CSFalconServiceUninstallTool_x64.exe
Sources: 300M+ executions observed in the wild.
Summary
CrowdStrike Falcon service uninstall tool (x64) for removing endpoint protection during decommission
CSFalconServiceUninstallTool_x64.exe is the 2223rd most commonly executed Windows program in EchoTrail's dataset, observed 234 times across enterprise environments. It typically runs from C:\ProgramData\... and it is most often launched by CSFalconServiceUninstallTool_x64.exe.
Get this in your tools
The same record for csfalconserviceuninstalltool_x64.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/csfalconserviceuninstalltool_x64.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\ProgramData\...100%
Top Hashes (SHA256)
- 2013e4248979c12d9dbb4e82f72bed129e90fea7e05cb41e50ad0c8a4139e6765.42%
- 7eaf310fe990b0906dffbd0b2d5e709af7a15c4f0af056ec4bd10be470a117674.58%
- 149cb54a04d178d94020630a10c874d82affc0e22c67ce01c59a0c1b9a9604402.92%
- c28e7b67144556661a01cb10110e868c31120d6b06938313493507238248b8db2.92%
- 21b86c62604df83fff2b91f073f339ba128ba9c08527177f380fcac80a9471d52.5%
- c2f667e303b903dd62c0b46eac30ef1601027d6f0e9393eea968d3f9488bf5842.5%
- 1fc00b89536cf180948c022447d7cb8f2a398a0b11efe782c1bb2a3f19f9ae842.08%
- 38b1ef496ed1b49718c601c866e1f714e71d4770386efdb79fb5ca041fce92602.08%
- b0fa8f5d82fcf3ec383f2d8b786a6ffff840caa0417769b1fadbf8d43818ba132.08%
- 0110a6ebf49c1b9c4072201c4f5db0c51bd34f816f8ea7cb6ddef924598d4d421.67%
Process Ancestry
Top Parents
Top Children
- conhost.exe47.33%
Ask Rocky about CSFalconServiceUninstallTool_x64.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for CSFalconServiceUninstallTool_x64.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.