notepad.exe
by Microsoft
Operating System
Summary
Windows Notepad - basic text editor included with Windows.
notepad.exe is the 457th most commonly executed Windows program in EchoTrail's dataset, observed 13,795 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by explorer.exe.
457th
most commonly executed Windows program
13,795
observed executions
medium
statistical confidence
Behavior
Top Paths
- C:\Windows\System3291.96%
- C:\Windows\SysWOW645.35%
- C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2304.26.0_x64__8wekyb3d8bbwe\Notepad1.06%
- C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2303.40.0_x64__8wekyb3d8bbwe\Notepad0.5%
- C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2306.15.0_x64__8wekyb3d8bbwe\Notepad0.33%
- C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2305.18.0_x64__8wekyb3d8bbwe\Notepad0.25%
- C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2307.27.0_x64__8wekyb3d8bbwe\Notepad0.23%
- C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2302.26.0_x64__8wekyb3d8bbwe\Notepad0.09%
- C:\Windows0.07%
- C:\Program Files\WindowsApps\microsoft.windowsnotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Notepad0.04%
Top Hashes (SHA256)
- e9f2fbe8e1bc49d107df36ef09f6d0aeb8901516980d3fe08ee73ab7b4a2325f28.81%
- c84c361b7f5dbaeac93828e60d2b54704d3e7ca84148bafda632f9ad6cdc96fa14.38%
- 899346f9f283a4fd5aa03015a3f58cde5b9c0b6a5c4d64c2cc74e9b22c1348d710.33%
- 0f8a84968fac3cadc04471c1ee5c4644414491c89a4a7149845c170258b6a6d16.06%
- e5d90beeb6f13f4613c3153dabbd1466f4a062b7252d931f37210907a7f914f74.93%
- f1d62648ef915d85cb4fc140359e925395d315c70f3566b63bb3e21151cb2ce34.43%
- f9d9b9ded9a67aa3cfdbd5002f3b524b265c4086c188e1be7c936ab25627bf013.96%
- da0acee8f60a460cfb5249e262d3d53211ebc4c777579e99c8202b761541110a3.16%
- 933e1778b2760b3a9194c2799d7b76052895959c3caedefb4e9d764cbb6ad3b52.35%
- 3348930f51a63f6b7509160ffc94c431f987a7ead81209592a74eb2de08680ad2.27%
Process Ancestry
Top Grandparents
- userinit.exe81.52%
- explorer.exe9.03%
- svchost.exe3.59%
- KeePass.exe1.46%
- winlogon.exe1.24%
- WerFault.exe0.91%
- OUTLOOK.EXE0.41%
- chrome.exe0.27%
- OneDrive.exe0.22%
- python.exe0.11%
Top Parents
- explorer.exe86.15%
- OUTLOOK.EXE4.89%
- OpenWith.exe2.12%
- chrome.exe1.79%
- 7zFM.exe0.72%
- WinRAR.exe0.62%
- cmd.exe0.54%
- firefox.exe0.42%
- notepad.exe0.25%
Top Children
- notepad.exe34.31%
- splwow64.exe18.63%
- CPC10Q.EXE14.71%
- crashpad_handler.exe10.78%
- RarExtLoader.exe10.78%
- WerFault.exe1.96%
- chrome.exe0.98%
- CNMSEEU.EXE0.98%
- firefox.exe0.98%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about notepad.exe
Rocky answers questions about notepad.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.