API tools faq
paste
Advertisement
Guest User

N4IRU28QQJ4C2YVMP

a guest
Mar 18th, 2019
428
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 66.31 KB | None | 0 0
raw download clone embed print report
  1.  
  2. Sysinternals Autoruns v13.94 - Autostart program viewer
  3. Copyright (C) 2002-2019 Mark Russinovich
  4. Sysinternals - www.sysinternals.com
  5.  
  6. Time,Entry Location,Entry,Enabled,Category,Profile,Description,Signer,Company,Image Path,Version,Launch String
  7. 3/18/2019 7:57 PM,HKLM\System\CurrentControlSet\Control\Session Manager\BootExecute,,,"Boot Execute",System-wide,,,,,,
  8. 12/16/2017 5:07 AM,"HKLM\System\CurrentControlSet\Control\Session Manager\BootExecute","autocheck autochk *",enabled,"Boot Execute",System-wide,"Auto Check Utility","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\autochk.exe",10.0.17134.137,"autocheck autochk *"
  9. 3/18/2019 5:20 PM,C:\Users\rezka\AppData\Local\Microsoft\Windows Sidebar\Settings.ini,,,"Sidebar Gadgets",System-wide,,,,,,
  10. 4/23/2018 4:05 AM,"C:\Users\rezka\AppData\Local\Microsoft\Windows Sidebar\Settings.ini","??7 Sidebar?",enabled,"Sidebar Gadgets",System-wide,"?7 Sidebar orders your gadgets nicely on the side and helps you to keep the gadgets always visible.","(Not verified) Helmut Buhler","Helmut Buhler","C:\Users\rezka\AppData\Local\Microsoft\Windows Sidebar\Gadgets\Sidebar7.gadget\Gadget.xml",,"C:\Users\rezka\AppData\Local\Microsoft\Windows Sidebar\Gadgets\Sidebar7.gadget"
  11. 4/12/2011 3:17 PM,"C:\Users\rezka\AppData\Local\Microsoft\Windows Sidebar\Settings.ini","Clock",enabled,"Sidebar Gadgets",System-wide,"Watch the clock in your own time zone or any city in the world.","(Not verified) Microsoft Corporation","Microsoft Corporation","C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\Gadget.xml",,"C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget"
  12. 4/17/2018 12:58 AM,"C:\Users\rezka\AppData\Local\Microsoft\Windows Sidebar\Settings.ini","Clipboarder",enabled,"Sidebar Gadgets",System-wide,"A clipboard manager which allows you to switch to the previous clipboard with a shortcut key. You will be surprised how you could have lived without this before!","(Not verified) Helmut Buhler","Helmut Buhler","C:\Users\rezka\AppData\Local\Microsoft\Windows Sidebar\Gadgets\Clipboarder.gadget\Gadget.xml",,"C:\Users\rezka\AppData\Local\Microsoft\Windows Sidebar\Gadgets\Clipboarder.gadget"
  13. 3/31/2018 9:04 PM,"C:\Users\rezka\AppData\Local\Microsoft\Windows Sidebar\Settings.ini","My Weather",enabled,"Sidebar Gadgets",System-wide,"Displays the current weather from a city of your choice.","(Not verified) Pat Possible","Pat Possible","C:\Users\rezka\AppData\Local\Microsoft\Windows Sidebar\Gadgets\MyWeather.gadget\Gadget.xml",,"C:\Users\rezka\AppData\Local\Microsoft\Windows Sidebar\Gadgets\MyWeather.gadget"
  14. 3/16/2019 12:07 AM,HKLM\Software\Microsoft\Office\Excel\Addins,,,"Office Addins",System-wide,,,,,,
  15. 2/22/2019 3:18 AM,"HKLM\Software\Microsoft\Office\Excel\Addins","Connect Class",enabled,"Office Addins",System-wide,"TFSOfficeAdd-in.dll","(Verified) Microsoft Corporation","Microsoft Corporation","c:\program files\common files\microsoft shared\team foundation server\15.0\x64\tfsofficeadd-in.dll",15.129.28621.1,"HKCR\CLSID\{5DC1CC51-2694-47CD-B7B7-21363388FFFC}"
  16. 3/16/2019 12:07 AM,HKLM\Software\Wow6432Node\Microsoft\Office\Excel\Addins,,,"Office Addins",System-wide,,,,,,
  17. 2/22/2019 3:18 AM,"HKLM\Software\Wow6432Node\Microsoft\Office\Excel\Addins","Connect Class",enabled,"Office Addins",System-wide,"TFSOfficeAdd-in.dll","(Verified) Microsoft Corporation","Microsoft Corporation","c:\program files\common files\microsoft shared\team foundation server\15.0\x86\tfsofficeadd-in.dll",15.129.28621.1,"HKCR\CLSID\{5DC1CC51-2694-47CD-B7B7-21363388FFFC}"
  18. 3/16/2019 12:07 AM,HKLM\Software\Microsoft\Office\PowerPoint\Addins,,,"Office Addins",System-wide,,,,,,
  19. 2/22/2019 3:18 AM,"HKLM\Software\Microsoft\Office\PowerPoint\Addins","Connect Class",enabled,"Office Addins",System-wide,"TFSOfficeAdd-in.dll","(Verified) Microsoft Corporation","Microsoft Corporation","c:\program files\common files\microsoft shared\team foundation server\15.0\x64\tfsofficeadd-in.dll",15.129.28621.1,"HKCR\CLSID\{5DC1CC51-2694-47CD-B7B7-21363388FFFC}"
  20. 3/16/2019 12:07 AM,HKLM\Software\Wow6432Node\Microsoft\Office\PowerPoint\Addins,,,"Office Addins",System-wide,,,,,,
  21. 2/22/2019 3:18 AM,"HKLM\Software\Wow6432Node\Microsoft\Office\PowerPoint\Addins","Connect Class",enabled,"Office Addins",System-wide,"TFSOfficeAdd-in.dll","(Verified) Microsoft Corporation","Microsoft Corporation","c:\program files\common files\microsoft shared\team foundation server\15.0\x86\tfsofficeadd-in.dll",15.129.28621.1,"HKCR\CLSID\{5DC1CC51-2694-47CD-B7B7-21363388FFFC}"
  22. 3/16/2019 10:40 AM,HKLM\SOFTWARE\Classes\Htmlfile\Shell\Open\Command\(Default),,,"Hijacks",System-wide,,,,,,
  23. 11/23/1940 1:25 AM,"HKLM\SOFTWARE\Classes\Htmlfile\Shell\Open\Command\(Default)","C:\Program Files\Internet Explorer\iexplore.exe",enabled,"Hijacks",System-wide,"Internet Explorer","(Verified) Microsoft Corporation","Microsoft Corporation","c:\program files\internet explorer\iexplore.exe",11.0.17134.1,""
  24. 3/18/2019 11:51 PM,HKLM\System\CurrentControlSet\Services,,,"Services",System-wide,,,,,,
  25. 7/26/2028 9:23 AM,"HKLM\System\CurrentControlSet\Services","AJRouter",enabled,"Services",System-wide,"AllJoyn Router Service: Routes AllJoyn messages for the local AllJoyn clients. If this service is stopped the AllJoyn clients that do not have their own bundled routers will be unable to run.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\ajrouter.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted -p"
  26. 1/30/1911 10:10 AM,"HKLM\System\CurrentControlSet\Services","ALG",enabled,"Services",System-wide,"Application Layer Gateway Service: Provides support for 3rd party protocol plug-ins for Internet Connection Sharing","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\alg.exe",10.0.17134.1,"%SystemRoot%\System32\alg.exe"
  27. 2/10/1963 12:33 AM,"HKLM\System\CurrentControlSet\Services","AppIDSvc",enabled,"Services",System-wide,"Application Identity: Determines and verifies the identity of an application. Disabling this service will prevent AppLocker from being enforced.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\appidsvc.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted -p"
  28. 6/1/1908 6:42 PM,"HKLM\System\CurrentControlSet\Services","Appinfo",enabled,"Services",System-wide,"Application Information: Facilitates the running of interactive applications with additional administrative privileges. If this service is stopped, users will be unable to launch applications with the additional administrative privileges they may require to perform desired user tasks.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\appinfo.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k netsvcs -p"
  29. 10/1/1962 12:59 PM,"HKLM\System\CurrentControlSet\Services","AppMgmt",enabled,"Services",System-wide,"Application Management: Processes installation, removal, and enumeration requests for software deployed through Group Policy. If the service is disabled, users will be unable to install, remove, or enumerate software deployed through Group Policy. If this service is disabled, any services that explicitly depend on it will fail to start.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\appmgmts.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k netsvcs -p"
  30. 9/21/1942 2:22 AM,"HKLM\System\CurrentControlSet\Services","AppReadiness",enabled,"Services",System-wide,"App Readiness: Gets apps ready for use the first time a user signs in to this PC and when adding new apps.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\appreadiness.dll",10.0.17134.112,"%SystemRoot%\System32\svchost.exe -k AppReadiness -p"
