Rocky Raccoon

screensketch.exe

by Microsoft
Operating System

Summary

Windows Snip & Sketch screenshot tool

screensketch.exe is the 2900th most commonly executed Windows program in EchoTrail's dataset, observed 107 times across enterprise environments. It typically runs from C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe and it is most often launched by svchost.exe.

2900th
most commonly executed Windows program
107
observed executions
low
statistical confidence

Behavior

Top Paths

  • C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe58.88%
  • C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.2008.2277.0_x64__8wekyb3d8bbwe27.1%
  • C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1809.2964.0_x64__8wekyb3d8bbwe4.67%
  • C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1901.10521.0_x64__8wekyb3d8bbwe3.74%
  • C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1807.2286.0_x64__8wekyb3d8bbwe1.87%
  • C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1811.3471.0_x64__8wekyb3d8bbwe1.87%
  • C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1806.2112.0_x64__8wekyb3d8bbwe0.93%
  • C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2205.10.0_x64__8wekyb3d8bbwe0.93%

Top Hashes (SHA256)

  • e142291bc8e720c15e440e0033ee7ae2cea0ce78a3c52f81a07fcf8f6ff61c6b60.58%
  • ce372e8e0c4548d733f0ca34dc0837ea8bb97668426645496d9e4f05418f582327.88%
  • 9a77a74407352068f8812cf38a5da09f88939d2cf567410cb2d5b11bb0cc2fc64.81%
  • a7bcd560432a28852b0184433f835cda64254a419e34fbe34dc954419e3970a41.92%
  • ec994e21a4163f8b88b1f1b5c55d3bb80c14336f7238cbf955db96e9b95828311.92%
  • 2450902195fd9dee5826c59dbb85430c513b4f4a964cdcfb8ea154c15b3c9cda0.96%
  • 4b0aae0d373874d43bf75e5a6b3b8039ecc6d1f1d029de0504fb6478a40f3b030.96%
  • 6847d320625832ad4696f0d27c04b0456fa2b540ebc513986ad197f769c8b9050.96%

Process Ancestry

Top Grandparents

Top Parents

Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.

Ask Rocky about screensketch.exe

Rocky answers questions about screensketch.exe grounded in this same dataset — free, no account needed.

Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.

Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.