[ERROR_SELECT]
This is a list of svchost.exe services I got from a malware clean Vista computer. If any of your svchost.exe services is not in this list you should double check it for malware.
I got this table by running following code on my Windows Vista 32 bit machine.
This code outputs service group extracted from ImagePath registry key, description extracted from service file, service executable extracted from DisplayName and full path to service binary.
| Application Experience Service | ||
|---|---|---|
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeTcbPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\aelupsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AeLookupSvc | |
| IIS Resource DLL | ||
| Svchost Group | apphost | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k apphost | SeChangeNotifyPrivilege SeTcbPrivilege |
| Executable File Name | c:\windows\system32\inetsrv\iisres.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppHostSvc | |
| Application Information Service | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeAssignPrimaryTokenPrivilege SeIncreaseQuotaPrivilege SeTcbPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\appinfo.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Appinfo | |
| Software installation Service | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeCreateGlobalPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege SeShutdownPrivilege SeTakeOwnershipPrivilege |
| Executable File Name | c:\windows\system32\appmgmts.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppMgmt | |
| Windows Audio Service | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted | SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\audiosrv.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AudioEndpointBuilder | |
| Windows Audio Service | ||
| Svchost Group | LocalServiceNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted | SeChangeNotifyPrivilege SeImpersonatePrivilege SeIncreaseWorkingSetPrivilege |
| Executable File Name | c:\windows\system32\audiosrv.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Audiosrv | |
| Base Filtering Engine | ||
| Svchost Group | LocalServiceNoNetwork | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork | SeAuditPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\bfe.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE | |
| Background Intelligent Transfer Service | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k netsvcs | SeCreateGlobalPrivilege SeImpersonatePrivilege SeTcbPrivilege SeAssignPrimaryTokenPrivilege SeIncreaseQuotaPrivilege |
| Executable File Name | c:\windows\system32\qmgr.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS | |
| Computer Browser Service DLL | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k netsvcs | |
| Executable File Name | c:\windows\system32\browser.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser | |
| Bluetooth Support Service | ||
| Svchost Group | bthsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k bthsvcs | |
| Executable File Name | c:\windows\system32\bthserv.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BthServ | |
| Microsoft Smartcard Certificate Propagation Service | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeCreateGlobalPrivilege SeTcbPrivilege SeChangeNotifyPrivilege SeImpersonatePrivilege SeTakeOwnershipPrivilege SeSecurityPrivilege |
| Executable File Name | c:\windows\system32\certprop.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertPropSvc | |
| Cryptographic Services | ||
| Svchost Group | NetworkService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k NetworkService | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\cryptsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc | |
| CSC Service DLL | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted | SeTcbPrivilege SeImpersonatePrivilege SeIncreaseBasePriorityPrivilege |
| Executable File Name | c:\windows\system32\cscsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CscService | |
| Ole resource dll | ||
| Svchost Group | DcomLaunch | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k DcomLaunch | SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeDebugPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege SeTcbPrivilege SeBackupPrivilege SeRestorePrivilege |
| Executable File Name | c:\windows\system32\oleres.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DcomLaunch | |
| DHCP Client Service | ||
| Svchost Group | LocalServiceNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted | SeChangeNotifyPrivilege SeCreateGlobalPrivilege |
| Executable File Name | c:\windows\system32\dhcpcsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp | |
| DNS Client API DLL | ||
| Svchost Group | NetworkService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k NetworkService | SeChangeNotifyPrivilege SeCreateGlobalPrivilege |
| Executable File Name | c:\windows\system32\dnsapi.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache | |
| Wired AutoConfig Service | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted | SeChangeNotifyPrivilege SeImpersonatePrivilege SeAuditPrivilege SeTcbPrivilege |
| Executable File Name | c:\windows\system32\dot3svc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dot3svc | |
| WDI Diagnostic Policy Service | ||
| Svchost Group | LocalServiceNoNetwork | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeAssignPrimaryTokenPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\dps.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DPS | |
| Microsoft EAPHost service | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k netsvcs | SeTcbPrivilege SeDebugPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\eapsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EapHost | |
| Windows Media Center Service Launcher | ||
| Svchost Group | LocalServiceNoNetwork | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork | SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\ehome\ehstart.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ehstart | |
| ReadyBoost Service | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted | SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\emdmgmt.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EMDMgmt | |
| Event Logging Service | ||
| Svchost Group | LocalServiceNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted | SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\wevtsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog | |
| COM+ Resources | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\comres.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventSystem | |
| WS Discovery Service | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\fdphost.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fdPHost | |
| Function Discovery Resource Publication Service | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\fdrespub.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FDResPub | |
| Group Policy Client API | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeImpersonatePrivilege SeTcbPrivilege SeTakeOwnershipPrivilege SeIncreaseQuotaPrivilege SeAssignPrimaryTokenPrivilege SeSecurityPrivilege SeChangeNotifyPrivilege SeCreatePermanentPrivilege SeShutdownPrivilege SeLoadDriverPrivilege SeRestorePrivilege SeBackupPrivilege |