  31. 2/4/1989 2:52 AM,"HKLM\System\CurrentControlSet\Services","AppXSvc",enabled,"Services",System-wide,"AppX Deployment Service (AppXSVC): Provides infrastructure support for deploying Store applications. This service is started on demand and if disabled Store applications will not be deployed to the system, and may not function properly.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\appxdeploymentserver.dll",10.0.17134.228,"%systemroot%\system32\svchost.exe -k wsappx -p"
  32. 3/26/2014 2:21 PM,"HKLM\System\CurrentControlSet\Services","ASLDRService",enabled,"Services",System-wide,"ASLDR Service: ASLDR Service","(Verified) ASUSTeK Computer Inc.","ASUSTek Computer Inc.","c:\program files (x86)\asus\atk package\atk hotkey\asldrsrv.exe",1.0.81.2,"C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe"
  33. 6/30/2015 9:54 AM,"HKLM\System\CurrentControlSet\Services","AtherosSvc",enabled,"Services",System-wide,"AtherosSvc: Atheros BT Stack Service Agent","(Not verified) Windows (R) Win 7 DDK provider","Windows (R) Win 7 DDK provider","c:\program files (x86)\bluetooth suite\adminservice.exe",6.2.9200.16384,"""C:\Program Files (x86)\Bluetooth Suite\adminservice.exe"""
  34. 11/21/2011 1:19 PM,"HKLM\System\CurrentControlSet\Services","ATKGFNEXSrv",enabled,"Services",System-wide,"ATKGFNEX Service: GFNEXSrv","(Verified) ASUSTeK Computer Inc.","ASUS","c:\program files (x86)\asus\atk package\atkgfnex\gfnexsrv.exe",1.0.11.1,"C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe"
  35. 1/17/1982 2:32 AM,"HKLM\System\CurrentControlSet\Services","AudioEndpointBuilder",enabled,"Services",System-wide,"Windows Audio Endpoint Builder: Manages audio devices for the Windows Audio service. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\audioendpointbuilder.dll",10.0.17134.137,"%SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted -p"
  36. 1/2/1978 8:05 PM,"HKLM\System\CurrentControlSet\Services","Audiosrv",enabled,"Services",System-wide,"Windows Audio: Manages audio for Windows-based programs. If this service is stopped, audio devices and effects will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\audiosrv.dll",10.0.17134.137,"%SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted -p"
  37. 9/19/2006 9:08 AM,"HKLM\System\CurrentControlSet\Services","AxInstSV",enabled,"Services",System-wide,"ActiveX Installer (AxInstSV): Provides User Account Control validation for the installation of ActiveX controls from the Internet and enables management of ActiveX control installation based on Group Policy settings. This service is started on demand and if disabled the installation of ActiveX controls will behave according to default browser settings.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\axinstsv.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k AxInstSVGroup"
  38. 8/26/2031 7:05 PM,"HKLM\System\CurrentControlSet\Services","BDESVC",enabled,"Services",System-wide,"BitLocker Drive Encryption Service: BDESVC hosts the BitLocker Drive Encryption service. BitLocker Drive Encryption provides secure startup for the operating system, as well as full volume encryption for OS, fixed or removable volumes. This service allows BitLocker to prompt users for various actions related to their volumes when mounted, and unlocks volumes automatically without user interaction. Additionally, it stores recovery information to Active Directory, if available, and, if necessary, ensures the most recent recovery certificates are used. Stopping or disabling the service would prevent users from leveraging this functionality.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\bdesvc.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k netsvcs -p"
  39. 7/27/1947 9:13 PM,"HKLM\System\CurrentControlSet\Services","BFE",enabled,"Services",System-wide,"Base Filtering Engine: The Base Filtering Engine (BFE) is a service that manages firewall and Internet Protocol security (IPsec) policies and implements user mode filtering. Stopping or disabling the BFE service will significantly reduce the security of the system. It will also result in unpredictable behavior in IPsec management and firewall applications.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\bfe.dll",10.0.17134.112,"%systemroot%\system32\svchost.exe -k LocalServiceNoNetwork -p"
  40. 4/27/1912 8:42 PM,"HKLM\System\CurrentControlSet\Services","BITS",enabled,"Services",System-wide,"Background Intelligent Transfer Service: Transfers files in the background using idle network bandwidth. If the service is disabled, then any applications that depend on BITS, such as Windows Update or MSN Explorer, will be unable to automatically download programs and other information.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\qmgr.dll",7.8.17134.1,"%SystemRoot%\System32\svchost.exe -k netsvcs -p"
  41. 3/10/1960 7:42 PM,"HKLM\System\CurrentControlSet\Services","BluetoothUserService",enabled,"Services",System-wide,"Bluetooth User Support Service: The Bluetooth user service supports proper functionality of Bluetooth features relevant to each user session.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\microsoft.bluetooth.userservice.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k BthAppGroup"
  42. 11/6/1920 9:00 AM,"HKLM\System\CurrentControlSet\Services","BluetoothUserService_44256",enabled,"Services",System-wide,"Bluetooth User Support Service_44256: The Bluetooth user service supports proper functionality of Bluetooth features relevant to each user session.","(Verified) Microsoft Windows Publisher","Microsoft Corporation","c:\windows\system32\svchost.exe",10.0.17134.1,"C:\Windows\system32\svchost.exe -k BthAppGroup"
  43. 12/23/1946 10:56 PM,"HKLM\System\CurrentControlSet\Services","BrokerInfrastructure",enabled,"Services",System-wide,"Background Tasks Infrastructure Service: Windows infrastructure service that controls which background tasks can run on the system.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\bisrv.dll",10.0.17134.137,"%SystemRoot%\system32\svchost.exe -k DcomLaunch -p"
  44. 6/28/1923 11:39 PM,"HKLM\System\CurrentControlSet\Services","BTAGService",enabled,"Services",System-wide,"Bluetooth Audio Gateway Service: Service supporting the audio gateway role of the Bluetooth Handsfree Profile.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\btagservice.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted"
  45. 1/12/1970 4:19 AM,"HKLM\System\CurrentControlSet\Services","BthAvctpSvc",enabled,"Services",System-wide,"AVCTP service: This is Audio Video Control Transport Protocol service","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\bthavctpsvc.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k LocalService -p"
  46. 9/2/1995 4:21 PM,"HKLM\System\CurrentControlSet\Services","bthserv",enabled,"Services",System-wide,"Bluetooth Support Service: The Bluetooth service supports discovery and association of remote Bluetooth devices. Stopping or disabling this service may cause already installed Bluetooth devices to fail to operate properly and prevent new devices from being discovered or associated.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\bthserv.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k LocalService -p"
  47. 12/4/2018 11:36 PM,"HKLM\System\CurrentControlSet\Services","camsvc",enabled,"Services",System-wide,"Capability Access Manager Service: Provides facilities for managing UWP apps access to app capabilities as well as checking an app's access to specific app capabilities","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\capabilityaccessmanager.dll",10.0.17134.137,"%SystemRoot%\system32\svchost.exe -k appmodel -p"
  48. 2/12/1914 9:25 PM,"HKLM\System\CurrentControlSet\Services","CDPSvc",enabled,"Services",System-wide,"Connected Devices Platform Service: This service is used for Connected Devices Platform scenarios","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\cdpsvc.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k LocalService -p"
  49. 4/25/1953 10:01 PM,"HKLM\System\CurrentControlSet\Services","CDPUserSvc",enabled,"Services",System-wide,"Connected Devices Platform User Service: This user service is used for Connected Devices Platform scenarios","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\cdpusersvc.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k UnistackSvcGroup"
  50. 11/6/1920 9:00 AM,"HKLM\System\CurrentControlSet\Services","CDPUserSvc_44256",enabled,"Services",System-wide,"Connected Devices Platform User Service_44256: This user service is used for Connected Devices Platform scenarios","(Verified) Microsoft Windows Publisher","Microsoft Corporation","c:\windows\system32\svchost.exe",10.0.17134.1,"C:\Windows\system32\svchost.exe -k UnistackSvcGroup"
  51. 1/30/1945 11:34 AM,"HKLM\System\CurrentControlSet\Services","CertPropSvc",enabled,"Services",System-wide,"Certificate Propagation: Copies user certificates and root certificates from smart cards into the current user's certificate store, detects when a smart card is inserted into a smart card reader, and, if needed, installs the smart card Plug and Play minidriver.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\certprop.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k netsvcs"
  52. 2/15/2007 1:37 AM,"HKLM\System\CurrentControlSet\Services","ClipSVC",enabled,"Services",System-wide,"Client License Service (ClipSVC): Provides infrastructure support for the Microsoft Store. This service is started on demand and if disabled applications bought using Windows Store will not behave correctly.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\clipsvc.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k wsappx -p"
  53. 3/18/1994 9:42 AM,"HKLM\System\CurrentControlSet\Services","COMSysApp",enabled,"Services",System-wide,"COM System Application: Manages the configuration and tracking of Component Object Model (COM) -based components. If the service is stopped, most COM -based components will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\dllhost.exe",10.0.17134.1,"%SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}"
  54. 2/17/2018 1:57 PM,"HKLM\System\CurrentControlSet\Services","CoreMessagingRegistrar",enabled,"Services",System-wide,"CoreMessaging: Manages communication between system components.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\coremessaging.dll",10.0.17134.228,"%SystemRoot%\system32\svchost.exe -k LocalServiceNoNetwork -p"
  55. 9/26/2014 3:17 AM,"HKLM\System\CurrentControlSet\Services","cphs",enabled,"Services",System-wide,"Intel(R) Content Protection HECI Service: Intel(R) Content Protection HECI Service - enables communication with the Content Protection FW","(Verified) Intel Corporation - pGFX","Intel Corporation","c:\windows\syswow64\intelcphecisvc.exe",9.0.31.9000,"%SystemRoot%\SysWow64\IntelCpHeciSvc.exe"
  56. 5/7/2014 11:41 PM,"HKLM\System\CurrentControlSet\Services","CryptSvc",enabled,"Services",System-wide,"Cryptographic Services: Provides three management services: Catalog Database Service, which confirms the signatures of Windows files and allows new programs to be installed; Protected Root Service, which adds and removes Trusted Root Certification Authority certificates from this computer; and Automatic Root Certificate Update Service, which retrieves root certificates from Windows Update and enable scenarios such as SSL. If this service is stopped, these management services will not function properly. If this service is disabled, any services that explicitly depend on it will fail to start.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\cryptsvc.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k NetworkService -p"
  57. 4/19/1962 6:38 PM,"HKLM\System\CurrentControlSet\Services","CscService",enabled,"Services",System-wide,"Offline Files: The Offline Files service performs maintenance activities on the Offline Files cache, responds to user logon and logoff events, implements the internals of the public API, and dispatches interesting events to those interested in Offline Files activities and changes in cache state.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\cscsvc.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted -p"
  58. 10/20/2014 1:54 PM,"HKLM\System\CurrentControlSet\Services","CxAudMsg",enabled,"Services",System-wide,"Conexant Audio Message Service: Monitors audio device events and forward them to subscribing application. If this service is stop. the aduio effects will not function properly.","(Verified) Conexant Systems, Inc.","Conexant Systems Inc.","c:\windows\system32\cxaudmsg64.exe",1.14.0.0,"C:\Windows\system32\CxAudMsg64.exe"
  59. 1/13/1916 8:13 PM,"HKLM\System\CurrentControlSet\Services","DcomLaunch",enabled,"Services",System-wide,"DCOM Server Process Launcher: The DCOMLAUNCH service launches COM and DCOM servers in response to object activation requests. If this service is stopped or disabled, programs using COM or DCOM will not function properly. It is strongly recommended that you have the DCOMLAUNCH service running.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\rpcss.dll",10.0.17134.112,"%SystemRoot%\system32\svchost.exe -k DcomLaunch -p"
  60. 3/6/1934 8:53 AM,"HKLM\System\CurrentControlSet\Services","defragsvc",enabled,"Services",System-wide,"Optimize drives: Helps the computer run more efficiently by optimizing files on storage drives.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\defragsvc.dll",10.0.17134.191,"%SystemRoot%\system32\svchost.exe -k defragsvc"
  61. 6/5/2018 4:19 PM,"HKLM\System\CurrentControlSet\Services","DevActSvc",enabled,"Services",System-wide,"Device Activation Service: ","(Verified) ASUSTeK Computer Inc.","","c:\program files (x86)\asus\asus device activation\devactsvc.exe",,"C:\Program Files (x86)\ASUS\ASUS Device Activation\DevActSvc.exe"
  62. 12/7/2030 5:49 AM,"HKLM\System\CurrentControlSet\Services","DeviceAssociationService",enabled,"Services",System-wide,"Device Association Service: Enables pairing between the system and wired or wireless devices.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\das.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p"
  63. 2/9/1936 4:00 AM,"HKLM\System\CurrentControlSet\Services","DeviceInstall",enabled,"Services",System-wide,"Device Install Service: Enables a computer to recognize and adapt to hardware changes with little or no user input. Stopping or disabling this service will result in system instability.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\umpnpmgr.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k DcomLaunch -p"
  64. 11/9/1957 7:46 PM,"HKLM\System\CurrentControlSet\Services","DevicePickerUserSvc",enabled,"Services",System-wide,"DevicePicker: Device Picker","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\windows.devices.picker.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k DevicesFlow"
  65. 11/6/1920 9:00 AM,"HKLM\System\CurrentControlSet\Services","DevicePickerUserSvc_44256",enabled,"Services",System-wide,"DevicePicker_44256: Device Picker","(Verified) Microsoft Windows Publisher","Microsoft Corporation","c:\windows\system32\svchost.exe",10.0.17134.1,"C:\Windows\system32\svchost.exe -k DevicesFlow"
  66. 10/17/1932 11:19 PM,"HKLM\System\CurrentControlSet\Services","DevicesFlowUserSvc",enabled,"Services",System-wide,"DevicesFlow: Device Discovery and Connecting","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\devicesflowbroker.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k DevicesFlow"
  67. 11/6/1920 9:00 AM,"HKLM\System\CurrentControlSet\Services","DevicesFlowUserSvc_44256",enabled,"Services",System-wide,"DevicesFlow_44256: Device Discovery and Connecting","(Verified) Microsoft Windows Publisher","Microsoft Corporation","c:\windows\system32\svchost.exe",10.0.17134.1,"C:\Windows\system32\svchost.exe -k DevicesFlow"
  68. 5/21/2029 1:55 AM,"HKLM\System\CurrentControlSet\Services","DevQueryBroker",enabled,"Services",System-wide,"DevQuery Background Discovery Broker: Enables apps to discover devices with a backgroud task","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\devquerybroker.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p"
  69. 12/11/1912 10:53 PM,"HKLM\System\CurrentControlSet\Services","Dhcp",enabled,"Services",System-wide,"DHCP Client: Registers and updates IP addresses and DNS records for this computer. If this service is stopped, this computer will not receive dynamic IP addresses and DNS updates. If this service is disabled, any services that explicitly depend on it will fail to start.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\dhcpcore.dll",10.0.17134.191,"%SystemRoot%\system32\dhcpcore.dll"
  70. 4/15/2013 7:51 PM,"HKLM\System\CurrentControlSet\Services","diagnosticshub.standardcollector.service",enabled,"Services",System-wide,"Microsoft (R) Diagnostics Hub Standard Collector Service: Diagnostics Hub Standard Collector Service. When running, this service collects real time ETW events and processes them.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe",11.0.17134.228,"%SystemRoot%\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe"
  71. 4/25/1960 12:48 AM,"HKLM\System\CurrentControlSet\Services","diagsvc",enabled,"Services",System-wide,"Diagnostic Execution Service: Executes diagnostic actions for troubleshooting support","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\diagsvc.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k diagnostics"
  72. 3/26/1949 2:26 AM,"HKLM\System\CurrentControlSet\Services","DmEnrollmentSvc",enabled,"Services",System-wide,"Device Management Enrollment Service: Performs Device Enrollment Activities for Device Management","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\windows.internal.management.dll",10.0.17134.137,"%systemroot%\system32\svchost.exe -k netsvcs -p"
  73. 12/28/1945 5:34 AM,"HKLM\System\CurrentControlSet\Services","dmwappushservice",enabled,"Services",System-wide,"dmwappushsvc: WAP Push Message Routing Service","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\dmwappushsvc.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k netsvcs -p"
  74. 8/24/1934 7:28 PM,"HKLM\System\CurrentControlSet\Services","Dnscache",enabled,"Services",System-wide,"DNS Client: The DNS Client service (dnscache) caches Domain Name System (DNS) names and registers the full computer name for this computer. If the service is stopped, DNS names will continue to be resolved. However, the results of DNS name queries will not be cached and the computer's name will not be registered. If the service is disabled, any services that explicitly depend on it will fail to start.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\dnsrslvr.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k NetworkService -p"
  75. 3/19/2006 7:32 AM,"HKLM\System\CurrentControlSet\Services","DoSvc",enabled,"Services",System-wide,"Delivery Optimization: Performs content delivery optimization tasks","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\dosvc.dll",10.0.17134.191,"%SystemRoot%\system32\dosvc.dll"
  76. 6/24/1954 4:17 PM,"HKLM\System\CurrentControlSet\Services","dot3svc",enabled,"Services",System-wide,"Wired AutoConfig: The Wired AutoConfig (DOT3SVC) service is responsible for performing IEEE 802.1X authentication on Ethernet interfaces. If your current wired network deployment enforces 802.1X authentication, the DOT3SVC service should be configured to run for establishing Layer 2 connectivity and/or providing access to network resources. Wired networks that do not enforce 802.1X authentication are unaffected by the DOT3SVC service.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\dot3svc.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p"
  77. 1/17/1977 12:59 AM,"HKLM\System\CurrentControlSet\Services","DPS",enabled,"Services",System-wide,"Diagnostic Policy Service: The Diagnostic Policy Service enables problem detection, troubleshooting and resolution for Windows components. If this service is stopped, diagnostics will no longer function.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\dps.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k LocalServiceNoNetwork -p"
  78. 3/4/1958 8:19 PM,"HKLM\System\CurrentControlSet\Services","DsmSvc",enabled,"Services",System-wide,"Device Setup Manager: Enables the detection, download and installation of device-related software. If this service is disabled, devices may be configured with outdated software, and may not work correctly.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\devicesetupmanager.dll",10.0.17134.137,"%SystemRoot%\system32\svchost.exe -k netsvcs -p"
  79. 6/16/1909 5:16 AM,"HKLM\System\CurrentControlSet\Services","DsSvc",enabled,"Services",System-wide,"Data Sharing Service: Provides data brokering between applications.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\dssvc.dll",10.0.17134.112,"%SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted -p"
  80. 9/4/1974 9:47 AM,"HKLM\System\CurrentControlSet\Services","DusmSvc",enabled,"Services",System-wide,"Data Usage: Network data usage, data limit, restrict background data, metered networks.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\dusmsvc.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted -p"
  81. 12/27/1980 9:11 PM,"HKLM\System\CurrentControlSet\Services","Eaphost",enabled,"Services",System-wide,"Extensible Authentication Protocol: The Extensible Authentication Protocol (EAP) service provides network authentication in such scenarios as 802.1x wired and wireless, VPN, and Network Access Protection (NAP). EAP also provides application programming interfaces (APIs) that are used by network access clients, including wireless and VPN clients, during the authentication process. If you disable this service, this computer is prevented from accessing networks that require EAP authentication.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\eapsvc.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k netsvcs -p"
  82. 3/28/2033 9:04 PM,"HKLM\System\CurrentControlSet\Services","EFS",enabled,"Services",System-wide,"Encrypting File System (EFS): Provides the core file encryption technology used to store encrypted files on NTFS file system volumes. If this service is stopped or disabled, applications will be unable to access encrypted files.","(Verified) Microsoft Windows Publisher","Microsoft Corporation","c:\windows\system32\lsass.exe",10.0.17134.1,"%SystemRoot%\System32\lsass.exe"
  83. 8/5/1952 11:13 AM,"HKLM\System\CurrentControlSet\Services","embeddedmode",enabled,"Services",System-wide,"Embedded Mode: The Embedded Mode service enables scenarios related to Background Applications. Disabling this service will prevent Background Applications from being activated.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\embeddedmodesvc.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted -p"
  84. 10/21/1957 6:15 AM,"HKLM\System\CurrentControlSet\Services","EntAppSvc",enabled,"Services",System-wide,"Enterprise App Management Service: Enables enterprise application management.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\enterpriseappmgmtsvc.dll",10.0.17134.1,"%systemroot%\system32\svchost.exe -k appmodel -p"
  85. 6/27/2015 1:48 AM,"HKLM\System\CurrentControlSet\Services","esifsvc",enabled,"Services",System-wide,"ESIF Upper Framework Service: ESIF Upper Framework Service","(Verified) Intel(R) Software","Intel Corporation","c:\windows\syswow64\esif_uf.exe",8.1.10600.150,"%SystemRoot%\SysWOW64\esif_uf.exe"
  86. 4/28/1973 11:33 PM,"HKLM\System\CurrentControlSet\Services","EventLog",enabled,"Services",System-wide,"Windows Event Log: This service manages events and event logs. It supports logging events, querying events, subscribing to events, archiving event logs, and managing event metadata. It can display events in both XML and plain text format. Stopping this service may compromise security and reliability of the system.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\wevtsvc.dll",10.0.17134.228,"%SystemRoot%\System32\wevtsvc.dll"
