ThunderboltZeroInv.exe
Sources: 300M+ executions observed in the wild.
Summary
Thunderbolt Zero Config Inventory - inventories Thunderbolt zero-config devices.
ThunderboltZeroInv.exe is the 989th most commonly executed Windows program in EchoTrail's dataset, observed 2,142 times across enterprise environments. It typically runs from C:\Windows\Temp\... and it is most often launched by invcol.exe.
Get this in your tools
The same record for thunderboltzeroinv.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/thunderboltzeroinv.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\Temp\...99.72%
- C:\Temp\...0.23%
- C:\Users\...0.05%
Top Hashes (SHA256)
- ae6322024f4106dd91b99ac12bd839e74e97af38b324552f75641dc7f06c12b69.72%
- 82de7225317201bbcf71b7b980f8e37b8b2f2f8775dd298569197136647c259e9.18%
- 8e400709d3fb2cd47336c8e017001044714a98fb1cadc3960e2aac65ee2a06488.15%
- be7a580ea5b78bb48fcfa587472314182f73e163a665ff5ed02eb0bfc0cfa7963.63%
- eb3219d84f75c51337cdb4fcf2e666bc5a832c1c123dae94ca473b5702ea25693.39%
- 4fab5998b6eff7920dd817575f97b3252646408a6db920ef6f59e04645ff76783.09%
- d97d292f72c9a247f9a9ea32eb68bcb4ae3306a0a0e8e879b94d0a111fa940bf2.7%
- b2060728f1d5bac32138f4bdfcbfc2d53ee1595e8374d11449ee92bcbc23f5fe2.65%
- 633adcab83bd89198ba6ce5670dbb3c328488f4743784de94bbf7b0beff22a292.4%
- ba479154820d61e60adc1d62c4a5270f92c1c01834c92fb63893d229709816752.21%
Process Ancestry
Top Grandparents
- InvColPC.exe100%
Top Parents
- invcol.exe100%
Top Children
- ThunderboltRegModule.exe99.51%
- drvupdate.exe0.45%
Ask Rocky about ThunderboltZeroInv.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for ThunderboltZeroInv.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.