sysmon64.exe
by Microsoft (Sysinternals)
Endpoint Security
Summary
Sysinternals System Monitor (64-bit) - already populated.
sysmon64.exe is the 552nd most commonly executed Windows program in EchoTrail's dataset, observed 9,342 times across enterprise environments. It typically runs from C:\ProgramData\... and it is most often launched by cmd.exe.
552nd
most commonly executed Windows program
9,342
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\ProgramData\...54.78%
- C:\Windows44.81%
- C:\Program Files (x86)\EchoTrail\Sysmon0.29%
- C:\Users\...0.11%
- C:\...0.01%
Top Hashes (SHA256)
- 2e2ce2f3fbb2a00ad374af9419b41f8dd09244e299d5fb32326b0b775857ecf750.18%
- c1255d2e0f139c1f494786bfb7f4764bb6ca05680010aadbc7fdd3db1f6e56e929.85%
- 3267279461be7397ef6e2afe61f9396e42475577f8c76648dbcae1b831b6fd3e8.76%
- de2d6b0260566ef4a485ad3ffb4a57095419ac503c3a405cb62c5f698a5d69506.73%
- bc6a579553f1cafec84ffc1baea3ec6fa5656ed207d3e8177798070c4f71e53e1.73%
- 8d4fc2c9352dad893d63ca30829b35c935e304c2fd0be83e7daebbe59a5586941.31%
- 373061d73b6743651050749dba958090a954939109fc51dd27e548b0d71cd75c1.3%
- 82b16d5247be31d9bddeb07dc716dd5d7a50f233807519037e88d8279ce850330.05%
- 9bbb54daf9d2a33e8d3db835e7043e7d1cb17d45539e94b10db0c7ccdfd3a6c90.04%
- ee067d135d799e98aa5de5cbd10d13a087721a982b7bff4d6c1678c33d0ed9fb0.04%
Process Ancestry
Top Grandparents
- svchost.exe100%
Top Parents
- cmd.exe55.08%
- services.exe44.8%
- msiexec.exe0.11%
- powershell.exe0.01%
Top Children
- conhost.exe98.74%
- wevtutil.exe1.26%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about sysmon64.exe
Rocky answers questions about sysmon64.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.