| Executable File Name | c:\windows\system32\gpapi.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gpsvc | |
| HID Service | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\hidserv.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hidserv | |
| Key Management Service | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k netsvcs | SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\kmsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hkmsvc | |
| IKE extension | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeAuditPrivilege SeImpersonatePrivilege SeTcbPrivilege SeDebugPrivilege |
| Executable File Name | c:\windows\system32\ikeext.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IKEEXT | |
| PnP-X IP Bus Enumerator DLL | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege SeLoadDriverPrivilege |
| Executable File Name | c:\windows\system32\ipbusenum.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPBusEnum | |
| Service that offers IPv6 connectivity over an IPv4 network. | ||
| Svchost Group | NetSvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k NetSvcs | SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\iphlpsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iphlpsvc | |
| COM+ Resources | ||
| Svchost Group | NetworkService | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k NetworkService | SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\comres.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KtmRm | |
| Server Service DLL | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | |
| Executable File Name | c:\windows\system32\srvsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer | |
| Workstation Service DLL | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalService | |
| Executable File Name | c:\windows\system32\wkssvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation | |
| Link-Layer Topology Discovery Resources | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalService | SeImpersonatePrivilege SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\lltdres.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lltdsvc | |
| TCPIP NetBios Transport Services DLL | ||
| Svchost Group | LocalServiceNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted | SeCreateGlobalPrivilege |
| Executable File Name | c:\windows\system32\lmhsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lmhosts | |
| Media Center Resources | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\ehome\ehres.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mcx2Svc | |
| Multimedia Class Scheduler Service | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeIncreaseBasePriorityPrivilege |
| Executable File Name | c:\windows\system32\mmcss.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MMCSS | |
| Windows Firewall API | ||
| Svchost Group | LocalServiceNoNetwork | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork | SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege |
| Executable File Name | c:\windows\system32\firewallapi.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc | |
| iSCSI Discovery api | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeCreatePermanentPrivilege SeImpersonatePrivilege SeTcbPrivilege |
| Executable File Name | c:\windows\system32\iscsidsc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSiSCSI | |
| Quarantine Agent Service Run-Time | ||
| Svchost Group | NetworkService | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k NetworkService | SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\qagentrt.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\napagent | |
| Network Connections Manager | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted | SeImpersonatePrivilege SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\netman.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netman | |
| Network Profile Management UI | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalService | SeImpersonatePrivilege SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\netprof.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\netprofm | |
| Network Location Awareness 2 | ||
| Svchost Group | NetworkService | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k NetworkService | SeCreateGlobalPrivilege SeImpersonatePrivilege SeAuditPrivilege |
| Executable File Name | c:\windows\system32\nlasvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc | |
| Network Store Interface RPC server | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\nsisvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nsi | |
| Peer-to-Peer Services | ||
| Svchost Group | LocalServiceNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\p2psvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p2pimsvc | |
| Peer-to-Peer Services | ||
| Svchost Group | LocalServiceNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\p2psvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p2psvc | |
| Program Compatibility Assistant Service | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted | SeDebugPrivilege |
| Executable File Name | c:\windows\system32\pcasvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PcaSvc | |
| Performance Logs & Alerts | ||
| Svchost Group | LocalServiceNoNetwork | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork | SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\pla.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pla | |
| User-mode Plug-and-Play Service | ||
| Svchost Group | DcomLaunch | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k DcomLaunch | SeTcbPrivilege SeSecurityPrivilege SeAssignPrimaryTokenPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeImpersonatePrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeUndockPrivilege SeDebugPrivilege |
| Executable File Name | c:\windows\system32\umpnpmgr.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PlugPlay | |
| Peer-to-Peer Services | ||
| Svchost Group | LocalServiceNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\p2psvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PNRPAutoReg | |
| Peer-to-Peer Services | ||
| Svchost Group | LocalServiceNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\p2psvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PNRPsvc | |
| Policy Storage dll | ||
| Svchost Group | NetworkServiceNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted | SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\polstore.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent | |
| ProfSvc | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\profsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProfSvc | |
| Windows NT | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\qwave.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\QWAVE | |
| ActiveSync RAPI Manager | ||
| Svchost Group | WindowsMobile | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k WindowsMobile | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\windowsmobile\rapimgr.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RapiMgr | |
| Remote Access AutoDial Manager | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeImpersonatePrivilege SeTcbPrivilege SeIncreaseQuotaPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeAssignPrimaryTokenPrivilege |
