Gridinsoft Logo

The svchost.exe (Host Process for Windows Services) File Analysis

Updated 1 year ago
Checked by Malaware Check
svchost.exe

Technical Analysis

File Name svchost.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.143.174
Database Version 2023-10-23 22:02:24 UTC
✓

Clean File

No threats detected by our scanner

0%
Detection Rate
55,456
File Size (bytes)
2023-10-23
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
d4461ec74a79986aaab9ef3312c961f4
SHA1
e96d28f9c234f07c8f8cd9c124aafaef75e452a2
SHA256
dab2ad1e12aebebceef118504165130e0585faae88d56cfc06b3905bdb18d021
SHA512
3b3a20282da7fc27ef52657b26249a90f4c78fbf498ebe901c76424a64a028106b99cdc4554cb1173e177745d939036caac48d3f14000c112c45cc55c8c76721
ImpHash
247b9220e5d9b720a82b2c8b5069ad69

PE Analysis

Basic Information

▼
Image Base 0x140000000
Entry Point 0x140005080
Compilation Time 1979-08-31 23:20:03
Checksum 0x0001c4b3 (Actual: 0x0001c4b3)
OS Version 10.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
PDB Path svchost.pdb
Digital Signature OK
Imports 30 libraries
Exports 0 functions
Resources 3 Resources
Sections 7 Sections

Digital Signatures

▼
Microsoft Windows Production PCA 2011 Microsoft Corporation (US)
Microsoft Root Certificate Authority 2010 Microsoft Corporation (US)

Version Information

▼
CompanyName Microsoft Corporation
FileDescription Host Process for Windows Services
FileVersion 10.0.19041.3570 (WinBuild.160101.0800)
InternalName svchost.exe
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename svchost.exe
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.19041.3570
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 23,533 bytes 23,552 bytes 5.93 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 390299E7A766ED82CFFC69882685DAFB
.rdata 0x00007000 14,294 bytes 14,336 bytes 4.55 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 68F71A22EA3EC79E56D0EC47DACD9E32
.data 0x0000b000 2,168 bytes 512 bytes 0.38 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE DAE690B4E58A3520398EFFC27D07A210
.pdata 0x0000c000 1,560 bytes 2,048 bytes 3.60 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 2D7D304279E9A94A3F469C5BA4F807A6
.didat 0x0000d000 48 bytes 512 bytes 0.35 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE BB85728D3111674F29BB16869AB2EB4C
.rsrc 0x0000e000 2,080 bytes 2,560 bytes 3.75 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 22B917C8DA55B037A2227BD69D4DE8F4
.reloc 0x0000f000 108 bytes 512 bytes 1.28 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 052AE962C37420554FBEB603EDA9F9FB

Resource Analysis

▼
Total Resources: 3 (1,834 bytes)
Resource Type Count Total Size Percentage
MUI 1 200 bytes
10.9%
RT_VERSION 1 944 bytes
51.5%
RT_MANIFEST 1 690 bytes
37.6%

Certificate Chain Analysis

▼
Certificate #1
Subject Microsoft Windows Publisher
Microsoft Corporation
US
Issuer Microsoft Windows Production PCA 2011
Serial Number 1137338010857634205578978592502211937346520144
Certificate #2
Subject Microsoft Windows Production PCA 2011
Microsoft Corporation
US
Issuer Microsoft Root Certificate Authority 2010
Serial Number 458207203049816025202696
Certificate Verification Status

OK

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
This file passed all security checks, but stay vigilant. New malware variants appear daily that can evade detection. Always verify files come from official sources and check digital signatures when available.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware