platform-webroot-plugin.exe
Sources: 300M+ executions observed in the wild.
Summary
Endpoint management platform plugin. Collects system state, handles patching, or manages security components depending on the plugin type.
platform-webroot-plugin.exe is the 101st most commonly executed Windows program in EchoTrail's dataset, observed 232,337 times across enterprise environments. It typically runs from C:\Program Files (x86)\ITSPlatform\plugin\webroot and it is most often launched by platform-agent-core.exe.
Get this in your tools
The same record for platform-webroot-plugin.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/platform-webroot-plugin.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Program Files (x86)\ITSPlatform\plugin\webroot100%
- C:\Program Files (x86)\ITSPlatform\tmp\platform-webroot-plugin\webroot<0.01%
Top Hashes (SHA256)
- 893c4bd4cd45299375e5a5b7b14545bc3749f0f8610f0a3a49e583ab63b6454137.78%
- 605c3d90204a5b8fcda0844947b3c5a6a2ab4a5fad0acedf3748be2f7a342c8320.94%
- 9497821c94ab39ca75a5df4dd62f88de84d496b2681b4a8e2167e9af3ceaf9a116.4%
- bd6dbab88edcee8eb0ce1269e52405d4e23a215c7bdbe8a1f633d65024ec5be59.17%
- 3508a48ee14f87371860e584de638ad53718f45692223b713fb9e474c61fbd648.24%
- 2add50b3bc1d8bfa2f7d3e18214010a23e8472775c275342f9af6751a15c48314.71%
- 5b159f8344b1480cf4af09bd5309e767565564a4ce5f978fc35246d9f5e55f002.76%
Process Ancestry
Top Parents
- platform-agent-core.exe98.48%
Top Children
- conhost.exe100%
Security Analysis
What does platform-webroot-plugin.exe normally do?
Part of an endpoint management agent. Runs continuously.
When is platform-webroot-plugin.exe suspicious?
Running from unexpected paths.
How do attackers abuse platform-webroot-plugin.exe?
Not commonly abused.
Detection guidance
No detection needed.
False positive notes
Normal management agent operation.
Related Processes
Ask Rocky about platform-webroot-plugin.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for platform-webroot-plugin.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.