copilotundockedhost_x64_154.0.4258.37.exe

by RealDefense LLC

Sources: observed in the EchoTrail lab on Windows 11.

Summary

Microsoft Edge Installer (Microsoft Edge Installer, Microsoft Corporation)

copilotundockedhost_x64_154.0.4258.37.exe is not in the 2025 snapshot. It was observed in EchoTrail's behavior lab on Windows 11 24H2 on 2026-09-29 installed from winget package Microsoft.WindowsSDK.10.0.22621.

Get this in your tools

The same record for copilotundockedhost_x64_154.0.4258.37.exe, by REST or as an MCP tool. Free key, no card.

Get a free key
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
  https://api.echotrail.io/v1/process/copilotundockedhost_x64_154.0.4258.37.exe

Free returns the summary. Team returns the full record you see on this page. Endpoint docs

n/a
most commonly executed Windows program
n/a
observed endpoint executions

Behavior

Top Paths

  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{13F2253B-89F5-4E07-BC61-79C24EF3729B}
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{82D4DFE6-F84B-4563-91B5-190E2F160658}
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1B405149-5C99-4EF4-8F10-21D5C98BD097}
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{85F93A4E-EA81-4710-BDA1-D97CB1410B4C}
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{60EFCCC6-F944-4495-B0CD-F2E8A6315655}

Top Hashes (SHA256)

  • f03ae50144be2952540430f9521c063d8ffcd82a46b9f469f4acd079ee3190a4

Process Ancestry

Top Grandparents

Top Parents

Top Children

Lab record

Installed from
winget Microsoft.WindowsSDK.10.0.22621 10.0.22621.2428
Publisher
Microsoft Corporation
Persistence
none
Network
none
Command lines
1 pattern (5 launches)
DLL loads
20 patterns (100 loads)
Registry writes
2 patterns (10 writes)
File writes
25 patterns (25 writes)
HTTP requests
0 patterns (0 requests)
TLS connections
0 patterns (0 handshakes)
Named pipes
0 patterns (0 events)
Process access
0 patterns (0 events)
Driver loads
12 patterns (12 loads)
PowerShell blocks
0 patterns (0 blocks)
Remote threads
0 patterns (0 events)
Audit events
0 patterns (0 events)

Full record on Team.

Ask Rocky about copilotundockedhost_x64_154.0.4258.37.exe

Rocky is the free chat demo. It answers from this same dataset, no account needed.

This page is the Team-tier API record for copilotundockedhost_x64_154.0.4258.37.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.