remsh.exe
by Various
Remote Accessmedium risk
Summary
Remote Shell - remote command execution utility, possibly from HP/Compaq management tools or Unix ports.
remsh.exe is the 210th most commonly executed Windows program in EchoTrail's dataset, observed 65,423 times across enterprise environments. It typically runs from C:\Program Files\rempl and it is most often launched by svchost.exe.
210th
most commonly executed Windows program
65,423
observed executions
medium
statistical confidence
Behavior
Top Paths
- C:\Program Files\rempl100%
Top Hashes (SHA256)
- 8f6d1ab93217aa73b0426a9253606f761d3c90143b9a9028e51a8821ce48956f31.36%
- 20eb7e6594b1ce9a7e2f3ee41dd8260a8557262e9c7e7d9dc4ef5e50067f051f24.67%
- 01374b0159f92e18f95e7ba8963f1573d60b5170a681575e55de1834afec08dd18.63%
- d857c85ae34f62f5d496f1447fc40beef58560804aad23bfae9357bb4fccc41b8.49%
- 795d354fc4c09726c8ecc99eb99ee82b4ad08da1e149e25d8d837df66d8dd09d4.21%
- 056bfdb9c92a683c831d481d533f78dbad964f3445ed9049cf87429684f8dff73.68%
- b7a6f9023e42646081dc45df53f967f988eb867c5d8903eb2f00c6d32005843e3.21%
- af899de8cf8db3108ab0e524249e3959be3404de021c67172cae76913aafc1032.77%
- c5330bf13be0a1f9a6fb81743edf5f7149d65e70d06898ab128c0854759700581.51%
- 9b8085ef444b2022809a6530f4d948eebc7034aebc5418625c8cb7f737a7e36b0.71%
Process Ancestry
Top Grandparents
- services.exe99.39%
- svchost.exe0.61%
Top Parents
- svchost.exe99.44%
- taskeng.exe0.45%
- msiexec.exe0.11%
Top Children
- cmd.exe86.07%
- rundll32.exe7.09%
- DismHost.exe5.22%
- CompatTelRunner.exe0.67%
- WerFault.exe0.01%
- conhost.exe<0.01%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about remsh.exe
Rocky answers questions about remsh.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.