sysmon64.exe
by Microsoft (Sysinternals)
Endpoint Security
Sources: 300M+ executions observed in the wild.
Summary
Sysinternals System Monitor (64-bit) - already populated.
sysmon64.exe is the 552nd most commonly executed Windows program in EchoTrail's dataset, observed 9,342 times across enterprise environments. It typically runs from C:\ProgramData\... and it is most often launched by cmd.exe.
Get this in your tools
The same record for sysmon64.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/sysmon64.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
552nd
most commonly executed Windows program
9,342
observed endpoint executions
Behavior
Top Paths
- C:\ProgramData\...54.78%
- C:\Windows44.81%
- C:\Program Files (x86)\EchoTrail\Sysmon0.29%
- C:\Users\...0.11%
- C:\...0.01%
Top Hashes (SHA256)
- 2e2ce2f3fbb2a00ad374af9419b41f8dd09244e299d5fb32326b0b775857ecf750.18%
- c1255d2e0f139c1f494786bfb7f4764bb6ca05680010aadbc7fdd3db1f6e56e929.85%
- 3267279461be7397ef6e2afe61f9396e42475577f8c76648dbcae1b831b6fd3e8.76%
- de2d6b0260566ef4a485ad3ffb4a57095419ac503c3a405cb62c5f698a5d69506.73%
- bc6a579553f1cafec84ffc1baea3ec6fa5656ed207d3e8177798070c4f71e53e1.73%
- 8d4fc2c9352dad893d63ca30829b35c935e304c2fd0be83e7daebbe59a5586941.31%
- 373061d73b6743651050749dba958090a954939109fc51dd27e548b0d71cd75c1.3%
- 82b16d5247be31d9bddeb07dc716dd5d7a50f233807519037e88d8279ce850330.05%
- 9bbb54daf9d2a33e8d3db835e7043e7d1cb17d45539e94b10db0c7ccdfd3a6c90.04%
- ee067d135d799e98aa5de5cbd10d13a087721a982b7bff4d6c1678c33d0ed9fb0.04%
Process Ancestry
Top Grandparents
- svchost.exe100%
Top Parents
- cmd.exe55.08%
- services.exe44.8%
- msiexec.exe0.11%
- powershell.exe0.01%
Top Children
- conhost.exe98.74%
- wevtutil.exe1.26%
Ask Rocky about sysmon64.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for sysmon64.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.