EXECUT~1.EXE
Summary
Short filename (8.3 format) for an executable, likely from a management or deployment tool using legacy path conventions.
EXECUT~1.EXE is the 153rd most commonly executed Windows program in EchoTrail's dataset, observed 109,412 times across enterprise environments. It typically runs from C:\... and it is most often launched by ClusterInfo.exe.
Behavior
Top Paths
- C:\...100%
Top Hashes (SHA256)
- 68810bf6e96c9c4b04deba20c12aef21aca23132f48421cfb10348ce9dc774aa57.45%
- 2237391b5c957e2607b65f5538e8befa257c1d9f82a94fd666a67e12f0af675942.55%
Process Ancestry
Top Parents
- svchost.exe50%
Top Children
- powershell.exe50.01%
- zscccon64.exe49.99%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does EXECUT~1.EXE normally do?
Part of Unknown software.
When is EXECUT~1.EXE suspicious?
Running from unexpected paths.
How do attackers abuse EXECUT~1.EXE?
Not commonly abused.
Detection guidance
No specific detection needed.
False positive notes
Normal operation.
Ask Rocky about EXECUT~1.EXE
Rocky answers questions about EXECUT~1.EXE grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.