SASrv.exe
by Dell
Driver/Hardware
Summary
SupportAssist Recovery Agent - Dell recovery agent service.
SASrv.exe is the 1102nd most commonly executed Windows program in EchoTrail's dataset, observed 1,629 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by services.exe.
1102nd
most commonly executed Windows program
1,629
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Windows\System3278.76%
- C:\Windows\SysWOW6421.24%
Top Hashes (SHA256)
- 8af4e13511aab6385f1365a9155c911be9451ec7f16d0e98ab065e3712e4d08534.22%
- 11ed2fe2f1d7c5c029e1f91de1b73d80666fa4dc69ded420d31e8c4924a2be1028.07%
- dd8ee9afabea5ebeea1534b140f50e5170260f59e5542b56eeaa207a5852428320.63%
- 34939518e75e11b18150cae24c488c10d6d1d5056986b2692050a543eec16c9d14.75%
- 0ec92836430ffa5e4b143051c5818bde4b4e2e3258236f9f2187a841e142dbd61.16%
- eb2c6aff1f9f8435694a04f8073504a45049d3683605b823863a631e61142f6c1.1%
- 10170cbd6965cd3cebe3322231030820fd7e539c180ed49507bbc66f6602ed5c0.06%
Process Ancestry
Top Grandparents
- wininit.exe98.9%
- setup.exe0.58%
- drvinst.exe0.52%
Top Parents
- services.exe98.96%
Top Children
- SACpl.exe75%
- regsvr32.exe18.75%
- conhost.exe6.25%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about SASrv.exe
Rocky answers questions about SASrv.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.