aesm_service.exe
Sources: 300M+ executions observed in the wild.
Summary
Intel SGX Application Enclave Service Manager - manages Intel Software Guard Extensions enclaves.
aesm_service.exe is the 1285th most commonly executed Windows program in EchoTrail's dataset, observed 1,098 times across enterprise environments. It typically runs from C:\Program Files\Intel\IntelSGXPSW\bin\x64\Release and it is most often launched by services.exe.
Get this in your tools
The same record for aesm_service.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/aesm_service.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Program Files\Intel\IntelSGXPSW\bin\x64\Release71.58%
- C:\Windows\System32\DriverStore\FileRepository\sgx_psw.inf_amd64_1781f8bae8fdf5c023.95%
- C:\Windows\System32\DriverStore\FileRepository\sgx_psw.inf_amd64_df0bea5643beeb1b4.46%
Top Hashes (SHA256)
- 1b2772da21b4cad37b5d77d7b981507f52eaa951a020f032c94c8a6c328682fa30%
- 47f7f0acf0662db8d8e0bdff74984dc14e32e90082c09584ae0db87c190fe57524.13%
- bdb316a2bdc0b1d576a3d7c50d692b5f739e8875c3f58c21ae5f9ef16908b55916.42%
- 93cbf8d6f899cd8b691f22fc8a5c3771dcacc2f9fd1ea6f9127ebf7f6452572715.41%
- 71aa5ebc3518f141347ee7ca9cfe954ec3a9b3036a48e9b57578c287d61055126.15%
- c43976a79ff47cc09625834419351632ecb8518e50ff58a4f0bc75dc444e4d2b4.5%
- 609513a568837366fd808d385d3542b427fd2547707b8ca7299d6d3988e742d93.39%
Process Ancestry
Top Grandparents
- wininit.exe97.68%
- services.exe1.29%
- msiexec.exe1.03%
Top Parents
- services.exe98.36%
- msiexec.exe1.64%
Top Children
- icacls.exe69.57%
- takeown.exe17.39%
- sc.exe13.04%
Ask Rocky about aesm_service.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for aesm_service.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.