CylanceSvc.exe
Summary
Cylance PROTECT Service - core service process for Cylance AI-based endpoint protection.
CylanceSvc.exe is the 670th most commonly executed Windows program in EchoTrail's dataset, observed 6,171 times across enterprise environments. It typically runs from C:\Program Files\Cylance\Desktop and it is most often launched by services.exe.
Behavior
Top Paths
- C:\Program Files\Cylance\Desktop86.81%
- C:\Program Files\Cylance\Desktop\b6.27%
- C:\Program Files\Cylance6.22%
- C:\Program Files\Cylance\b0.7%
Top Hashes (SHA256)
- f8fb8c3745c0c7095b1c6a26343b79f84b9f9a3a78cc9062d6add6e85c5c2d5230.53%
- 54da90894109158a9c6d81d853aa35f737dbac8963c8793db013c5ce2136fabf14.05%
- 29df28b3c18ce886889564cd17a55e51064c885890eec5d8afc462d44155e23d8.12%
- 24bc2651d7e14123f638bb1e34549e40a8a12c7fad9896a5ced443e7aff550f86.94%
- b495a3cea0739d0b62e709451118a304984ae46c3870771877ba0f7ed72c5e2b4.89%
- cda8911bc5fdd352ef0aaa3306cf066c668d498e12fce9e38380df9c6d45d7804.15%
- 4295e92989c5f38c9f62e9dd40440a5f14f3ada122a8a271ac4b773b26c4a6792.89%
- 1ba1ba0a1efa92d5390b069533daa7284722e39be4bf0219225efd163f4e102f2.73%
- a9be1ade4fd7a5c0e8d0e7cdcb55b74a848fcf2f81df16990fcdc5048788db152.43%
- 912b7cfd25379c3469588bca43f2abce24a3930193932ad5bfd33680ad200fc52.33%
Process Ancestry
Top Grandparents
- wininit.exe84.79%
- CylanceSvc.exe14.53%
- services.exe0.61%
- svchost.exe0.03%
- userinit.exe0.03%
Top Parents
- services.exe85.35%
- CyUpdate.exe13.89%
- msiexec.exe0.65%
- dllhost.exe0.03%
- explorer.exe0.03%
Top Children
- CyUpdate.exe99.3%
- conhost.exe0.65%
- WerFault.exe0.03%
- InstallUtil.exe0.02%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about CylanceSvc.exe
Rocky answers questions about CylanceSvc.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.