Rocky Raccoon

wslservice.exe

by Microsoft
Operating System

Summary

Windows Subsystem for Linux service

wslservice.exe is the 2890th most commonly executed Windows program in EchoTrail's dataset, observed 108 times across enterprise environments. It typically runs from C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_1.0.3.0_x64__8wekyb3d8bbwe and it is most often launched by services.exe.

2890th
most commonly executed Windows program
108
observed executions
low
statistical confidence

Behavior

Top Paths

  • C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_1.0.3.0_x64__8wekyb3d8bbwe28.7%
  • C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_0.70.4.0_x64__8wekyb3d8bbwe19.44%
  • C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_1.2.5.0_x64__8wekyb3d8bbwe16.67%
  • C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_1.1.6.0_x64__8wekyb3d8bbwe12.96%
  • C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_1.0.0.0_x64__8wekyb3d8bbwe12.04%
  • C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_1.1.3.0_x64__8wekyb3d8bbwe7.41%
  • C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux_1.2.0.0_x64__8wekyb3d8bbwe2.78%

Top Hashes (SHA256)

  • 7160b721b2e8c2d50de9e782645de974f504a3d569d66786ed41801ca3cd8d8b28.7%
  • c8952327a1a7eb174cad41388a4e372e4ea26ec62b8ca776ecbea2fee2ee0bd619.44%
  • e84f00f83ae8efb6f1d4de69afba525fb06b9f8580b3e7b0ce215f821e49f79316.67%
  • 22285a288d5e9d1a43e79d88d718fa49ff35d622557e9eabdccb47861c7e121312.96%
  • 7355fbefa62049193b542629205a914850f52f47628ae862c97bdc88bd1149cc12.04%
  • 80b5c5b9bc428b2ea7a103b3c7b6e3cd7b776ca2e5fd696953548c6fa2ad10177.41%
  • a407a08d746202aeb79c323d9fe1b12a9ed4c0dab41d3af708c7c2cc2252fb212.78%

Process Ancestry

Top Parents

Top Children

Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.

Ask Rocky about wslservice.exe

Rocky answers questions about wslservice.exe grounded in this same dataset — free, no account needed.

Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.

Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.