sh.exe
by GNU/Various
Development Tool
Summary
Unix shell (typically from Git for Windows, MSYS2, or Cygwin) - provides Bash-compatible shell on Windows.
sh.exe is the 533rd most commonly executed Windows program in EchoTrail's dataset, observed 10,163 times across enterprise environments. It typically runs from C:\Users\... and it is most often launched by git-remote-https.exe.
533rd
most commonly executed Windows program
10,163
observed executions
medium
statistical confidence
Behavior
Top Paths
- C:\Users\...95.06%
- C:\Program Files\Git\usr\bin2.51%
- C:\...2.43%
Top Hashes (SHA256)
- 2eb357078cfc0deb71631eec392f70ad0eef6f7a3763b523071ed5f9421778c492.27%
- 78d1760e7ead9d594cb0183e9632af761df9d4c46714bb92086d5de99351050d2.43%
- 744343e01351ba92e365b7e24eedd4ed18ed3ebe26e68c69d9b5e324fe64a1b52.35%
- 0a0ec9b7259d0fbdaa037f1ff630cf37f097e0c82bbe8275c7084d59120644b01.35%
- fc98a4cb037259e59c908778446fa4738087f3381547cafdc9ae1328193205850.72%
- 797e2fd8f51acbe1da517b2ad56ad07f16e2649a85502c12341153a0e13463500.51%
- 5635de45980e960f315fa3ea0b3ee01a9687a370e134d268a2614f20ec2cfa5f0.31%
- bb8267613f55d6f53e8a4b1f2a92688e0e1217bdb22402d90f7363044d8158de0.06%
Process Ancestry
Top Parents
- git-remote-https.exe86.85%
- sh.exe10.29%
- git.exe0.65%
- bash.exe0.06%
Top Children
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about sh.exe
Rocky answers questions about sh.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.