  87. 7/15/1914 6:38 AM,"HKLM\System\CurrentControlSet\Services","EventSystem",enabled,"Services",System-wide,"COM Event System: Supports System Event Notification Service (SENS), which provides automatic distribution of events to subscribing Component Object Model (COM) components. If the service is stopped, SENS will close and will not be able to provide logon and logoff notifications. If this service is disabled, any services that explicitly depend on it will fail to start.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\es.dll",2001.12.10941.16384,"%SystemRoot%\system32\svchost.exe -k LocalService -p"
  88. 8/2/1961 9:37 PM,"HKLM\System\CurrentControlSet\Services","fdPHost",enabled,"Services",System-wide,"Function Discovery Provider Host: The FDPHOST service hosts the Function Discovery (FD) network discovery providers. These FD providers supply network discovery services for the Simple Services Discovery Protocol (SSDP) and Web Services � Discovery (WS-D) protocol. Stopping or disabling the FDPHOST service will disable network discovery for these protocols when using FD. When this service is unavailable, network services using FD and relying on these discovery protocols will be unable to find network devices or resources.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\fdphost.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k LocalService -p"
  89. 11/28/1990 10:35 AM,"HKLM\System\CurrentControlSet\Services","FDResPub",enabled,"Services",System-wide,"Function Discovery Resource Publication: Publishes this computer and resources attached to this computer so they can be discovered over the network. If this service is stopped, network resources will no longer be published and they will not be discovered by other computers on the network.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\fdrespub.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation -p"
  90. 12/8/1956 11:48 PM,"HKLM\System\CurrentControlSet\Services","fhsvc",enabled,"Services",System-wide,"File History Service: Protects user files from accidental loss by copying them to a backup location","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\fhsvc.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p"
  91. 9/12/1997 6:50 PM,"HKLM\System\CurrentControlSet\Services","FontCache",enabled,"Services",System-wide,"Windows Font Cache Service: Optimizes performance of applications by caching commonly used font data. Applications will start this service if it is not already running. It can be disabled, though doing so will degrade application performance.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\fntcache.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k LocalService -p"
  92. 2/9/2018 12:03 PM,"HKLM\System\CurrentControlSet\Services","FontCache3.0.0.0",enabled,"Services",System-wide,"Windows Presentation Foundation Font Cache 3.0.0.0: Optimizes performance of Windows Presentation Foundation (WPF) applications by caching commonly used font data. WPF applications will start this service if it is not already running. It can be disabled, though doing so will degrade the performance of WPF applications.","(Verified) Microsoft Corporation","Microsoft Corporation","c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe",3.0.6920.8931,"%systemroot%\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe"
  93. 9/6/1936 4:52 PM,"HKLM\System\CurrentControlSet\Services","FrameServer",enabled,"Services",System-wide,"Windows Camera Frame Server: Enables multiple clients to access video frames from camera devices.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\frameserver.dll",10.0.17134.112,"%SystemRoot%\System32\svchost.exe -k Camera"
  94. 3/10/2019 12:00 PM,"HKLM\System\CurrentControlSet\Services","GoogleChromeElevationService",enabled,"Services",System-wide,"Google Chrome Elevation Service: Google Chrome","(Verified) Google LLC","Google Inc.","c:\program files (x86)\google\chrome\application\73.0.3683.75\elevation_service.exe",73.0.3683.75,"""C:\Program Files (x86)\Google\Chrome\Application\73.0.3683.75\elevation_service.exe"""
  95. 9/16/1946 1:27 AM,"HKLM\System\CurrentControlSet\Services","gpsvc",enabled,"Services",System-wide,"Group Policy Client: The service is responsible for applying settings configured by administrators for the computer and users through the Group Policy component. If the service is disabled, the settings will not be applied and applications and components will not be manageable through Group Policy. Any components or applications that depend on the Group Policy component might not be functional if the service is disabled.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\gpsvc.dll",10.0.17134.1,"%systemroot%\system32\svchost.exe -k netsvcs -p"
  96. 6/7/1919 9:42 AM,"HKLM\System\CurrentControlSet\Services","GraphicsPerfSvc",enabled,"Services",System-wide,"GraphicsPerfSvc: Graphics performance monitor service","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\graphicsperfsvc.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k GraphicsPerfSvcGroup"
  97. 12/5/2018 9:00 AM,"HKLM\System\CurrentControlSet\Services","gupdate",enabled,"Services",System-wide,"Google Update Service (gupdate): Keeps your Google software up to date. If this service is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Google software using it.","(Verified) Google Inc","Google Inc.","c:\program files (x86)\google\update\googleupdate.exe",1.3.33.23,"""C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"" /svc"
  98. 12/5/2018 9:00 AM,"HKLM\System\CurrentControlSet\Services","gupdatem",enabled,"Services",System-wide,"Google Update Service (gupdatem): Keeps your Google software up to date. If this service is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Google software using it.","(Verified) Google Inc","Google Inc.","c:\program files (x86)\google\update\googleupdate.exe",1.3.33.23,"""C:\Program Files (x86)\Google\Update\GoogleUpdate.exe"" /medsvc"
  99. 11/20/1970 6:23 AM,"HKLM\System\CurrentControlSet\Services","hidserv",enabled,"Services",System-wide,"Human Interface Device Service: Activates and maintains the use of hot buttons on keyboards, remote controls, and other multimedia devices. It is recommended that you keep this service running.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\hidserv.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p"
  100. 6/7/2031 9:51 PM,"HKLM\System\CurrentControlSet\Services","HvHost",enabled,"Services",System-wide,"HV Host Service: Provides an interface for the Hyper-V hypervisor to provide per-partition performance counters to the host operating system.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\hvhostsvc.dll",10.0.17134.228,"%SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p"
  101. 3/17/1983 12:51 AM,"HKLM\System\CurrentControlSet\Services","icssvc",enabled,"Services",System-wide,"Windows Mobile Hotspot Service: Provides the ability to share a cellular data connection with another device.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\tetheringservice.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted -p"
  102. 10/2/2015 12:58 AM,"HKLM\System\CurrentControlSet\Services","igfxCUIService2.0.0.0",enabled,"Services",System-wide,"Intel(R) HD Graphics Control Panel Service: Service for Intel(R) HD Graphics Control Panel","(Verified) Intel Corporation - pGFX","Intel Corporation","c:\windows\system32\igfxcuiservice.exe",6.15.10.4300,"%SystemRoot%\system32\igfxCUIService.exe"
  103. 11/4/1977 7:22 AM,"HKLM\System\CurrentControlSet\Services","IKEEXT",enabled,"Services",System-wide,"IKE and AuthIP IPsec Keying Modules: The IKEEXT service hosts the Internet Key Exchange (IKE) and Authenticated Internet Protocol (AuthIP) keying modules. These keying modules are used for authentication and key exchange in Internet Protocol security (IPsec). Stopping or disabling the IKEEXT service will disable IKE and AuthIP key exchange with peer computers. IPsec is typically configured to use IKE or AuthIP; therefore, stopping or disabling the IKEEXT service might result in an IPsec failure and might compromise the security of the system. It is strongly recommended that you have the IKEEXT service running.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\ikeext.dll",10.0.17134.1,"%systemroot%\system32\svchost.exe -k netsvcs -p"
