wpcmon.exe
by Microsoft
Operating System
Summary
Windows Parental Controls Monitor - enforces parental control restrictions on user accounts.
wpcmon.exe is the 423rd most commonly executed Windows program in EchoTrail's dataset, observed 16,958 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by svchost.exe.
423rd
most commonly executed Windows program
16,958
observed executions
medium
statistical confidence
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- 8d7bf6d012073f58f326c2682b4a1b2a24c9bca28dc040c0a07cbee5f741cf7128.87%
- 7efa00db7dd75bbf48d7246fce684b5f0c83c054eac92774f4ad9d4d1d018d6015.69%
- 3b6bc46957d9e3f80b779c49cf7bc3fb4cbe36146846e403fb32d099f9a1377a6.63%
- 2f18d022932daf32bd7d956bf3f0a0563af7632d016749567e9156a82afed78c5.66%
- 7d8095797e355297839601954ab4d7160869a7d22ea285acea72eecfde8ea42e5.33%
- f76d9152b75053ead020e3623735090e9611f188ac9c29bba08fd77d733a176a5.04%
- 5ae1b93ade705798bbf20eaf1b1678689ce07e683b6dbbdf2d376924908ee8a44.74%
- 4ca40a314f3e324dc8acaae7b0550faf2867bf201e19cc5f231ca1c0a3a94fd64.48%
- fb11a9ef8694ffba54d503c885ad1b1307fa4ac51fd7d176832fefe41b65b5463.94%
- 4f2ae1730156dd8c22275f6770aafbfe1a2f4c26ab720b3c756d590e56dceac73.84%
Process Ancestry
Top Grandparents
- services.exe58.19%
- svchost.exe37.34%
- userinit.exe4.36%
- chrome.exe0.12%
Top Parents
- svchost.exe82.45%
- wpcmon.exe15.91%
- explorer.exe1.6%
- cnmnsst2.exe0.01%
- conhost.exe0.01%
- searchapp.exe0.01%
- taskhostw.exe0.01%
Top Children
- wpcmon.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about wpcmon.exe
Rocky answers questions about wpcmon.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.