DiskSnapshot.exe
by Microsoft
System Utility
Summary
Windows Disk Snapshot - captures disk usage statistics for storage management reporting.
DiskSnapshot.exe is the 245th most commonly executed Windows program in EchoTrail's dataset, observed 54,217 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by svchost.exe.
245th
most commonly executed Windows program
54,217
observed executions
medium
statistical confidence
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- 965328c982f264890c29ab284fc8225106bf1971988ca0ee4fe4d3af0cf16f4e19.38%
- 4a60e5ebf54bc9edf9f78688acbdff19ca8c4affe29a836f78ca70396be848f715.18%
- 2af7212a150b721d0105928864df0049a4d959ad7b5b997df47ba69b434404b311.82%
- c7b9591eb4dd78286615401c138c7c1a89f0e358caae1786de2c3b08e904ffdc11.5%
- 06d065590c6652d5c811398dbed459b5760adbd4ba5d4d3eea265cb5b1f891e69.41%
- ab7d8320cab32f7e2106e0f7cb74081f2e444c5c99eec856a8c534f2bde8f70c8.52%
- f9a712caed73ec1392224aa13f48b154832151488e53410f1130cdf81aacf2ae7.73%
- 01e0d4ffe6f18299b0f33065dcc4009fd73e357b66b6825eb8338df9d59f8a326.01%
- c36c5e772d92c32af3de75661ff4fd131a28f99735f2fb2c73194d95e2912ea13.17%
- 660f45568effe4564725702ddaa6b36113ee99fb9ad4c0fabca88ccdf06b3d762.09%
Process Ancestry
Top Grandparents
- services.exe100%
Top Parents
- svchost.exe91.93%
Top Children
- conhost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about DiskSnapshot.exe
Rocky answers questions about DiskSnapshot.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.