rasphone.exe
by Microsoft
Operating System
Summary
Windows Remote Access Phonebook - GUI for managing dial-up and VPN connections.
rasphone.exe is the 1131st most commonly executed Windows program in EchoTrail's dataset, observed 1,498 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by explorer.exe.
1131st
most commonly executed Windows program
1,498
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Windows\System3299.93%
- C:\Users\...0.07%
Top Hashes (SHA256)
- 07252b6c1887bf314a22dc014c8c2bb286953186b8062a83d74ecb07f1d4324c70.23%
- af03c1207616ca4e553f880cd26ac72bc6f615fedf62ec4ad227e24450793eeb13.89%
- e4b55bba2bb62d38c699fca8b752bd0d18654d7edf2fc4bd5dfb5b4780586aaa6.54%
- 67eed561232bf2593ce6af7729f49e928756bd598325a72ff304c1bd93f7d83e6.41%
- af0309ab694d5bbdb2e303852d82ae8d0a49bb27be19d61aa102f904065278262.94%
Process Ancestry
Top Grandparents
- userinit.exe99.15%
- WerFault.exe0.54%
- explorer.exe0.08%
- SenseCncProxy.exe0.08%
- svchost.exe0.08%
- winlogon.exe0.08%
Top Parents
- explorer.exe99.87%
- chrome.exe0.07%
- RuntimeBroker.exe0.07%
Top Children
- ngmonitor.exe90.38%
- chrome.exe0.42%
- WerFault.exe0.42%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about rasphone.exe
Rocky answers questions about rasphone.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.