207b134c13ccb48ea5cd5cde6ad1.14%
- 849d826942cde2075abcb212be18ce232ee9d83e3749aefe7b16dd72c472bf9a0.84%
Process Ancestry
Top Grandparents
- FCHelper64.exe52.56%
- DropboxUpdate.exe0.02%
- svchost.exe0.02%
Top Parents
- FortiTray.exe51.05%
- FortiESNAC.exe48.92%
- DropboxUpdate.exe0.01%
- OfficeC2RClient.exe0.01%
Top Children
- conhost.exe99.97%
- WerFault.exe0.03%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about EPCUserAvatar.exe
Rocky answers questions about EPCUserAvatar.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.