| Executable File Name | c:\windows\system32\rasauto.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAuto | |
| Remote Access Connection Manager | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeImpersonatePrivilege SeIncreaseQuotaPrivilege SeTcbPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeAssignPrimaryTokenPrivilege |
| Executable File Name | c:\windows\system32\rasmans.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan | |
| Dynamic Interface Manager | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeChangeNotifyPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege SeAuditPrivilege |
| Executable File Name | c:\windows\system32\mprdim.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess | |
| Remote Registry Service | ||
| Svchost Group | regsvc | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k regsvc | SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\regsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry | |
| Ole resource dll | ||
| Svchost Group | rpcss | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k rpcss | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\oleres.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs | |
| Smart Card Resource Management Server | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeCreateGlobalPrivilege SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\scardsvr.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SCardSvr | |
| Task Scheduler Service | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeIncreaseQuotaPrivilege SeChangeNotifyPrivilege SeAuditPrivilege SeImpersonatePrivilege SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeRestorePrivilege |
| Executable File Name | c:\windows\system32\schedsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule | |
| Microsoft Smartcard Certificate Propagation Service | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeCreateGlobalPrivilege SeTcbPrivilege SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\certprop.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SCPolicySvc | |
| MicrosoftВ® Windows Backup Service | ||
| Svchost Group | SDRSVC | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k SDRSVC | |
| Executable File Name | c:\windows\system32\sdrsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SDRSVC | |
| Secondary Logon Service DLL | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeTcbPrivilege SeRestorePrivilege SeBackupPrivilege SeAssignPrimaryTokenPrivilege SeIncreaseQuotaPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\seclogon.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seclogon | |
| System Event Notification Service (SENS) | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege SeTcbPrivilege |
| Executable File Name | c:\windows\system32\sens.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SENS | |
| Terminal Services Configuration service | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k netsvcs | SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\sessenv.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SessionEnv | |
| Microsoft NAT Helper Components | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k netsvcs | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege SeLoadDriverPrivilege SeTakeOwnershipPrivilege |
| Executable File Name | c:\windows\system32\ipnathlp.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess | |
| Windows Shell Services Dll | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k netsvcs | |
| Executable File Name | c:\windows\system32\shsvcs.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ShellHWDetection | |
| Software Licensing UI Notification Service | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\sluinotify.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SLUINotify | |
| SSDP Service DLL | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeChangeNotifyPrivilege SeCreateGlobalPrivilege |
| Executable File Name | c:\windows\system32\ssdpsrv.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SSDPSRV | |
| Provides the facility of using Secure Socket Tunneling Protocol (SSTP) to connect to remote computers (using VPN). | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\sstpsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SstpSvc | |
| Still Image Devices Service | ||
| Svchost Group | imgsvc | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k imgsvc | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\wiaservc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\stisvc | |
| MicrosoftВ® Volume Shadow Copy Service software provider | ||
| Svchost Group | swprv | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k swprv | SeBackupPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeCreatePermanentPrivilege SeImpersonatePrivilege SeManageVolumePrivilege SeRestorePrivilege SeIncreaseBasePriorityPrivilege SeManageVolumePrivilege SeRestorePrivilege SeTcbPrivilege |
| Executable File Name | c:\windows\system32\swprv.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swprv | |
| Superfetch Service Host | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted | SeTcbPrivilege SeProfileSingleProcessPrivilege SeTakeOwnershipPrivilege SeDebugPrivilege |
| Executable File Name | c:\windows\system32\sysmain.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysMain | |
| Microsoft Tablet PC Input Service | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted | SeTcbPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege SeAssignPrimaryTokenPrivilege SeCreateGlobalPrivilege |
| Executable File Name | c:\windows\system32\tabsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TabletInputService | |
| MicrosoftВ® Windows(TM) Telephony Server | ||
| Svchost Group | NetworkService | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k NetworkService | SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege SeAssignPrimaryTokenPrivilege |
| Executable File Name | c:\windows\system32\tapisrv.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TapiSrv | |
| TBS Service | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalService | SeChangeNotifyPrivilege SeAuditPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\tbssvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TBS | |
| Terminal Server Remote Connections Manager | ||
| Svchost Group | NetworkService | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k NetworkService | SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege |
| Executable File Name | c:\windows\system32\termsrv.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService | |
| Windows Shell Services Dll | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k netsvcs | SeAssignPrimaryTokenPrivilege SeDebugPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\shsvcs.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Themes | |
| Multimedia Class Scheduler Service | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\mmcss.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\THREADORDER | |
| Distributed Link Tracking Client | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted | SeRestorePrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\trkwks.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks | |
| Terminal Server Device Redirector Service | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted | SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege SeCreatePermanentPrivilege SeLoadDriverPrivilege SeDebugPrivilege |
| Executable File Name | c:\windows\system32\umrdp.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UmRdpService | |
| UPnP Device Host | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\upnphost.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\upnphost | |
| Desktop Window Manager | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted | SeAssignPrimaryTokenPrivilege SeCreateGlobalPrivilege SeIncreaseQuotaPrivilege SeSecurityPrivilege SeTcbPrivilege |
| Executable File Name | c:\windows\system32\dwm.exe | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UxSms | |
| Windows Time Service | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege SeSystemTimePrivilege |
| Executable File Name | c:\windows\system32\w32time.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time | |
| IIS Resource DLL | ||
| Svchost Group | iissvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k iissvcs | SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeBackupPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeDebugPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege SeRestorePrivilege SeTcbPrivilege |
| Executable File Name | c:\windows\system32\inetsrv\iisres.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W3SVC | |
| IIS Resource DLL | ||
| Svchost Group | iissvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k iissvcs | SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeBackupPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeDebugPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege SeRestorePrivilege SeTcbPrivilege |
| Executable File Name | c:\windows\system32\inetsrv\iisres.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WAS | |
| ActiveSync Connection Manager | ||
| Svchost Group | WindowsMobile | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k WindowsMobile | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\windowsmobile\wcescomm.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WcesComm | |
| Windows Connect Now – Config Registrar Service | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalService | SeImpersonatePrivilege SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\wcncsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wcncsvc | |
| WcsPlugInService DLL | ||
| Svchost Group | wcssvc | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k wcssvc | SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\wcspluginservice.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WcsPlugInService | |
| Windows Diagnostic Infrastructure | ||
| Svchost Group | wdisvc | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k wdisvc | SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\wdi.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdiServiceHost | |
| Windows Diagnostic Infrastructure | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted | SeChangeNotifyPrivilege SeImpersonatePrivilege SeTcbPrivilege SeDebugPrivilege SeAssignPrimaryTokenPrivilege SeIncreaseQuotaPrivilege SeProfileSingleProcessPrivilege |
| Executable File Name | c:\windows\system32\wdi.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdiSystemHost | |
| Web DAV Service DLL | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeImpersonatePrivilege SeCreateGlobalPrivilege |
| Executable File Name | c:\windows\system32\webclnt.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient | |
| Event Collector Service | ||
| Svchost Group | NetworkService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k NetworkService | SeAuditPrivilege SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\wecsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wecsvc | |
| Problem Reports and Solutions | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k netsvcs | SeImpersonatePrivilege SeTcbPrivilege |
| Executable File Name | c:\windows\system32\wercplsupport.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wercplsupport | |
| Windows Error Reporting Service | ||
| Svchost Group | WerSvcGroup | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k WerSvcGroup | SeDebugPrivilege SeTcbPrivilege SeImpersonatePrivilege SeAssignPrimaryTokenPrivilege |
| Executable File Name | c:\windows\system32\wersvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WerSvc | |
| Resource Module | ||
| Svchost Group | secsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k secsvcs | SeImpersonatePrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeChangeNotifyPrivilege SeSecurityPrivilege |
| Executable File Name | c:\program files\windows defender\msmpres.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend | |
| Windows HTTP Services | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\winhttp.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc | |
| WMI | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | |
| Executable File Name | c:\windows\system32\wbem\wmisvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winmgmt | |
| WSMan Service | ||
| Svchost Group | NetworkService | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k NetworkService | SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\wsmsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinRM | |
| Windows WLAN AutoConfig Service DLL | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted | SeChangeNotifyPrivilege SeImpersonatePrivilege SeAuditPrivilege SeTcbPrivilege SeDebugPrivilege |
| Executable File Name | c:\windows\system32\wlansvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wlansvc | |
| WPC Filtering Service | ||
| Svchost Group | LocalServiceNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted | SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\wpcsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WPCSvc | |
| Portable Device Enumerator | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted | SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeCreatePermanentPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\wpdbusenum.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WPDBusEnum | |
| Windows Security Center Service | ||
| Svchost Group | LocalServiceNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted | SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\wscsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc | |
| Windows Update Agent | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeAuditPrivilege SeCreateGlobalPrivilege SeCreatePageFilePrivilege SeTcbPrivilege SeAssignPrimaryTokenPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege SeShutdownPrivilege |
| Executable File Name | c:\windows\system32\wuaueng.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv | |
| Windows Driver Foundation – User-mode Driver Framework Service | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted | SeChangeNotifyPrivilege SeAssignPrimaryTokenPrivilege SeIncreaseQuotaPrivilege |
| Executable File Name | c:\windows\system32\wudfsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wudfsvc | |