platform-systemstate-plugin.exe
Summary
Endpoint management platform plugin. Collects system state, handles patching, or manages security components depending on the plugin type.
platform-systemstate-plugin.exe is the 50th most commonly executed Windows program in EchoTrail's dataset, observed 757,570 times across enterprise environments. It typically runs from C:\Program Files (x86)\ITSPlatform\plugin\systemstate and it is most often launched by platform-agent-core.exe.
Behavior
Top Paths
- C:\Program Files (x86)\ITSPlatform\plugin\systemstate100%
Top Hashes (SHA256)
- 379be10ec009e307a3634258023a2bcf5c990545533114982d5bf05489307c4037.27%
- 5f0b12b0accb0e6614d55d2a1dfd0fc30408379aadcd2e7baf34c0bfb3f94d3824.68%
- b891b72a83eaa920b5ef117888d53aca7582b88fb21f7f8d6f19f5d910c5cb9817.35%
- 2905bab596a23daff18a6359bb490903296cc5ab4ffde85410958443a72d17839.42%
- b7f13607e55be0d50d80813d979a2c0a46b7444af778dd079656d2dfa8f1e74d8.37%
- a118265691ebd5a389364753d6e35e7ae53680e8cd08badc6aa34966e9c0410b2.9%
Process Ancestry
Top Parents
- platform-agent-core.exe99.47%
Top Children
- conhost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does platform-systemstate-plugin.exe normally do?
Part of an endpoint management agent. Runs continuously.
When is platform-systemstate-plugin.exe suspicious?
Running from unexpected paths.
How do attackers abuse platform-systemstate-plugin.exe?
Not commonly abused.
Detection guidance
No detection needed.
False positive notes
Normal management agent operation.
Related Processes
Ask Rocky about platform-systemstate-plugin.exe
Rocky answers questions about platform-systemstate-plugin.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.