EchoTrail

elevated_tracing_service.exe

by RealDefense LLC

Sources: observed in the EchoTrail lab on Windows 11.

Summary

Microsoft Edge (Microsoft Edge, Microsoft Corporation)

elevated_tracing_service.exe is not in the 2025 snapshot. It was observed in EchoTrail's behavior lab on Windows 11 24H2 on 2026-09-29 installed from winget package SUPERAntiSpyware.SUPERAntiSpyware.

Get this in your tools

The same record for elevated_tracing_service.exe, by REST or as an MCP tool. Free key, no card.

Get a free key
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
  https://api.echotrail.io/v1/process/elevated_tracing_service.exe

Free returns the summary. Team returns the full record you see on this page. Endpoint docs

n/a
most commonly executed Windows program
n/a
observed endpoint executions

Behavior

Top Paths

  • C:\Program Files (x86)\Microsoft\Copilot\Application\154.0.4258.37

Top Hashes (SHA256)

  • e99dd200d80c3feb81a5a75aadfe46738382f6d67f4373edf4f2764470599501

Code Signing

Signers by share of executions

  • Microsoft CorporationValid
    Embedded signature · 2 hashes
    72.73%
    Chain
    1. Microsoft Corporation
    2. Microsoft Code Signing PCA 2024
    3. Microsoft Root Certificate Authority 2011
    Valid
    • Apr 16, 2026 to Apr 15, 2027
    Hashes
    • e99dd200d80c3feb81a5a75aadfe46738382f6d67f4373edf4f276447059950154.55% of executions, first seen Sep 25, 2026
    • dd36abd0257a34e1db3a850756bc0eb1d12b133c3e4f311c54510cb6ae3b76db18.18% of executions, first seen Sep 25, 2026
  • Google LLCValid
    Embedded signature · 1 hash
    27.27%
    Chain
    1. Google LLC
    2. DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
    3. DigiCert Trusted Root G4
    Valid
    • Apr 8, 2024 to Apr 10, 2027
    Hashes
    • 93a4b254b16c9a9d98436e8c91d0933bfcd468e2ef1d2465a9cf32cd30a911bf27.27% of executions, first seen Sep 10, 2026

Full certificate detail on Team.

Process Ancestry

Top Grandparents

Top Parents

Lab record

Installed from
winget SUPERAntiSpyware.SUPERAntiSpyware 10.0.1278
Publisher
Microsoft Corporation
Persistence
none
Network
none
Command lines
1 pattern (5 launches)
DLL loads
30 patterns (151 loads)
Registry writes
0 patterns (0 writes)
File writes
0 patterns (0 writes)
HTTP requests
0 patterns (0 requests)
TLS connections
0 patterns (0 handshakes)
Named pipes
0 patterns (0 events)
Process access
0 patterns (0 events)
Driver loads
0 patterns (0 loads)
PowerShell blocks
0 patterns (0 blocks)
Remote threads
0 patterns (0 events)
Audit events
0 patterns (0 events)

Full record on Team.

Ask Rocky about elevated_tracing_service.exe

Rocky is the free chat demo. It answers from this same dataset, no account needed.

This page is the Team-tier API record for elevated_tracing_service.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.