svchost.exe

GPTKB entity

Statements (45)
Predicate Object
gptkbp:instanceOf Process
gptkbp:architecture 32-bit
64-bit
gptkbp:canBe breed registry
gptkbp:canBeMisusedBy malware
gptkbp:canBeRestartedBy Service Control Manager
gptkbp:canBeStoppedBy Service Control Manager
gptkbp:canBeTargetOfMalware true
gptkbp:canRunMultipleInstances true
gptkbp:category service host
gptkbp:cause system instability if terminated
gptkbp:criticalFor Windows operation
gptkbp:defaultPath C:\\Windows\\System32\\svchost.exe
gptkbp:developedBy gptkb:Microsoft
gptkbp:documentation https://learn.microsoft.com/en-us/windows/win32/services/svchost
gptkbp:executableName gptkb:svchost.exe
gptkbp:extendsTo .exe
gptkbp:firstAppearance gptkb:Windows_2000
gptkbp:foundIn gptkb:Windows_Task_Manager
https://www.w3.org/2000/01/rdf-schema#label svchost.exe
gptkbp:introducedIn gptkb:Windows_2000
gptkbp:location C:\\Windows\\System32
gptkbp:mayInclude multiple services
gptkbp:monitors gptkb:Process_Explorer
gptkb:Task_Manager
gptkbp:operatingSystem gptkb:Microsoft_Windows
gptkbp:parentProcess services.exe
gptkbp:presentIn gptkb:Windows_8
gptkb:Windows_10
gptkb:Windows_11
gptkb:Windows_7
gptkb:Windows_Vista
gptkb:Windows_XP
gptkbp:purpose hosts Windows services
gptkbp:relatedTo Service Control Manager
Windows services
gptkbp:runsOn Local Service
Network Service
Local System
gptkbp:signedBy gptkb:Microsoft
gptkbp:supportsFormat executable file
gptkbp:usedFor grouping services into processes
gptkbp:bfsParent gptkb:Proxysvc
gptkb:Remote_Registry_Service
gptkbp:bfsLayer 8