WINWORD.EXE
Summary
Microsoft Word - word processing application in the Microsoft Office suite.
WINWORD.EXE is the 335th most commonly executed Windows program in EchoTrail's dataset, observed 26,611 times across enterprise environments. It typically runs from C:\Program Files (x86)\Microsoft Office\root\Office16 and it is most often launched by explorer.exe.
Behavior
Top Paths
- C:\Program Files (x86)\Microsoft Office\root\Office1681.4%
- C:\Program Files\Microsoft Office\root\Office1618.31%
- C:\Program Files\Microsoft Office 15\root\office150.21%
- C:\...0.07%
- C:\Program Files\Microsoft Office\Office140.02%
Top Hashes (SHA256)
- 566df3cd1cbbaf373f1b59e9af147e950e51d4f8560c5d41f062bc1f9139ae543.04%
- 8ab39e9199b36260b3c9bbc46663fd537ba787782fba19b7f320faf1b43d25942.54%
- 784bdbc25c9a8ba51819ca9c17732f8c299f2e8af336324b0f12b1312d07b6412.4%
- a6395edd4b6e0a80a14c5a78124d5b3ebb799a5c6928d0c46c9820ee50cd5e7f2.27%
- 44145c2d81c3ff9292bce57058196148dde90bb6d53e4305b3b89379f95788c62.13%
- c46e4f8d50e874e6db60af536a0ed48a9ac718baa92697a2986edf219885e2741.95%
- bb307a5bba1e3472b7fff39d4f2ecdfb553bdc72f567f3c36f9521d9381702901.88%
- 1d6d1e9aa9bee54f1949e02fcfe5a49f4371fae6d8c1f30c466838ffce95f33a1.85%
- d93dfa5cfadcc9ea2e4b0d4d646b7ce95ccacfaec7b4223d842cae46ebdfc8641.61%
- 93aeffc8d1aeec124120dc409906313ebd32716cd5c1fb9977bbc3d00991ca781.54%
Process Ancestry
Top Grandparents
- userinit.exe51.67%
- explorer.exe31.02%
- OUTLOOK.EXE5.32%
- svchost.exe3.39%
- services.exe1.84%
- chrome.exe1.54%
- firefox.exe1.46%
- winlogon.exe0.94%
- WerFault.exe0.64%
- OfficeClickToRun.exe0.23%
Top Parents
- explorer.exe55.05%
- OUTLOOK.EXE14.78%
- svchost.exe14.38%
- WINWORD.EXE12.17%
- chrome.exe2.55%
- Acrobat.exe0.19%
- msedge.exe0.16%
- OfficeClickToRun.exe0.14%
- protocolhandler.exe0.11%
- OpenWith.exe0.11%
Top Children
- WINWORD.EXE32.15%
- splwow64.exe20.72%
- MSOSYNC.EXE20.09%
- ai.exe8.81%
- Acrobat.exe2.56%
- AcroRd32.exe2.31%
- chrome.exe1.82%
- CPC10Q.EXE1.4%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about WINWORD.EXE
Rocky answers questions about WINWORD.EXE grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.