Rocky Raccoon

TSTheme.exe

by Microsoft
Operating System

Summary

Terminal Services Theme Service - manages visual themes in Remote Desktop sessions.

TSTheme.exe is the 626th most commonly executed Windows program in EchoTrail's dataset, observed 7,041 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by svchost.exe.

626th
most commonly executed Windows program
7,041
observed executions
low
statistical confidence

Behavior

Top Paths

  • C:\Windows\System32100%

Top Hashes (SHA256)

  • dbdf0c85b1a39656e616e428fcefedc930761acc5cf2846bbf8e60610016142a20.86%
  • c31798a1bd47abd1d3ea6344f535bddeb2c1ab5fead49ccf5cfc3f1c7fb35c1720.6%
  • c1879b15c38d1c9bb86bcfd08a0b7d8a0809c553f8f1985659d7da0c883ea4f715.66%
  • 51d67b482954239ef2a55b7476ed6de388c3592ae82195243649f23a72cd421211.87%
  • 5edb8f164b5cacaefc551e3d0ea0971e5da1ab144ab66fe429bc7e5dcb2fcc3c10.17%
  • 3a22aaa677b8b658386f6a22ecfb36795dc1be55aed591feaa05ca8d369734647.84%
  • 29305b1c55bee1bb298464f1b47b3cc493b9fc5ea65da516afc09d26ddfc717e4.6%
  • cd3d07f54a1cbd14e8baad9a6ab990ee892ca988f9c24ebc8a624bf2932f84de3.44%
  • 9adb2d70a46c3f4c33c592a32b6ffc9b742ca3512ca8704db2c13fb70988c1152.77%
  • ccabe63588d5aa633bb6ca01c69c693534651e7cd14dd533bc5008f9a80f21160.92%

Process Ancestry

Top Grandparents

Top Parents

Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.

Ask Rocky about TSTheme.exe

Rocky answers questions about TSTheme.exe grounded in this same dataset — free, no account needed.

Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.

Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.