svchost第一个是rpcss第二个是termsvcs第三个是NetworkService第四个是LocalService第五个是netsvcs----备忘

svchost第一个是rpcss第二个是termsvcs第三个是NetworkService第四个是LocalService第五个是netsvcs

CommandLine:  'C:\WINDOWS\system32\svchost -k rpcss'
CommandLine:  'C:\WINDOWS\System32\svchost.exe -k termsvcs'
CommandLine:  'C:\WINDOWS\system32\svchost.exe -k NetworkService'
CommandLine:  'C:\WINDOWS\system32\svchost.exe -k LocalService'
CommandLine:  'C:\WINDOWS\System32\svchost.exe -k netsvcs'

PROCESS 89593758  SessionId: 0  Cid: 01f4    Peb: 7ffdf000  ParentCid: 01c8
    DirBase: 7a0cc000  ObjectTable: e141e7f0  HandleCount: 308.
    Image: services.exe

PROCESS 8950d020  SessionId: 0  Cid: 0200    Peb: 7ffdf000  ParentCid: 01c8
    DirBase: 79f94000  ObjectTable: e1430ee0  HandleCount: 392.
    Image: lsass.exe

PROCESS 89460d88  SessionId: 0  Cid: 02c0    Peb: 7ffdf000  ParentCid: 01f4
    DirBase: 79cc5000  ObjectTable: e143d9f0  HandleCount: 195.
    Image: svchost.exe

PROCESS 898ac478  SessionId: 0  Cid: 02e8    Peb: 7ffdf000  ParentCid: 01f4
    DirBase: 79a1c000  ObjectTable: e143fc08  HandleCount: 195.
    Image: svchost.exe

PROCESS 897ad8c0  SessionId: 0  Cid: 037c    Peb: 7ffdf000  ParentCid: 01f4
    DirBase: 793ad000  ObjectTable: e1754458  HandleCount: 128.
    Image: svchost.exe

PROCESS 896a0598  SessionId: 0  Cid: 03b0    Peb: 7ffdf000  ParentCid: 01f4
    DirBase: 793f2000  ObjectTable: e17f4c08  HandleCount:  79.
    Image: svchost.exe

PROCESS 8940f8d0  SessionId: 0  Cid: 03bc    Peb: 7ffdf000  ParentCid: 01f4
    DirBase: 792b8000  ObjectTable: e17c66d8  HandleCount: 919.
    Image: svchost.exe

PROCESS 897b7d88  SessionId: 0  Cid: 0498    Peb: 7ffdf000  ParentCid: 01f4
    DirBase: 7994a000  ObjectTable: e17c30a8  HandleCount: 130.
    Image: spoolsv.exe

PROCESS 89831d88  SessionId: 0  Cid: 04b4    Peb: 7ffdf000  ParentCid: 01f4
    DirBase: 78f51000  ObjectTable: e1813f48  HandleCount: 165.
    Image: msdtc.exe

第一个：CommandLine:  'C:\WINDOWS\system32\svchost -k rpcss'

0: kd> !peb
PEB at 7ffdf000
    InheritedAddressSpace:    No
    ReadImageFileExecOptions: No
    BeingDebugged:            No
    ImageBaseAddress:         01000000
    NtGlobalFlag:             440000
    NtGlobalFlag2:            0
    Ldr                       77fba600
    Ldr.Initialized:          Yes
    Ldr.InInitializationOrderModuleList: 00182508 . 00182d40
    Ldr.InLoadOrderModuleList:           001824a0 . 00182fb8
    Ldr.InMemoryOrderModuleList:         001824a8 . 00182fc0
            Base TimeStamp                     Module
         1000000 66e5bf0e Sep 15 00:51:26 2024 C:\WINDOWS\system32\svchost.exe
        77f20000 66e651b9 Sep 15 11:17:13 2024 C:\WINDOWS\system32\ntdll.dll
        77e20000 66e651b9 Sep 15 11:17:13 2024 C:\WINDOWS\system32\kernel32.dll
        77d70000 66e651bb Sep 15 11:17:15 2024 C:\WINDOWS\system32\ADVAPI32.dll
        77bd0000 66e651bb Sep 15 11:17:15 2024 C:\WINDOWS\system32\RPCRT4.dll
        74f10000 66e651cf Sep 15 11:17:35 2024 c:\windows\system32\rpcss.dll
        77b00000 66e651bc Sep 15 11:17:16 2024 C:\WINDOWS\system32\msvcrt.dll
        70550000 66e651ed Sep 15 11:18:05 2024 c:\windows\system32\WS2_32.dll
        70540000 66e651ed Sep 15 11:18:05 2024 c:\windows\system32\WS2HELP.dll
        77ca0000 66e651bb Sep 15 11:17:15 2024 C:\WINDOWS\system32\USER32.dll
        77b60000 66e651bb Sep 15 11:17:15 2024 C:\WINDOWS\system32\GDI32.dll
        76c30000 66e651c3 Sep 15 11:17:23 2024 c:\windows\system32\Secur32.dll
        70440000 66e651ed Sep 15 11:18:05 2024 C:\WINDOWS\system32\mswsock.dll
        70400000 66e651ed Sep 15 11:18:05 2024 C:\WINDOWS\System32\wshtcpip.dll
        76c80000 3e801273 Mar 25 16:25:23 2003 C:\WINDOWS\system32\CLBCatQ.DLL
        76df0000 3e801272 Mar 25 16:25:22 2003 C:\WINDOWS\system32\OLEAUT32.dll
        76ed0000 66e651c3 Sep 15 11:17:23 2024 C:\WINDOWS\system32\ole32.dll
        76d20000 3e801273 Mar 25 16:25:23 2003 C:\WINDOWS\system32\COMRes.dll
        77af0000 66e651bc Sep 15 11:17:16 2024 C:\WINDOWS\system32\VERSION.dll
    SubSystemData:     00000000
    ProcessHeap:       00080000
    ProcessParameters: 00020000
    CurrentDirectory:  'C:\WINDOWS\system32\'
    WindowTitle:  'C:\WINDOWS\system32\svchost.exe'
    ImageFile:    'C:\WINDOWS\system32\svchost.exe'
    CommandLine:  'C:\WINDOWS\system32\svchost -k rpcss'