  104. 9/29/1974 12:07 AM,"HKLM\System\CurrentControlSet\Services","InstallService",enabled,"Services",System-wide,"Microsoft Store Install Service: Provides infrastructure support for the Microsoft Store. This service is started on demand and if disabled then installations will not function properly.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\installservice.dll",10.0.17134.137,"%SystemRoot%\System32\svchost.exe -k netsvcs -p"
  105. 5/22/2015 6:23 AM,"HKLM\System\CurrentControlSet\Services","Intel(R) Capability Licensing Service TCP IP Interface",enabled,"Services",System-wide,"Intel(R) Capability Licensing Service TCP IP Interface: Version: 1.42.17.0","(Verified) Intel� Trusted Connect Service","Intel(R) Corporation","c:\program files\intel\icls client\socketheciserver.exe",1.42.17.0,"""C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe"""
  106. 5/19/2015 11:10 PM,"HKLM\System\CurrentControlSet\Services","Intel(R) Security Assist",enabled,"Services",System-wide,"Intel(R) Security Assist: Security Helper","(Not verified) Intel Corporation","Intel Corporation","c:\program files (x86)\intel\intel(r) security assist\isa.exe",1.0.0.532,"""C:\Program Files (x86)\Intel\Intel(R) Security Assist\isa.exe"""
  107. 3/29/1945 4:36 PM,"HKLM\System\CurrentControlSet\Services","iphlpsvc",enabled,"Services",System-wide,"IP Helper: Provides tunnel connectivity using IPv6 transition technologies (6to4, ISATAP, Port Proxy, and Teredo), and IP-HTTPS. If this service is stopped, the computer will not have the enhanced connectivity benefits that these technologies offer.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\iphlpsvc.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k NetSvcs -p"
  108. 10/12/1958 3:41 AM,"HKLM\System\CurrentControlSet\Services","IpOverUsbSvc",enabled,"Services",System-wide,"Windows Phone IP over USB Transport (IpOverUsbSvc): Enables communication between the Windows SDK and a Windows Device. If the service is stopped, application deployment and debugging will fail on device.","(Verified) Microsoft Corporation","Microsoft Corporation","c:\program files (x86)\common files\microsoft shared\phone tools\corecon\11.0\bin\ipoverusbsvc.exe",10.0.16299.15,"""C:\Program Files (x86)\Common Files\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\IpOverUsbSvc.exe"""
  109. 5/30/2026 12:35 AM,"HKLM\System\CurrentControlSet\Services","IpxlatCfgSvc",enabled,"Services",System-wide,"IP Translation Configuration Service: Configures and enables translation from v4 to v6 and vice versa","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\ipxlatcfg.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted -p"
  110. 7/6/1987 9:43 AM,"HKLM\System\CurrentControlSet\Services","irmon",enabled,"Services",System-wide,"Infrared monitor service: Detects other Infrared devices that are in range and launches the file transfer application. Stopping the service will prevent file transfer from working","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\irmon.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p"
  111. 5/19/2015 11:11 PM,"HKLM\System\CurrentControlSet\Services","isaHelperSvc",enabled,"Services",System-wide,"Intel(R) Security Assist Helper: Security Helper",,"","c:\program files (x86)\intel\intel(r) security assist\isahelperservice.exe",,"""C:\Program Files (x86)\Intel\Intel(R) Security Assist\isaHelperService.exe"""
  112. 6/24/2015 5:03 AM,"HKLM\System\CurrentControlSet\Services","jhi_service",enabled,"Services",System-wide,"Intel(R) Dynamic Application Loader Host Interface Service: Intel(R) Dynamic Application Loader Host Interface Service - Allows applications to access the local Intel (R) DAL","(Verified) Intel Corporation - Embedded Subsystems and IP Blocks Group","Intel Corporation","c:\program files (x86)\intel\intel(r) management engine components\dal\jhi_service.exe",11.0.0.1153,"""C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe"""
  113. 3/28/2033 9:04 PM,"HKLM\System\CurrentControlSet\Services","KeyIso",enabled,"Services",System-wide,"CNG Key Isolation: The CNG key isolation service is hosted in the LSA process. The service provides key process isolation to private keys and associated cryptographic operations as required by the Common Criteria. The service stores and uses long-lived keys in a secure process complying with Common Criteria requirements.","(Verified) Microsoft Windows Publisher","Microsoft Corporation","c:\windows\system32\lsass.exe",10.0.17134.1,"%SystemRoot%\system32\lsass.exe"
  114. 11/2/2015 12:10 AM,"HKLM\System\CurrentControlSet\Services","Kingsoft_WPS_UpdateService",enabled,"Services",System-wide,"WPS Office Update Service: WPS Office Update Service.","(Verified) Zhuhai Kingsoft Office Software Co.,Ltd","Zhuhai Kingsoft Office Software Co.,Ltd","c:\program files (x86)\kingsoft\wps office\9.1.0.5220\wtoolex\wpsupdatesvr.exe",9.1.0.5220,"C:\Program Files (x86)\Kingsoft\WPS Office\9.1.0.5220\wtoolex\wpsupdatesvr.exe"
  115. 3/10/1943 3:20 AM,"HKLM\System\CurrentControlSet\Services","KtmRm",enabled,"Services",System-wide,"KtmRm for Distributed Transaction Coordinator: Coordinates transactions between the Distributed Transaction Coordinator (MSDTC) and the Kernel Transaction Manager (KTM). If it is not needed, it is recommended that this service remain stopped. If it is needed, both MSDTC and KTM will start this service automatically. If this service is disabled, any MSDTC transaction interacting with a Kernel Resource Manager will fail and any services that explicitly depend on it will fail to start.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\msdtckrm.dll",2001.12.10941.16384,"%SystemRoot%\System32\svchost.exe -k NetworkServiceAndNoImpersonation -p"
  116. 9/19/2017 8:11 PM,"HKLM\System\CurrentControlSet\Services","LanmanServer",enabled,"Services",System-wide,"Server: Supports file, print, and named-pipe sharing over the network for this computer. If this service is stopped, these functions will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\srvsvc.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k netsvcs -p"
  117. 10/3/1971 12:30 PM,"HKLM\System\CurrentControlSet\Services","LanmanWorkstation",enabled,"Services",System-wide,"Workstation: Creates and maintains client network connections to remote servers using the SMB protocol. If this service is stopped, these connections will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\wkssvc.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k NetworkService -p"
  118. 9/29/1969 10:18 AM,"HKLM\System\CurrentControlSet\Services","lfsvc",enabled,"Services",System-wide,"Geolocation Service: This service monitors the current location of the system and manages geofences (a geographical location with associated events). If you turn off this service, applications will be unable to use or receive notifications for geolocation or geofences.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\lfsvc.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k netsvcs -p"
  119. 1/24/1930 3:37 AM,"HKLM\System\CurrentControlSet\Services","LicenseManager",enabled,"Services",System-wide,"Windows License Manager Service: Provides infrastructure support for the Microsoft Store. This service is started on demand and if disabled then content acquired through the Microsoft Store will not function properly.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\licensemanagersvc.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k LocalService -p"
  120. 12/25/1908 7:00 AM,"HKLM\System\CurrentControlSet\Services","lltdsvc",enabled,"Services",System-wide,"Link-Layer Topology Discovery Mapper: Creates a Network Map, consisting of PC and device topology (connectivity) information, and metadata describing each PC and device. If this service is disabled, the Network Map will not function properly.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\lltdsvc.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k LocalService -p"
