EchoTrail

copilotapp_proxy.exe

by RealDefense LLC

Sources: observed in the EchoTrail lab on Windows 11.

Summary

Microsoft Edge (Microsoft Edge, Microsoft Corporation)

copilotapp_proxy.exe is not in the 2025 snapshot. It was observed in EchoTrail's behavior lab on Windows 11 24H2 on 2026-09-29 installed from winget package Microsoft.WindowsSDK.10.0.22621.

Get this in your tools

The same record for copilotapp_proxy.exe, by REST or as an MCP tool. Free key, no card.

Get a free key
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
  https://api.echotrail.io/v1/process/copilotapp_proxy.exe

Free returns the summary. Team returns the full record you see on this page. Endpoint docs

n/a
most commonly executed Windows program
n/a
observed endpoint executions

Behavior

Top Paths

  • C:\Program Files (x86)\Microsoft\Copilot\Application

Top Hashes (SHA256)

  • 542e874ac8e0bb6c5ab59bcfc24da2ae6c8390b0f6e87776aedc87757182f937

Code Signing

Signers by share of executions

  • Microsoft CorporationValid
    Embedded signature · 2 hashes
    100%
    Chain
    1. Microsoft Corporation
    2. Microsoft Code Signing PCA 2024
    3. Microsoft Root Certificate Authority 2011
    Valid
    • Apr 16, 2026 to Apr 15, 2027
    Hashes
    • 542e874ac8e0bb6c5ab59bcfc24da2ae6c8390b0f6e87776aedc87757182f93766.67% of executions, first seen Sep 25, 2026
    • 2b28d2e0f8033f2eff6647773a9aa5ac117dbc6f653f9a29259e4df4a3e0f52c33.33% of executions, first seen Sep 25, 2026

Full certificate detail on Team.

Process Ancestry

Top Grandparents

Top Parents

Top Children

Lab record

Installed from
winget Microsoft.WindowsSDK.10.0.22621 10.0.22621.2428
Publisher
Microsoft Corporation
Persistence
none
Network
none
Command lines
1 pattern (9 launches)
DLL loads
38 patterns (301 loads)
Registry writes
6 patterns (37 writes)
File writes
0 patterns (0 writes)
HTTP requests
0 patterns (0 requests)
TLS connections
0 patterns (0 handshakes)
Named pipes
0 patterns (0 events)
Process access
1 pattern (8 events)
Driver loads
12 patterns (12 loads)
PowerShell blocks
0 patterns (0 blocks)
Remote threads
0 patterns (0 events)
Audit events
0 patterns (0 events)

Full record on Team.

Ask Rocky about copilotapp_proxy.exe

Rocky is the free chat demo. It answers from this same dataset, no account needed.

This page is the Team-tier API record for copilotapp_proxy.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.