osk.exe
Summary
Accessibility On-Screen Keyboard
osk.exe is the 3817th most commonly executed Windows program in EchoTrail's dataset, observed 41 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by explorer.exe.
3817th
most commonly executed Windows program
41
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Windows\System32100%
Top Hashes (SHA256)
- c9e625e25d9aa375af64bf46309dcd8395c5265d304043fafe97142e80ad5a2c36.36%
- 53809b7dddb65ce004076b282a039ca682f68cd3211a48237a71c2ccb0dc700324.24%
- 21e04c0248be53d40c091619dbe3b7337e8b26d2e37debb5e8e0489d3d72b42312.12%
- 49373bae22572752532fcd232ac8c9d5b21d393bca9ea0f79ae13f1540210da76.06%
- 79c62bde821fbb73ccd72621e4eddff3d5dae7b915bb7620084fa72e324b3cc06.06%
- 7ac4b734a31ac4c29ccc53b7433773911ca46e1063a8b0f033ab9027d34273426.06%
- f855ffb4f49efe66efcdf28e0710637fe34e7a89e38a9493c88153220cd873ad6.06%
- bda46e284362ec360aa8f3e8999437faf41dad0723fbdbcf9ba1e6d8e6c945573.03%
Process Ancestry
Top Grandparents
- winlogon.exe58.33%
- AtBroker.exe25%
- userinit.exe16.67%
Top Parents
- explorer.exe43.9%
- AtBroker.exe29.27%
- utilman.exe26.83%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about osk.exe
Rocky answers questions about osk.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.