[ERROR_SELECT]
This is a list of svchost.exe services I got from a malware clean Windows 7 computer. If any of your svchost.exe services is not in this list you should double check it for malware.
I got this table by running following code on my Windows Vista 7 64 bit machine.
This code outputs service group extracted from ImagePath registry key, description extracted from service file, service executable extracted from DisplayName and full path to service binary.
| Application Experience Service | ||
|---|---|---|
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeTcbPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\aelupsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AeLookupSvc | |
| Application Identity Service | ||
| Svchost Group | LocalServiceAndNoImpersonation | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation | SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\appidsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppIDSvc | |
| Application Information Service | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeAssignPrimaryTokenPrivilege SeIncreaseQuotaPrivilege SeTcbPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\appinfo.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Appinfo | |
| Software installation Service | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeCreateGlobalPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege SeShutdownPrivilege SeTakeOwnershipPrivilege |
| Executable File Name | c:\windows\system32\appmgmts.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppMgmt | |
| Windows Audio Service | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted | SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\audiosrv.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AudioEndpointBuilder | |
| Windows Audio Service | ||
| Svchost Group | LocalServiceNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted | SeChangeNotifyPrivilege SeImpersonatePrivilege SeIncreaseWorkingSetPrivilege |
| Executable File Name | c:\windows\system32\audiosrv.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AudioSrv | |
| ActiveX Installer Service | ||
| Svchost Group | AxInstSVGroup | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k AxInstSVGroup | SeAssignPrimaryTokenPrivilege SeIncreaseQuotaPrivilege SeTcbPrivilege SeBackupPrivilege SeRestorePrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\axinstsv.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AxInstSV | |
| BDE Service | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k netsvcs | SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\bdesvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BDESVC | |
| Base Filtering Engine | ||
| Svchost Group | LocalServiceNoNetwork | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork | SeAuditPrivilege |
| Executable File Name | c:\windows\system32\bfe.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE | |
| Background Intelligent Transfer Service | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k netsvcs | SeCreateGlobalPrivilege SeImpersonatePrivilege SeTcbPrivilege SeAssignPrimaryTokenPrivilege SeIncreaseQuotaPrivilege |
| Executable File Name | c:\windows\system32\qmgr.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS | |
| Computer Browser Service DLL | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k netsvcs | |
| Executable File Name | c:\windows\system32\browser.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser | |
| Bluetooth Support Service | ||
| Svchost Group | bthsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k bthsvcs | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\bthserv.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bthserv | |
| Microsoft Smartcard Certificate Propagation Service | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeCreateGlobalPrivilege SeTcbPrivilege SeChangeNotifyPrivilege SeImpersonatePrivilege SeTakeOwnershipPrivilege SeSecurityPrivilege |
| Executable File Name | c:\windows\system32\certprop.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertPropSvc | |
| Cryptographic Services | ||
| Svchost Group | NetworkService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k NetworkService | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\cryptsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc | |
| CSC Service DLL | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted | SeTcbPrivilege SeImpersonatePrivilege SeIncreaseBasePriorityPrivilege |
| Executable File Name | c:\windows\system32\cscsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CscService | |
| Ole resource dll | ||
| Svchost Group | DcomLaunch | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k DcomLaunch | SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeDebugPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege SeTcbPrivilege SeBackupPrivilege SeRestorePrivilege |
| Executable File Name | c:\windows\system32\oleres.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DcomLaunch | |
| Microsoft\Disk Defragmenter | ||
| Svchost Group | defragsvc | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k defragsvc | SeChangeNotifyPrivilege SeImpersonatePrivilege SeIncreaseWorkingSetPrivilege SeTcbPrivilege SeSystemProfilePrivilege SeAuditPrivilege SeCreateGlobalPrivilege SeBackupPrivilege SeManageVolumePrivilege |
| Executable File Name | c:\windows\system32\defragsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\defragsvc | |
| DHCP Client Service | ||
| Svchost Group | LocalServiceNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted | SeChangeNotifyPrivilege SeCreateGlobalPrivilege |
| Executable File Name | c:\windows\system32\dhcpcore.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp | |
| DNS Client API DLL | ||
| Svchost Group | NetworkService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k NetworkService | SeChangeNotifyPrivilege SeCreateGlobalPrivilege |
| Executable File Name | c:\windows\system32\dnsapi.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache | |
| Wired AutoConfig Service | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted | SeChangeNotifyPrivilege SeImpersonatePrivilege SeAuditPrivilege SeTcbPrivilege |
| Executable File Name | c:\windows\system32\dot3svc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dot3svc | |
| WDI Diagnostic Policy Service | ||
| Svchost Group | LocalServiceNoNetwork | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeAssignPrimaryTokenPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\dps.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DPS | |
| Microsoft EAPHost service | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k netsvcs | SeTcbPrivilege SeDebugPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\eapsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EapHost | |
| Event Logging Service | ||
| Svchost Group | LocalServiceNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted | SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\wevtsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog | |
| COM+ Resources | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\comres.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventSystem | |
| Function Discovery Provider host service | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\fdphost.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fdPHost | |
| Function Discovery Resource Publication Service | ||
| Svchost Group | LocalServiceAndNoImpersonation | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation | SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\fdrespub.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FDResPub | |
| Windows Font Cache Service | ||
| Svchost Group | LocalServiceAndNoImpersonation | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation | SeChangeNotifyPrivilege SeAuditPrivilege |
| Executable File Name | c:\windows\system32\fntcache.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FontCache | |
| Group Policy Client API | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeImpersonatePrivilege SeTcbPrivilege SeTakeOwnershipPrivilege SeIncreaseQuotaPrivilege SeAssignPrimaryTokenPrivilege SeSecurityPrivilege SeChangeNotifyPrivilege SeCreatePermanentPrivilege SeShutdownPrivilege SeLoadDriverPrivilege SeRestorePrivilege SeBackupPrivilege |
| Executable File Name | c:\windows\system32\gpapi.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gpsvc | |
| HID Service | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\hidserv.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hidserv | |
| Key Management Service | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k netsvcs | SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\kmsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hkmsvc | |
| Windows HomeGroup | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted | SeChangeNotifyPrivilege SeImpersonatePrivilege SeTcbPrivilege |
| Executable File Name | c:\windows\system32\listsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HomeGroupListener | |
| Windows HomeGroup | ||
| Svchost Group | LocalServiceNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted | SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\provsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HomeGroupProvider | |
| IKE extension | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeAuditPrivilege SeImpersonatePrivilege SeTcbPrivilege SeDebugPrivilege |
| Executable File Name | c:\windows\system32\ikeext.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IKEEXT | |
| PnP-X IP Bus Enumerator DLL | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege SeLoadDriverPrivilege |
| Executable File Name | c:\windows\system32\ipbusenum.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPBusEnum | |
| Service that offers IPv6 connectivity over an IPv4 network. | ||
| Svchost Group | NetSvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k NetSvcs | SeCreateGlobalPrivilege SeImpersonatePrivilege SeLoadDriverPrivilege |
| Executable File Name | c:\windows\system32\iphlpsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iphlpsvc | |
| COM+ Resources | ||
| Svchost Group | NetworkServiceAndNoImpersonation | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k NetworkServiceAndNoImpersonation | SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\comres.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KtmRm | |
| Server Service DLL | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeChangeNotifyPrivilege SeImpersonatePrivilege SeAuditPrivilege SeLoadDriverPrivilege |
| Executable File Name | c:\windows\system32\srvsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer | |
| Workstation Service DLL | ||
| Svchost Group | NetworkService | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k NetworkService | SeChangeNotifyPrivilege SeImpersonatePrivilege SeAuditPrivilege |
| Executable File Name | c:\windows\system32\wkssvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation | |
| Link-Layer Topology Discovery Resources | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalService | SeImpersonatePrivilege SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\lltdres.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lltdsvc | |
| TCPIP NetBios Transport Services DLL | ||
| Svchost Group | LocalServiceNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted | SeCreateGlobalPrivilege |
| Executable File Name | c:\windows\system32\lmhsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lmhosts | |
| Media Center Resources | ||
| Svchost Group | LocalServiceAndNoImpersonation | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation | SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\ehome\ehres.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mcx2Svc | |
| Multimedia Class Scheduler Service | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeIncreaseBasePriorityPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\mmcss.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MMCSS | |
| Windows Firewall API | ||
| Svchost Group | LocalServiceNoNetwork | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork | SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege |
| Executable File Name | c:\windows\system32\firewallapi.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc | |
| iSCSI Discovery api | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeCreatePermanentPrivilege SeImpersonatePrivilege SeTcbPrivilege |
| Executable File Name | c:\windows\system32\iscsidsc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSiSCSI | |
| Quarantine Agent Service Run-Time | ||
| Svchost Group | NetworkService | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k NetworkService | SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\qagentrt.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\napagent | |
| Network Connections Manager | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted | SeImpersonatePrivilege SeChangeNotifyPrivilege SeLoadDriverPrivilege |
| Executable File Name | c:\windows\system32\netman.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netman | |
| Network List Manager | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalService | SeImpersonatePrivilege SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\netprofm.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\netprofm | |
| Network Location Awareness 2 | ||
| Svchost Group | NetworkService | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k NetworkService | SeCreateGlobalPrivilege SeImpersonatePrivilege SeAuditPrivilege |
| Executable File Name | c:\windows\system32\nlasvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc | |
| Network Store Interface RPC server | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\nsisvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nsi | |
| PNRP Service Dll | ||
| Svchost Group | LocalServicePeerNet | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalServicePeerNet | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\pnrpsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p2pimsvc | |
| Peer-to-Peer Services | ||
| Svchost Group | LocalServicePeerNet | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalServicePeerNet | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\p2psvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\p2psvc | |
| Program Compatibility Assistant Service | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted | SeDebugPrivilege |
| Executable File Name | c:\windows\system32\pcasvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PcaSvc | |
| BranchCache Service | ||
| Svchost Group | PeerDist | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k PeerDist | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege SeAuditPrivilege |
| Executable File Name | c:\windows\system32\peerdistsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PeerDistSvc | |
| Performance Logs & Alerts | ||
| Svchost Group | LocalServiceNoNetwork | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork | SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\pla.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pla | |
| User-mode Plug-and-Play Service | ||
| Svchost Group | DcomLaunch | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k DcomLaunch | SeTcbPrivilege SeSecurityPrivilege SeAssignPrimaryTokenPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeImpersonatePrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeUndockPrivilege SeDebugPrivilege SeShutdownPrivilege |
| Executable File Name | c:\windows\system32\umpnpmgr.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PlugPlay | |
| PNRP Auto Service Dll | ||
| Svchost Group | LocalServicePeerNet | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalServicePeerNet | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\pnrpauto.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PNRPAutoReg | |
| PNRP Service Dll | ||
| Svchost Group | LocalServicePeerNet | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalServicePeerNet | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\pnrpsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PNRPsvc | |
| Policy Storage dll | ||
| Svchost Group | NetworkServiceNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted | SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\polstore.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent | |
| User-mode Power Service | ||
| Svchost Group | DcomLaunch | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k DcomLaunch | SeTcbPrivilege SeSecurityPrivilege SeAssignPrimaryTokenPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeImpersonatePrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeUndockPrivilege SeDebugPrivilege |
| Executable File Name | c:\windows\system32\umpo.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Power | |
| ProfSvc | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\profsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProfSvc | |
| Windows NT | ||
| Svchost Group | LocalServiceAndNoImpersonation | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation | SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\qwave.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\QWAVE | |
| Remote Access AutoDial Manager | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k netsvcs | SeImpersonatePrivilege SeTcbPrivilege SeIncreaseQuotaPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeAssignPrimaryTokenPrivilege |
| Executable File Name | c:\windows\system32\rasauto.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAuto | |
| Remote Access Connection Manager | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k netsvcs | SeImpersonatePrivilege SeIncreaseQuotaPrivilege SeTcbPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeAssignPrimaryTokenPrivilege |
| Executable File Name | c:\windows\system32\rasmans.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan | |
| Dynamic Interface Manager | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k netsvcs | SeChangeNotifyPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege SeAuditPrivilege |
| Executable File Name | c:\windows\system32\mprdim.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess | |
| Remote Registry Service | ||
| Svchost Group | regsvc | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k regsvc | SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\regsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry | |
| RPC Endpoint Mapper | ||
| Svchost Group | RPCSS | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k RPCSS | SeChangeNotifyPrivilege SeImpersonatePrivilege SeCreateGlobalPrivilege |
| Executable File Name | c:\windows\system32\rpcepmap.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcEptMapper | |
| Ole resource dll | ||
| Svchost Group | rpcss | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k rpcss | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\oleres.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs | |
| Smart Card Resource Management Server | ||
| Svchost Group | LocalServiceAndNoImpersonation | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation | SeCreateGlobalPrivilege SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\scardsvr.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SCardSvr | |
| Task Scheduler Service | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeIncreaseQuotaPrivilege SeChangeNotifyPrivilege SeAuditPrivilege SeImpersonatePrivilege SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeRestorePrivilege |
| Executable File Name | c:\windows\system32\schedsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule | |
| Microsoft Smartcard Certificate Propagation Service | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeCreateGlobalPrivilege SeTcbPrivilege SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\certprop.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SCPolicySvc | |
| MicrosoftAr Windows Backup Service | ||
| Svchost Group | SDRSVC | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k SDRSVC | SeBackupPrivilege SeRestorePrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeCreateSymbolicLinkPrivilege SeAssignPrimaryTokenPrivilege SeIncreaseQuotaPrivilege SeTcbPrivilege SeSystemEnvironmentPrivilege |
| Executable File Name | c:\windows\system32\sdrsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SDRSVC | |
| Secondary Logon Service DLL | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeTcbPrivilege SeRestorePrivilege SeBackupPrivilege SeAssignPrimaryTokenPrivilege SeIncreaseQuotaPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\seclogon.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seclogon | |
| System Event Notification Service (SENS) | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege SeTcbPrivilege |
| Executable File Name | c:\windows\system32\sens.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SENS | |
| Microsoft Windows ambient light service | ||
| Svchost Group | LocalServiceAndNoImpersonation | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation | SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\sensrsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SensrSvc | |
| Remote Desktop Configuration service | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k netsvcs | SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\sessenv.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SessionEnv | |
| Microsoft NAT Helper Components | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k netsvcs | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege SeLoadDriverPrivilege SeTakeOwnershipPrivilege |
| Executable File Name | c:\windows\system32\ipnathlp.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess | |
| Windows Shell Services Dll | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k netsvcs | SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\shsvcs.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ShellHWDetection | |
| SPP Notification Service | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\sppuinotify.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sppuinotify | |
| SSDP Service DLL | ||
| Svchost Group | LocalServiceAndNoImpersonation | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation | SeChangeNotifyPrivilege SeCreateGlobalPrivilege |
| Executable File Name | c:\windows\system32\ssdpsrv.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SSDPSRV | |
| Provides the facility of using Secure Socket Tunneling Protocol (SSTP) to connect to remote computers (using VPN). | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\sstpsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SstpSvc | |
| Still Image Devices Service | ||
| Svchost Group | imgsvc | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k imgsvc | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\wiaservc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\stisvc | |
| MicrosoftAr Volume Shadow Copy Service software provider | ||
| Svchost Group | swprv | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k swprv | SeBackupPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeCreatePermanentPrivilege SeImpersonatePrivilege SeManageVolumePrivilege SeRestorePrivilege SeIncreaseBasePriorityPrivilege SeManageVolumePrivilege SeRestorePrivilege SeTcbPrivilege |
| Executable File Name | c:\windows\system32\swprv.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swprv | |
| Superfetch Service Host | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted | SeTcbPrivilege SeProfileSingleProcessPrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeIncreaseBasePriorityPrivilege |
| Executable File Name | c:\windows\system32\sysmain.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysMain | |
| Microsoft Tablet PC Input Service | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted | SeTcbPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege SeAssignPrimaryTokenPrivilege SeCreateGlobalPrivilege |
| Executable File Name | c:\windows\system32\tabsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TabletInputService | |
| MicrosoftAr Windows(TM) Telephony Server | ||
| Svchost Group | NetworkService | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k NetworkService | SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege SeAssignPrimaryTokenPrivilege |
| Executable File Name | c:\windows\system32\tapisrv.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TapiSrv | |
| TBS Service | ||
| Svchost Group | LocalServiceAndNoImpersonation | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation | SeChangeNotifyPrivilege SeAuditPrivilege |
| Executable File Name | c:\windows\system32\tbssvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TBS | |
| Remote Desktop Session Host Server Remote Connections Manager | ||
| Svchost Group | NetworkService | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k NetworkService | SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege |
| Executable File Name | c:\windows\system32\termsrv.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService | |
| Windows Shell Theme Service Dll | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k netsvcs | SeAssignPrimaryTokenPrivilege SeDebugPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\themeservice.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Themes | |
| Multimedia Class Scheduler Service | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\mmcss.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\THREADORDER | |
| Distributed Link Tracking Client | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted | SeRestorePrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\trkwks.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks | |
| Remote Desktop Services Device Redirector Service | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted | SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege SeCreatePermanentPrivilege SeLoadDriverPrivilege SeDebugPrivilege |
| Executable File Name | c:\windows\system32\umrdp.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UmRdpService | |
| UPnP Device Host | ||
| Svchost Group | LocalServiceAndNoImpersonation | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation | SeChangeNotifyPrivilege SeCreateGlobalPrivilege |
| Executable File Name | c:\windows\system32\upnphost.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\upnphost | |
| Desktop Window Manager | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted | SeAssignPrimaryTokenPrivilege SeCreateGlobalPrivilege SeIncreaseQuotaPrivilege SeSecurityPrivilege SeTcbPrivilege |
| Executable File Name | c:\windows\system32\dwm.exe | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UxSms | |
| Windows Time Service | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeSystemTimePrivilege |
| Executable File Name | c:\windows\system32\w32time.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time | |
| Windows Biometric Service | ||
| Svchost Group | WbioSvcGroup | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k WbioSvcGroup | SeAssignPrimaryTokenPrivilege SeIncreaseQuotaPrivilege SeTcbPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\wbiosrvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WbioSrvc | |
| Windows Connect Now – Config Registrar Service | ||
| Svchost Group | LocalServiceAndNoImpersonation | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalServiceAndNoImpersonation | SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\wcncsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wcncsvc | |
| WcsPlugInService DLL | ||
| Svchost Group | wcssvc | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k wcssvc | SeChangeNotifyPrivilege |
| Executable File Name | c:\windows\system32\wcspluginservice.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WcsPlugInService | |
| Windows Diagnostic Infrastructure | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalService | SeChangeNotifyPrivilege SeImpersonatePrivilege SeSystemProfilePrivilege |
| Executable File Name | c:\windows\system32\wdi.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdiServiceHost | |
| Windows Diagnostic Infrastructure | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted | SeChangeNotifyPrivilege SeImpersonatePrivilege SeTcbPrivilege SeDebugPrivilege SeAssignPrimaryTokenPrivilege SeIncreaseQuotaPrivilege SeProfileSingleProcessPrivilege SeSystemEnvironmentPrivilege |
| Executable File Name | c:\windows\system32\wdi.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdiSystemHost | |
| Web DAV Service DLL | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeImpersonatePrivilege SeCreateGlobalPrivilege |
| Executable File Name | c:\windows\system32\webclnt.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WebClient | |
| Event Collector Service | ||
| Svchost Group | NetworkService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k NetworkService | SeAuditPrivilege SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\wecsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wecsvc | |
| Problem Reports and Solutions | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k netsvcs | SeImpersonatePrivilege SeTcbPrivilege |
| Executable File Name | c:\windows\system32\wercplsupport.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wercplsupport | |
| Windows Error Reporting Service | ||
| Svchost Group | WerSvcGroup | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k WerSvcGroup | SeDebugPrivilege SeTcbPrivilege SeImpersonatePrivilege SeAssignPrimaryTokenPrivilege |
| Executable File Name | c:\windows\system32\wersvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WerSvc | |
| Windows Defender Resource Module | ||
| Svchost Group | secsvcs | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k secsvcs | SeImpersonatePrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeChangeNotifyPrivilege SeSecurityPrivilege SeShutdownPrivilege SeIncreaseQuotaPrivilege SeAssignPrimaryTokenPrivilege |
| Executable File Name | c:\program files\windows defender\msmpres.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend | |
| Windows HTTP Services | ||
| Svchost Group | LocalService | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalService | SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\winhttp.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc | |
| WMI | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | |
| Executable File Name | c:\windows\system32\wbem\wmisvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winmgmt | |
| WSMan Service | ||
| Svchost Group | NetworkService | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k NetworkService | SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\wsmsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinRM | |
| Windows WLAN AutoConfig Service DLL | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted | SeChangeNotifyPrivilege SeImpersonatePrivilege SeAuditPrivilege SeTcbPrivilege SeDebugPrivilege |
| Executable File Name | c:\windows\system32\wlansvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wlansvc | |
| WPC Filtering Service | ||
| Svchost Group | LocalServiceNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted | SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\wpcsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WPCSvc | |
| Portable Device Enumerator | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted | SeAuditPrivilege SeChangeNotifyPrivilege SeCreateGlobalPrivilege SeCreatePermanentPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\wpdbusenum.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WPDBusEnum | |
| Windows Security Center Service | ||
| Svchost Group | LocalServiceNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted | SeChangeNotifyPrivilege SeImpersonatePrivilege |
| Executable File Name | c:\windows\system32\wscsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc | |
| Windows Update Agent | ||
| Svchost Group | netsvcs | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k netsvcs | SeAuditPrivilege SeCreateGlobalPrivilege SeCreatePageFilePrivilege SeTcbPrivilege SeAssignPrimaryTokenPrivilege SeImpersonatePrivilege SeIncreaseQuotaPrivilege SeShutdownPrivilege |
| Executable File Name | c:\windows\system32\wuaueng.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv | |
| Windows Driver Foundation – User-mode Driver Framework Service | ||
| Svchost Group | LocalSystemNetworkRestricted | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted | SeChangeNotifyPrivilege SeAssignPrimaryTokenPrivilege SeIncreaseQuotaPrivilege SeTcbPrivilege |
| Executable File Name | c:\windows\system32\wudfsvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wudfsvc | |
| WWAN Auto Config Service | ||
| Svchost Group | LocalServiceNoNetwork | Privileges |
| Svchost Command | C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork | SeChangeNotifyPrivilege SeImpersonatePrivilege SeAuditPrivilege |
| Executable File Name | c:\windows\system32\wwansvc.dll | |
| Registry Key | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WwanSvc | |