eventvwr.exe
by Microsoft
System Utilitymedium risk
Summary
already deep-covered
eventvwr.exe is the 2729th most commonly executed Windows program in EchoTrail's dataset, observed 130 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by explorer.exe.
2729th
most commonly executed Windows program
130
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Windows\System3290.77%
- C:\Windows\SysWOW649.23%
Top Hashes (SHA256)
- b8f06c842b582d7df5821d86ad8e09edb45e661dc852135b1ab410994726a74f34.17%
- 0ee8f607e5ccd6d0ab3296bbb37254c096cac9ec464fd8aa75f0838c8f40276b15%
- 1501986365ae248c8e4998ecadd52f44acf9e31d05fa10b0c324dc12d4a5c07e14.17%
- 687bfd3c930df3323096faa9db5e0f9651d320fe8e8b07915c376587506ae51c10%
- 5d93f37f80d4f5848d1b492c1758db0fea706b104c381653a322e5c4f5bc1a086.67%
- c720c4ed36f041a76f70331be3c2b3b98e1a7d31825d03f5a26e21ba73034b225.83%
- bc87e4f462f00b826ec09ac16b625d0f70439c48fc04a52a41b4cd9e78401f703.33%
- be0d401c8b42024b0918394faa0aa6b494ea537b3c6c2c62c3d9064929f6245b3.33%
- 9c48f2740d96d1092c36c4f2c01e13e396d582777d3594643b9ff8c34e05970a1.67%
- c4b3160160be1230a81ef687b5d59ee17223e3e418fda9a8a167c7702592ce131.67%
Process Ancestry
Top Grandparents
- userinit.exe79.17%
- explorer.exe6.25%
- cmd.exe5.21%
- mshta.exe4.17%
- powershell.exe3.12%
- control.exe1.04%
- svchost.exe1.04%
Top Parents
- explorer.exe83.85%
- cmd.exe4.62%
- python.exe3.85%
- chrome.exe3.08%
- powershell.exe3.08%
- mmc.exe1.54%
Top Children
- mmc.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about eventvwr.exe
Rocky answers questions about eventvwr.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.