minionhost.exe
by VMware / SaltStack
Endpoint Management
Summary
SaltStack Minion host process
minionhost.exe is the 1580th most commonly executed Windows program in EchoTrail's dataset, observed 598 times across enterprise environments. It typically runs from C:\Program Files\Cybereason ActiveProbe and it is most often launched by PylumLoader.exe.
1580th
most commonly executed Windows program
598
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Program Files\Cybereason ActiveProbe100%
Top Hashes (SHA256)
- 74bd4ebc47ddb4543aee597a5742f8509258f1ee87bfd8c5b9f5e53350a93d5653.01%
- 7e01b292c3c888c0d347212a93cc379cc4fa50756395a0f677b1c9457f5854d831.27%
- 84eba6c657e23f6fa7a304a636a7ae1cb0e36c927703a9eec04737b3540acd508.7%
- 7435f68a12254b4b805efdcc747ddd2c0d7aa7782db81bae8a2dd8b121dffab24.01%
- 55c7d205deed4a2753c7d34e736cf6af26270fe6e42a2b86dc78b0c9fe3a694a1.51%
- 8dd8fa12fdecd708921afb0586de264eb866960d0396a20381e1e0cfde86badb1.51%
Process Ancestry
Top Grandparents
- services.exe57.64%
- PylumLoader.exe42.36%
Top Parents
- PylumLoader.exe56.02%
Top Children
- reg.exe46.2%
- setx.exe46.2%
- msiexec.exe1.49%
- cmd.exe0.66%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about minionhost.exe
Rocky answers questions about minionhost.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.