Parent process

Related files

This is a Windows system installed file with Windows File Protection (WFP) enabled.

sethc.exe executes as a process under the SYSTEM account with extensive privileges (the system and the administrator accounts have the same file privileges) typically within the context of its parent atbroker.exe (Windows Assistive Technology Manager by Microsoft). This version is installed on Windows 8 and is compiled as a 64 bit program.

CPU
Total CPU:	0.00003883%	0.028634%
Kernel CPU:	0.00001266%	0.013761%
User CPU:	0.00002617%	0.014873%
Kernel CPU time:	16 ms/min	100,923,805ms/min
CPU cycles:	733/sec	17,470,203/sec
Memory
Private memory:	900 KB	21.59 MB
Private (maximum):	3.3 MB
Private (minimum):	2.55 MB
Non-paged memory:	900 KB	21.59 MB
Virtual memory:	44.95 MB	140.96 MB
Virtual memory (peak):	45.81 MB	169.69 MB
Working set:	2.59 MB	18.61 MB
Working set (peak):	3.3 MB	37.95 MB
Page faults:	922/min	2,039/min
I/O
I/O read transfer:	13 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O other transfer:	2 Bytes/sec	448.09 KB/min
I/O other operations:	1/sec	1,671/min
Resource allocations
Threads:	3	12
Handles:	80	600

Sethc.exe (main module)
Total CPU:	0.00005262%	0.272967%
Kernel CPU:	0.00000000%	0.107585%
User CPU:	0.00005262%	0.165382%
CPU cycles:	689/sec	5,741,424/sec
Memory:	280 KB	1.16 MB
PlaySndSrv.DLL
Total CPU:	0.00002631%
Kernel CPU:	0.00002631%
User CPU:	0.00000000%
CPU cycles:	7/sec
Memory:	96 KB