  121. 10/5/1980 2:43 PM,"HKLM\System\CurrentControlSet\Services","lmhosts",enabled,"Services",System-wide,"TCP/IP NetBIOS Helper: Provides support for the NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution for clients on the network, therefore enabling users to share files, print, and log on to the network. If this service is stopped, these functions might be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\lmhsvc.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted -p"
  122. 6/24/2015 5:07 AM,"HKLM\System\CurrentControlSet\Services","LMS",enabled,"Services",System-wide,"Intel(R) Management and Security Application Local Management Service: Intel(R) Management and Security Application Local Management Service - Provides OS-related Intel(R) ME functionality.","(Verified) Intel Corporation - Embedded Subsystems and IP Blocks Group","Intel Corporation","c:\program files (x86)\intel\intel(r) management engine components\lms\lms.exe",11.0.0.1153,"""C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe"""
  123. 1/17/1960 6:00 PM,"HKLM\System\CurrentControlSet\Services","LSM",enabled,"Services",System-wide,"Local Session Manager: Core Windows Service that manages local user sessions. Stopping or disabling this service will result in system instability.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\lsm.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k DcomLaunch -p"
  124. 2/12/1936 9:43 PM,"HKLM\System\CurrentControlSet\Services","LxpSvc",enabled,"Services",System-wide,"Language Experience Service: Provides infrastructure support for deploying and configuring localized Windows resources. This service is started on demand and, if disabled, additional Windows languages will not be deployed to the system, and Windows may not function properly.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\languageoverlayserver.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k netsvcs"
  125. 5/2/1902 10:09 PM,"HKLM\System\CurrentControlSet\Services","MapsBroker",enabled,"Services",System-wide,"Downloaded Maps Manager: Windows service for application access to downloaded maps. This service is started on-demand by application accessing downloaded maps. Disabling this service will prevent apps from accessing maps.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\moshost.dll",10.0.17134.165,"%SystemRoot%\System32\svchost.exe -k NetworkService -p"
  126. 12/23/2005 10:17 PM,"HKLM\System\CurrentControlSet\Services","MessagingService",enabled,"Services",System-wide,"MessagingService: Service supporting text messaging and related functionality.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\messagingservice.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k UnistackSvcGroup"
  127. 11/6/1920 9:00 AM,"HKLM\System\CurrentControlSet\Services","MessagingService_44256",enabled,"Services",System-wide,"MessagingService_44256: Service supporting text messaging and related functionality.","(Verified) Microsoft Windows Publisher","Microsoft Corporation","c:\windows\system32\svchost.exe",10.0.17134.1,"C:\Windows\system32\svchost.exe -k UnistackSvcGroup"
  128. 9/30/1983 6:08 AM,"HKLM\System\CurrentControlSet\Services","mpssvc",enabled,"Services",System-wide,"Windows Defender Firewall: Windows Defender Firewall helps protect your computer by preventing unauthorized users from gaining access to your computer through the Internet or a network.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\mpssvc.dll",10.0.17134.137,"%SystemRoot%\system32\svchost.exe -k LocalServiceNoNetwork -p"
  129. 12/12/2020 6:07 PM,"HKLM\System\CurrentControlSet\Services","MSDTC",enabled,"Services",System-wide,"Distributed Transaction Coordinator: Coordinates transactions that span multiple resource managers, such as databases, message queues, and file systems. If this service is stopped, these transactions will fail. If this service is disabled, any services that explicitly depend on it will fail to start.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\msdtc.exe",2001.12.10941.16384,"%SystemRoot%\System32\msdtc.exe"
  130. 4/4/1924 10:22 AM,"HKLM\System\CurrentControlSet\Services","MSiSCSI",enabled,"Services",System-wide,"Microsoft iSCSI Initiator Service: Manages Internet SCSI (iSCSI) sessions from this computer to remote iSCSI target devices. If this service is stopped, this computer will not be able to login or access iSCSI targets. If this service is disabled, any services that explicitly depend on it will fail to start.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\iscsiexe.dll",10.0.17134.1,"%systemroot%\system32\svchost.exe -k netsvcs -p"
  131. 1/21/2012 3:40 PM,"HKLM\System\CurrentControlSet\Services","msiserver",enabled,"Services",System-wide,"Windows Installer: Adds, modifies, and removes applications provided as a Windows Installer (*.msi, *.msp) package. If this service is disabled, any services that explicitly depend on it will fail to start.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\msiexec.exe",5.0.17134.228,"%systemroot%\system32\msiexec.exe /V"
  132. 4/8/1902 1:29 PM,"HKLM\System\CurrentControlSet\Services","NaturalAuthentication",enabled,"Services",System-wide,"Natural Authentication: Signal aggregator service, that evaluates signals based on time, network, geolocation, bluetooth and cdf factors. Supported features are Device Unlock, Dynamic Lock and Dynamo MDM policies","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\naturalauth.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k netsvcs -p"
  133. 8/11/1974 11:40 PM,"HKLM\System\CurrentControlSet\Services","NcaSvc",enabled,"Services",System-wide,"Network Connectivity Assistant: Provides DirectAccess status notification for UI components","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\ncasvc.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k NetSvcs -p"
  134. 12/9/1923 3:41 PM,"HKLM\System\CurrentControlSet\Services","NcbService",enabled,"Services",System-wide,"Network Connection Broker: Brokers connections that allow Windows Store Apps to receive notifications from the internet.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\ncbservice.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted -p"
  135. 10/11/2002 2:14 PM,"HKLM\System\CurrentControlSet\Services","NcdAutoSetup",enabled,"Services",System-wide,"Network Connected Devices Auto-Setup: Network Connected Devices Auto-Setup service monitors and installs qualified devices that connect to a qualified network. Stopping or disabling this service will prevent Windows from discovering and installing qualified network connected devices automatically. Users can still manually add network connected devices to a PC through the user interface.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\ncdautosetup.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k LocalServiceNoNetwork -p"
  136. 3/28/2033 9:04 PM,"HKLM\System\CurrentControlSet\Services","Netlogon",enabled,"Services",System-wide,"Netlogon: Maintains a secure channel between this computer and the domain controller for authenticating users and services. If this service is stopped, the computer may not authenticate users and services and the domain controller cannot register DNS records. If this service is disabled, any services that explicitly depend on it will fail to start.","(Verified) Microsoft Windows Publisher","Microsoft Corporation","c:\windows\system32\lsass.exe",10.0.17134.1,"%systemroot%\system32\lsass.exe"
  137. 1/1/1969 4:49 PM,"HKLM\System\CurrentControlSet\Services","Netman",enabled,"Services",System-wide,"Network Connections: Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\netman.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted -p"
  138. 10/15/1908 6:43 AM,"HKLM\System\CurrentControlSet\Services","netprofm",enabled,"Services",System-wide,"Network List Service: Identifies the networks to which the computer has connected, collects and stores properties for these networks, and notifies applications when these properties change.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\netprofmsvc.dll",10.0.17134.191,"%SystemRoot%\System32\svchost.exe -k LocalService -p"
