Versions

6.3.9600.16384 (winblue_rtm.130821-1623)	5.77%
6.3.9600.16384 (winblue_rtm.130821-1623)	0.08%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.27%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.01%
6.2.9200.16384 (win8_rtm.120725-1247)	1.05%
6.1.7601.17725 (win7sp1_gdr.111116-1503)	49.58%
6.1.7601.17725 (win7sp1_gdr.111116-1503)	22.84%
6.1.7600.16915 (win7_gdr.111116-1506)	4.33%
6.1.7600.16385 (win7_rtm.090713-1255)	9.97%
6.1.7600.16385 (win7_rtm.090713-1255)	4.79%
6.0.6000.16386 (vista_rtm.061101-2205)	1.31%

This is a Windows system installed file with Windows File Protection (WFP) enabled.

There are 11 versions of lsass.exe in the wild, the latest version being 6.3.9600.16384 (winblue_rtm.130821-1623). It is started as a Windows Service called 'Protected Storage' with the name 'ProtectedStorage' and described as “Provides protected storage for sensitive data, such as passwords, to prevent access by unauthorized services, processes, or users.”. . In addition, it is run under the context of the SYSTEM account with extensive privileges (the administrator accounts have the same privileges). This is executed as a shared service (which simply means that this service can share a process with other Win32 services). The average file size is about 28.68 KB. The file is a digitally signed and issued to Microsoft Corporation by Microsoft Corporation. During the process's lifecycle, the typical CPU resource utilization is about 0.0047% including both foreground and background operations, the average private memory consumption is about 5.83 MB with the maximum memory reaching around 12.4 MB. Addionally, typically read and write I/O disk operations is about 1.96 KB per minute for reads and 4.17 KB per minute for writes.

Local Security Authority Subsystem Service (LSASS), is a process in Microsoft Windows operating systems that is responsible for enforcing the security policy on the system. It verifies users logging on to a Windows computer or server, handles password changes, and creates access tokens.