第二个是：CommandLine:  'C:\WINDOWS\System32\svchost.exe -k termsvcs'

0: kd> !peb
PEB at 7ffdf000
    InheritedAddressSpace:    No
    ReadImageFileExecOptions: No
    BeingDebugged:            No
    ImageBaseAddress:         01000000
    NtGlobalFlag:             440000
    NtGlobalFlag2:            0
    Ldr                       77fba600
    Ldr.Initialized:          Yes
    Ldr.InInitializationOrderModuleList: 00182508 . 00183bb8
    Ldr.InLoadOrderModuleList:           001824a0 . 00183c50
    Ldr.InMemoryOrderModuleList:         001824a8 . 00183c58
            Base TimeStamp                     Module
         1000000 66e5bf0e Sep 15 00:51:26 2024 C:\WINDOWS\System32\svchost.exe
        77f20000 66e651b9 Sep 15 11:17:13 2024 C:\WINDOWS\system32\ntdll.dll
        77e20000 66e651b9 Sep 15 11:17:13 2024 C:\WINDOWS\system32\kernel32.dll
        77d70000 66e651bb Sep 15 11:17:15 2024 C:\WINDOWS\system32\ADVAPI32.dll
        77bd0000 66e651bb Sep 15 11:17:15 2024 C:\WINDOWS\system32\RPCRT4.dll
        768a0000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\System32\NTMARTA.DLL
        77b00000 66e651bc Sep 15 11:17:16 2024 C:\WINDOWS\system32\msvcrt.dll
        77ca0000 66e651bb Sep 15 11:17:15 2024 C:\WINDOWS\system32\USER32.dll
        77b60000 66e651bb Sep 15 11:17:15 2024 C:\WINDOWS\system32\GDI32.dll
        76be0000 66e651c3 Sep 15 11:17:23 2024 C:\WINDOWS\system32\WLDAP32.dll
        59730000 66e65595 Sep 15 11:33:41 2024 C:\WINDOWS\System32\SAMLIB.dll
        76ed0000 66e651c3 Sep 15 11:17:23 2024 C:\WINDOWS\system32\ole32.dll
        74870000 66e651d2 Sep 15 11:17:38 2024 c:\windows\system32\termsrv.dll
        74460000 66e651d5 Sep 15 11:17:41 2024 c:\windows\system32\ICAAPI.dll
        76c30000 66e651c3 Sep 15 11:17:23 2024 c:\windows\system32\Secur32.dll
        70550000 66e651ed Sep 15 11:18:05 2024 c:\windows\system32\WS2_32.dll
        70540000 66e651ed Sep 15 11:18:05 2024 c:\windows\system32\WS2HELP.dll
        76df0000 3e801272 Mar 25 16:25:22 2003 C:\WINDOWS\system32\OLEAUT32.dll
        76880000 66e651c5 Sep 15 11:17:25 2024 c:\windows\system32\AUTHZ.dll
        74660000 66e651d3 Sep 15 11:17:39 2024 c:\windows\system32\mstlsapi.dll
        76a80000 66e651c5 Sep 15 11:17:25 2024 c:\windows\system32\ACTIVEDS.dll
        76a50000 66e651c5 Sep 15 11:17:25 2024 c:\windows\system32\adsldpc.dll
        705a0000 66e651ec Sep 15 11:18:04 2024 c:\windows\system32\NETAPI32.dll
        76850000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\system32\imagehlp.dll