  139. 10/21/2032 5:12 AM,"HKLM\System\CurrentControlSet\Services","NetSetupSvc",enabled,"Services",System-wide,"Network Setup Service: The Network Setup Service manages the installation of network drivers and permits the configuration of low-level network settings. If this service is stopped, any driver installations that are in-progress may be cancelled.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\netsetupsvc.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k netsvcs -p"
  140. 12/21/1937 1:34 PM,"HKLM\System\CurrentControlSet\Services","NgcCtnrSvc",enabled,"Services",System-wide,"Microsoft Passport Container: Manages local user identity keys used to authenticate user to identity providers as well as TPM virtual smart cards. If this service is disabled, local user identity keys and TPM virtual smart cards will not be accessible. It is recommended that you do not reconfigure this service.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\ngcctnrsvc.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted -p"
  141. 1/30/1939 10:38 PM,"HKLM\System\CurrentControlSet\Services","NgcSvc",enabled,"Services",System-wide,"Microsoft Passport: Provides process isolation for cryptographic keys used to authenticate to a user�s associated identity providers. If this service is disabled, all uses and management of these keys will not be available, which includes machine logon and single-sign on for apps and websites. This service starts and stops automatically. It is recommended that you do not reconfigure this service.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\ngcsvc.dll",10.0.17134.165,"%SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p"
  142. 11/9/2008 7:58 PM,"HKLM\System\CurrentControlSet\Services","NlaSvc",enabled,"Services",System-wide,"Network Location Awareness: Collects and stores configuration information for the network and notifies programs when this information is modified. If this service is stopped, configuration information might be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\nlasvc.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k NetworkService -p"
  143. 5/2/2018 8:39 AM,"HKLM\System\CurrentControlSet\Services","npggsvc",enabled,"Services",System-wide,"nProtect GameGuard Service: nProtect GameGuard Service","(Verified) INCA Internet Co.,Ltd.","INCA Internet Co., Ltd.","c:\windows\syswow64\gamemon.des",2018.5.2.1,"C:\Windows\system32\GameMon.des -service"
  144. 8/11/1930 4:14 PM,"HKLM\System\CurrentControlSet\Services","nsi",enabled,"Services",System-wide,"Network Store Interface Service: This service delivers network notifications (e.g. interface addition/deleting etc) to user mode clients. Stopping this service will cause loss of network connectivity. If this service is disabled, any other services that explicitly depend on this service will fail to start.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\nsisvc.dll",10.0.17134.1,"%systemroot%\system32\svchost.exe -k LocalService -p"
  145. 7/14/2015 12:32 AM,"HKLM\System\CurrentControlSet\Services","nvsvc",enabled,"Services",System-wide,"NVIDIA Display Driver Service: Provides system and desktop level support to the NVIDIA display driver","(Verified) NVIDIA Corporation","NVIDIA Corporation","c:\windows\system32\nvvsvc.exe",8.17.13.5354,"""C:\Windows\system32\nvvsvc.exe"""
  146. 4/4/2029 4:44 AM,"HKLM\System\CurrentControlSet\Services","OneSyncSvc",enabled,"Services",System-wide,"Sync Host: This service synchronizes mail, contacts, calendar and various other user data. Mail and other applications dependent on this functionality will not work properly when this service is not running.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\aphostservice.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k UnistackSvcGroup"
  147. 11/6/1920 9:00 AM,"HKLM\System\CurrentControlSet\Services","OneSyncSvc_44256",enabled,"Services",System-wide,"Sync Host_44256: This service synchronizes mail, contacts, calendar and various other user data. Mail and other applications dependent on this functionality will not work properly when this service is not running.","(Verified) Microsoft Windows Publisher","Microsoft Corporation","c:\windows\system32\svchost.exe",10.0.17134.1,"C:\Windows\system32\svchost.exe -k UnistackSvcGroup"
  148. 3/27/1917 9:27 AM,"HKLM\System\CurrentControlSet\Services","p2pimsvc",enabled,"Services",System-wide,"Peer Networking Identity Manager: Provides identity services for the Peer Name Resolution Protocol (PNRP) and Peer-to-Peer Grouping services. If disabled, the Peer Name Resolution Protocol (PNRP) and Peer-to-Peer Grouping services may not function, and some applications, such as HomeGroup and Remote Assistance, may not function correctly.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\pnrpsvc.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k LocalServicePeerNet"
  149. 12/3/1930 10:38 AM,"HKLM\System\CurrentControlSet\Services","p2psvc",enabled,"Services",System-wide,"Peer Networking Grouping: Enables multi-party communication using Peer-to-Peer Grouping. If disabled, some applications, such as HomeGroup, may not function.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\p2psvc.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k LocalServicePeerNet"
  150. 7/2/1949 7:23 AM,"HKLM\System\CurrentControlSet\Services","PcaSvc",enabled,"Services",System-wide,"Program Compatibility Assistant Service: This service provides support for the Program Compatibility Assistant (PCA). PCA monitors programs installed and run by the user and detects known compatibility problems. If this service is stopped, PCA will not function properly.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\pcasvc.dll",10.0.17134.165,"%systemroot%\system32\svchost.exe -k LocalSystemNetworkRestricted -p"
  151. 8/24/1906 5:44 PM,"HKLM\System\CurrentControlSet\Services","PeerDistSvc",enabled,"Services",System-wide,"BranchCache: This service caches network content from peers on the local subnet.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\peerdistsvc.dll",10.0.17134.1,"%SystemRoot%\System32\svchost.exe -k PeerDist"
  152. 1/22/1934 12:40 PM,"HKLM\System\CurrentControlSet\Services","PerfHost",enabled,"Services",System-wide,"Performance Counter DLL Host: Enables remote users and 64-bit processes to query performance counters provided by 32-bit DLLs. If this service is stopped, only local users and 32-bit processes will be able to query performance counters provided by 32-bit DLLs.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\syswow64\perfhost.exe",10.0.17134.1,"%SystemRoot%\SysWow64\perfhost.exe"
  153. 7/4/1926 9:59 AM,"HKLM\System\CurrentControlSet\Services","PhoneSvc",enabled,"Services",System-wide,"Phone Service: Manages the telephony state on the device","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\phoneservice.dll",10.0.17134.81,"%SystemRoot%\system32\svchost.exe -k LocalService -p"
  154. 12/24/1995 1:45 AM,"HKLM\System\CurrentControlSet\Services","PimIndexMaintenanceSvc",enabled,"Services",System-wide,"Contact Data: Indexes contact data for fast contact searching. If you stop or disable this service, contacts might be missing from your search results.","(Verified) Microsoft Windows","Microsoft Corporation","c:\windows\system32\pimindexmaintenance.dll",10.0.17134.1,"%SystemRoot%\system32\svchost.exe -k UnistackSvcGroup"
  155. 11/6/1920 9:00 AM,"HKLM\System\CurrentControlSet\Services","PimIndexMaintenanceSvc_44256",enabled,"Services",System-wide,"Contact Data_44256: Indexes contact data for fast contact searching. If you stop or disable this service, contacts might be missing from your search results.","(Verified) Microsoft Windows Publisher","Microsoft Corporation","c:\windows\system32\svchost.exe",10.0.17134.1,"C:\Windows\system32\svchost.exe -k UnistackSvcGroup"
  156. 2/20/1914 6:47 AM,"HKLM\System\CurrentControlSet\Services","pla",enabled,"Services",System-wide,"Performance Logs
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!