mspaint.exe
by Microsoft
Operating System
Summary
Microsoft Paint - basic image editing application included with Windows.
mspaint.exe is the 1220th most commonly executed Windows program in EchoTrail's dataset, observed 1,259 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by explorer.exe.
1220th
most commonly executed Windows program
1,259
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Windows\System3294.36%
- C:\Windows\SysWOW645%
- C:\Program Files\WindowsApps\Microsoft.Paint_11.2302.18.0_x64__8wekyb3d8bbwe\PaintApp0.4%
- C:\Program Files\WindowsApps\Microsoft.Paint_11.2302.19.0_x64__8wekyb3d8bbwe\PaintApp0.24%
Top Hashes (SHA256)
- 72100afe833afcb6cb68d5507f30ebe7c48b93a319e44ebc783031b80c2de48532.95%
- f2e4864792a70df2ed43b9021ebc171726d1b9b274aa6693a6aa0589512157e923.11%
- 39818f3d974e7455b02261ef017b40839ba2dfb649f3a44726d2ddfc0454b4f417.54%
- d46519b76d09dff8bc5c7b34a4e73ad8e7cf6e4c40bdad6c769e34a099ece0174.34%
- f1e3d8851c7b41e3838eae69a95224c92abd9a33117238ef9730233b5b14cdc23.69%
- db3516dbf69d16183421429b8005a01affaef361c6d1fa5a06591ea0eb38854e3.2%
- 474cdb204efea21378ae858ae517ffb9e3b066d59d8c3066246ab404cb57c23a2.62%
- 94aa32a2c9c1d2db78318d9c68262c2f834abe26b6e9a661700324b55fdd57091.89%
- 00521265e7eed4772f65d17c92ddcc40f74d0cc0c37cebc55b95eb3241a3757e1.64%
- 615cffe98cad0db5f7f261ce915f13bbbc22378bb2a80591d38205d5658a80921.64%
Process Ancestry
Top Grandparents
- userinit.exe68.84%
- explorer.exe15.53%
- svchost.exe6.98%
- services.exe6.05%
- winlogon.exe0.93%
- WerFault.exe0.84%
- KeePass.exe0.37%
- OUTLOOK.EXE0.28%
- chrome.exe0.09%
- OneDrive.exe0.09%
Top Parents
- explorer.exe73.97%
- OUTLOOK.EXE12.03%
- svchost.exe8.07%
- OpenWith.exe3.09%
- chrome.exe1.03%
- dllhost.exe0.47%
- Acrobat.exe0.32%
- Greenshot.exe0.32%
- cmd.exe0.16%
- Illustrator.exe0.16%
Top Children
- CPC10Q.EXE33.33%
- rundll32.exe16.67%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about mspaint.exe
Rocky answers questions about mspaint.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.