        767b0000 66e651c5 Sep 15 11:17:25 2024 c:\windows\system32\credui.dll
        77200000 66e651bc Sep 15 11:17:16 2024 C:\WINDOWS\system32\SHELL32.dll
        770c0000 66e651c2 Sep 15 11:17:22 2024 C:\WINDOWS\system32\SHLWAPI.dll
        76690000 3e801277 Mar 25 16:25:27 2003 c:\windows\system32\ATL.DLL
        75c10000 66e651ca Sep 15 11:17:30 2024 C:\WINDOWS\system32\CRYPT32.dll
        75bf0000 66e651ca Sep 15 11:17:30 2024 C:\WINDOWS\system32\MSASN1.dll
        6f610000 66e651f2 Sep 15 11:18:10 2024 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.100.0_x-ww_8417450B\comctl32.dll
        76740000 66e651c6 Sep 15 11:17:26 2024 C:\WINDOWS\System32\REGAPI.dll
         ffd0000 3e801389 Mar 25 16:30:01 2003 C:\WINDOWS\System32\rsaenh.dll
        767a0000 66e651c6 Sep 15 11:17:26 2024 C:\WINDOWS\System32\PSAPI.DLL
        77af0000 66e651bc Sep 15 11:17:16 2024 C:\WINDOWS\system32\VERSION.dll
        751c0000 66e651ce Sep 15 11:17:34 2024 C:\WINDOWS\system32\USERENV.dll
        70fb0000 66e657c4 Sep 15 11:43:00 2024 C:\WINDOWS\System32\rdpwsx.dll
        71d70000 66e651e4 Sep 15 11:17:56 2024 C:\WINDOWS\System32\WINSPOOL.DRV
    SubSystemData:     00000000
    ProcessHeap:       00080000
    ProcessParameters: 00020000
    CurrentDirectory:  'C:\WINDOWS\system32\'
    WindowTitle:  'C:\WINDOWS\System32\svchost.exe'
    ImageFile:    'C:\WINDOWS\System32\svchost.exe'
    CommandLine:  'C:\WINDOWS\System32\svchost.exe -k termsvcs'
    DllPath:      'C:\WINDOWS\System32;C:\WINDOWS\system32;C:\WINDOWS\system;C:\WINDOWS;.;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem'
    Environment:  00010000
        ALLUSERSPROFILE=C:\Documents and Settings\All Users
        ClusterLog=C:\WINDOWS\Cluster\cluster.log
        CommonProgramFiles=C:\Program Files\Common Files
        COMPUTERNAME=NTDEV-QQTQSNLDX
        ComSpec=C:\WINDOWS\system32\cmd.exe
        NUMBER_OF_PROCESSORS=2
        OS=Windows_NT
        Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
        PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
        PROCESSOR_ARCHITECTURE=x86
        PROCESSOR_IDENTIFIER=x86 Family 6 Model 5 Stepping 3, GenuineIntel
        PROCESSOR_LEVEL=6
        PROCESSOR_REVISION=0503
        ProgramFiles=C:\Program Files
        SystemDrive=C:
        SystemRoot=C:\WINDOWS
        TEMP=C:\WINDOWS\TEMP
        TMP=C:\WINDOWS\TEMP
        USERPROFILE=C:\WINDOWS\system32\config\systemprofile
        windir=C:\WINDOWS

第三个：CommandLine:  'C:\WINDOWS\system32\svchost.exe -k NetworkService'

