vmwp.exe
by Microsoft
Virtualization
Summary
Hyper-V Virtual Machine Worker Process
vmwp.exe is the 1480th most commonly executed Windows program in EchoTrail's dataset, observed 743 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by vmcompute.exe.
1480th
most commonly executed Windows program
743
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- 842663673e42e34a0215b5d1bb7c4ed508a4aaf3b852d7e0b60c27f4e822991326.51%
- 91a1ad30e0724a11bd41c95270f640d194b5286c8c626eb67d91a427adf5aace16.82%
- 2767864d0915b0d772ed5c732ac6b615c14c0fc89c30671ee5b1d10503cb352d10.9%
- fbe3849cc142b1ad5886cdf07e7cd9c9f2c1a78b72d6721d78e669a2aa5a49807.67%
- bb223df7ef5050502de68518290c6eaa4ec8146defbd34335c1fb631a34a1a287.54%
- 0af5a02d8bf9da8cc01450a6b152b9a5a6b378cf5fd6980d2469b10b4ccda2f46.46%
- 824badb7bf156253c238ad4b7cc1b1ddc7e6ece4c974d28457ebed3def2b30845.92%
- 90e3e397f6e12a73b4dfae8d0781490c403bff12a4a0bda9606c83f04b1c78cd4.71%
- 32dac8974407c7b7cca730b1eb764309988f8df04b593aefd4ffe4e50e9ae4002.02%
- 4b55e4145fc129ff49c0e7282c39b937fd49fcd6e81da2da4a4c301354bae7202.02%
Process Ancestry
Top Grandparents
- services.exe100%
Top Parents
- vmcompute.exe97.04%
- vmms.exe2.42%
Top Children
- WerFault.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about vmwp.exe
Rocky answers questions about vmwp.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.