Versions

6.3.9600.16384 (winblue_rtm.130821-1623)	4.35%
6.3.9600.16384 (winblue_rtm.130821-1623)	0.10%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.24%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.05%
6.2.9200.16384 (win8_rtm.120725-1247)	2.49%
6.2.9200.16384 (win8_rtm.120725-1247)	13.87%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.10%
6.2.8400.0 (winmain_win8rc.120518-1423)	0.10%
6.2.8250.0 (winmain_win8beta.120217-1520)	0.05%
6.2.8102.0 (winmain_win8m3.110823-1455)	0.10%
6.1.7600.16385 (win7_rtm.090713-1255)	25.05%
6.1.7600.16385 (win7_rtm.090713-1255)	44.53%
6.1.7600.16385 (win7_rtm.090713-1255)	0.05%
6.0.6001.18000 (longhorn_rtm.080118-1840)	7.08%
6.0.6001.18000 (longhorn_rtm.080118-1840)	1.46%
6.0.6000.16386 (vista_rtm.061101-2205)	0.39%

This is a Windows system installed file with Windows File Protection (WFP) enabled.

There are 16 versions of ui0detect.exe in the wild, the latest version being 6.3.9600.16384 (winblue_rtm.130821-1623). It is started as a Windows Service called 'Detección de servicios interactivos' with the name 'UI0Detect' and described as “Habilita la notificación al usuario sobre la entrada de usuario para los servicios interactivos; esto habilita el acceso a los cuadros de diálogo creados por los servicios interactivos cuando aparecen. Si se detiene este servicio, dejarán de funcionar las notificaciones de cuadros de diálogo de nuevos servicios interactivos y es posible que no se pueda obtener acceso a los cuadros de diálogo de se”. . In addition, it is run under the context of the SYSTEM account with extensive privileges (the administrator accounts have the same privileges). The average file size is about 38.19 KB. During the process's lifecycle, the typical CPU resource utilization is less than 0.01%, the average private memory consumption is about 2.39 MB with the maximum memory reaching around 6.16 MB. Addionally, typically read and write I/O disk operations is about 92 Bytes per minute for reads and 523 Bytes per minute for writes.

Services and system processes run in session 0. Interactive Services Detection (the blinking button on the taskbar) is a mitigation for legacy applications that detects if a service is trying to interact with the desktop. This is handled by the Interactive Services Detection (UI0Detect) service.