.. / services.exe

Star

• Image Path: System32 dir
• Parent Process: wininit.exe
• Number of Instances: 1
• User Account: SYSTEM
• Start Time: Around boot

Implements the Unified Background Process Manager (UBPM), which is responsible for background activities such as services and scheduled tasks. Services.exe also implements the Service Control Manager (SCM), which specifically handles the loading of services and device drivers marked for auto-start. In addition, once a user has successfully logged on interactively, the SCM (services.exe) considers the boot successful and sets the Last Known Good control set (HKLM\SYSTEM\Select\LastKnownGood) to the value of the CurrentControlSet.

Image Path

Executable’s image path.

%SystemRoot%\System32\services.exe

Parent Process

A process which spawned the analyzed process.

wininit.exe

Number of Instances

Expected number of processes running which may normally run on Windows.

One

User Account

Windows account with which the process was launched. This defines what privileges given process has.

Local System

Start Time

Expected time of process to be launched.

Within seconds of boot time