sh.exe
by GNU/Various
Development Tool
Sources: 300M+ executions observed in the wild.
Summary
Unix shell (typically from Git for Windows, MSYS2, or Cygwin) - provides Bash-compatible shell on Windows.
sh.exe is the 533rd most commonly executed Windows program in EchoTrail's dataset, observed 10,163 times across enterprise environments. It typically runs from C:\Users\... and it is most often launched by git-remote-https.exe.
Get this in your tools
The same record for sh.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/sh.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
533rd
most commonly executed Windows program
10,163
observed endpoint executions
Behavior
Top Paths
- C:\Users\...95.06%
- C:\Program Files\Git\usr\bin2.51%
- C:\...2.43%
Top Hashes (SHA256)
- 2eb357078cfc0deb71631eec392f70ad0eef6f7a3763b523071ed5f9421778c492.27%
- 78d1760e7ead9d594cb0183e9632af761df9d4c46714bb92086d5de99351050d2.43%
- 744343e01351ba92e365b7e24eedd4ed18ed3ebe26e68c69d9b5e324fe64a1b52.35%
- 0a0ec9b7259d0fbdaa037f1ff630cf37f097e0c82bbe8275c7084d59120644b01.35%
- fc98a4cb037259e59c908778446fa4738087f3381547cafdc9ae1328193205850.72%
- 797e2fd8f51acbe1da517b2ad56ad07f16e2649a85502c12341153a0e13463500.51%
- 5635de45980e960f315fa3ea0b3ee01a9687a370e134d268a2614f20ec2cfa5f0.31%
- bb8267613f55d6f53e8a4b1f2a92688e0e1217bdb22402d90f7363044d8158de0.06%
Process Ancestry
Top Parents
- git-remote-https.exe86.85%
- sh.exe10.29%
- git.exe0.65%
- bash.exe0.06%
Ask Rocky about sh.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for sh.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.