sdbinst.exe
Summary
Windows Application Compatibility Database Installer - installs application compatibility shim databases (.sdb files) that modify application behavior at runtime.
sdbinst.exe is the 821st most commonly executed Windows program in EchoTrail's dataset, observed 3,659 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by svchost.exe.
Behavior
Top Paths
- C:\Windows\System3293.25%
- C:\Windows\SysWOW646.75%
Top Hashes (SHA256)
- 29e98ce8d214358ad4fbf6daf6374a83524b938b4a624f686862e698f765269c31.52%
- 6cc48f57e15d171e2afcb59543d5e2e61c7338a89a07924d278e2a9d57f579a020.59%
- dd04783db8334dc82399956e04d089607e91b3942c92bbb1b3b482ae20f8402911.2%
- f668b054476fee2380fd6091439725f22cc5f774579dc1924acddc75a453383e7.04%
- 282086b837400fd2db00df5dc238782e482c6ff1f46adfee697214688838acad6.79%
- 4e2217e6b6ac20fc3e14e70c377f3f57f3b161a7ca7c29683939408e47ce48006.05%
- 4437b40482baeedbd92ffaabc7d7b0b244ac5e68a2a93e4881f5772ce7c77bb14.85%
- f92f5a22c6dff993b7ae5428c7c235938c8099d08389b581ec25cac0fc0dc51b4.11%
- 234aa1bf13ba45c48b11b70a6fb23dba11cde584fb89bfceb5aff086258429942.63%
- 078893c42058905373489a8bd2f3d72935d6b0098949335a5ef16876d48a461f2.3%
Process Ancestry
Top Grandparents
- services.exe69.12%
- svchost.exe30.03%
- msiexec.exe0.57%
- explorer.exe0.28%
Top Parents
- svchost.exe89.99%
- msiexec.exe6.67%
- rundll32.exe3.12%
- TrustedInstaller.exe0.16%
- cmd.exe0.03%
- SystemSettings.exe0.03%
Top Children
- conhost.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does sdbinst.exe normally do?
Used to install compatibility fixes for legacy applications. Part of the Windows Application Compatibility Framework.
When is sdbinst.exe suspicious?
Installing custom .sdb files from temp or user directories. Running on systems without known application compatibility needs.
How do attackers abuse sdbinst.exe?
Attackers create custom shim databases (.sdb files) that inject code into target applications or redirect API calls. Shims persist across reboots and can be difficult to detect. Used for both persistence and defense evasion.
Detection guidance
Monitor for sdbinst.exe execution. Track .sdb file creation and installation. Alert on shim database installations from non-standard paths.
False positive notes
Enterprise application compatibility teams may deploy custom shims. SCCM can deploy shim databases for legacy app support.
MITRE ATT&CK techniques
Ask Rocky about sdbinst.exe
Rocky answers questions about sdbinst.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.