0: kd> !peb
PEB at 7ffdf000
    InheritedAddressSpace:    No
    ReadImageFileExecOptions: No
    BeingDebugged:            No
    ImageBaseAddress:         01000000
    NtGlobalFlag:             440000
    NtGlobalFlag2:            0
    Ldr                       77fba600
    Ldr.Initialized:          Yes
    Ldr.InInitializationOrderModuleList: 00182508 . 00184180
    Ldr.InLoadOrderModuleList:           001824a0 . 00184170
    Ldr.InMemoryOrderModuleList:         001824a8 . 00184178
            Base TimeStamp                     Module
         1000000 66e5bf0e Sep 15 00:51:26 2024 C:\WINDOWS\system32\svchost.exe
        77f20000 66e651b9 Sep 15 11:17:13 2024 C:\WINDOWS\system32\ntdll.dll
        77e20000 66e651b9 Sep 15 11:17:13 2024 C:\WINDOWS\system32\kernel32.dll
        77d70000 66e651bb Sep 15 11:17:15 2024 C:\WINDOWS\system32\ADVAPI32.dll
        77bd0000 66e651bb Sep 15 11:17:15 2024 C:\WINDOWS\system32\RPCRT4.dll
        76960000 66e651c5 Sep 15 11:17:25 2024 c:\windows\system32\dhcpcsvc.dll
        77b00000 66e651bc Sep 15 11:17:16 2024 C:\WINDOWS\system32\msvcrt.dll
        76b80000 66e651c3 Sep 15 11:17:23 2024 c:\windows\system32\DNSAPI.dll
        70550000 66e651ed Sep 15 11:18:05 2024 c:\windows\system32\WS2_32.dll
        70540000 66e651ed Sep 15 11:18:05 2024 c:\windows\system32\WS2HELP.dll
        76940000 66e651c5 Sep 15 11:17:25 2024 c:\windows\system32\iphlpapi.dll
        77ca0000 66e651bb Sep 15 11:17:15 2024 C:\WINDOWS\system32\USER32.dll
        77b60000 66e651bb Sep 15 11:17:15 2024 C:\WINDOWS\system32\GDI32.dll
        76c30000 66e651c3 Sep 15 11:17:23 2024 c:\windows\system32\Secur32.dll
        761b0000 66e651c8 Sep 15 11:17:28 2024 c:\windows\system32\dnsrslvr.dll
        70440000 66e651ed Sep 15 11:18:05 2024 C:\WINDOWS\system32\mswsock.dll
        70400000 66e651ed Sep 15 11:18:05 2024 C:\WINDOWS\System32\wshtcpip.dll
        769f0000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\system32\netman.dll
        76920000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\system32\MPRAPI.dll
        76a80000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\system32\ACTIVEDS.dll
        76a50000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\system32\adsldpc.dll
        705a0000 66e651ec Sep 15 11:18:04 2024 C:\WINDOWS\system32\NETAPI32.dll
        76be0000 66e651c3 Sep 15 11:17:23 2024 C:\WINDOWS\system32\WLDAP32.dll
        76850000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\system32\imagehlp.dll
        767b0000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\system32\credui.dll
        77200000 66e651bc Sep 15 11:17:16 2024 C:\WINDOWS\system32\SHELL32.dll
        770c0000 66e651c2 Sep 15 11:17:22 2024 C:\WINDOWS\system32\SHLWAPI.dll
        76690000 3e801277 Mar 25 16:25:27 2003 C:\WINDOWS\system32\ATL.DLL
        76ed0000 66e651c3 Sep 15 11:17:23 2024 C:\WINDOWS\system32\ole32.dll
        76df0000 3e801272 Mar 25 16:25:22 2003 C:\WINDOWS\system32\OLEAUT32.dll
        76ac0000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\system32\rtutils.dll
        59730000 66e65595 Sep 15 11:33:41 2024 C:\WINDOWS\system32\SAMLIB.dll
        76070000 66e651c8 Sep 15 11:17:28 2024 C:\WINDOWS\system32\SETUPAPI.dll
        76b30000 66e651c4 Sep 15 11:17:24 2024 C:\WINDOWS\system32\RASAPI32.dll
        76ad0000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\system32\rasman.dll
        76af0000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\system32\TAPI32.dll
        766b0000 66e651c7 Sep 15 11:17:27 2024 C:\WINDOWS\system32\WINMM.dll
        75c10000 66e651ca Sep 15 11:17:30 2024 C:\WINDOWS\system32\CRYPT32.dll
        75bf0000 66e651ca Sep 15 11:17:30 2024 C:\WINDOWS\system32\MSASN1.dll
        76990000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\system32\WZCSvc.DLL
        76910000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\system32\WMI.dll
        76bd0000 66e651c3 Sep 15 11:17:23 2024 C:\WINDOWS\system32\WTSAPI32.dll
        75cd0000 66e651ca Sep 15 11:17:30 2024 C:\WINDOWS\system32\WINSTA.dll
        67440000 66e6524a Sep 15 11:19:38 2024 C:\WINDOWS\system32\ESENT.dll
        71da0000 66e651e4 Sep 15 11:17:56 2024 C:\WINDOWS\system32\WZCSAPI.DLL
        6f610000 66e651f2 Sep 15 11:18:10 2024 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.100.0_x-ww_8417450B\comctl32.dll
    SubSystemData:     00000000
    ProcessHeap:       00080000
    ProcessParameters: 00020000
    CurrentDirectory:  'C:\WINDOWS\system32\'
    WindowTitle:  'C:\WINDOWS\system32\svchost.exe'
    ImageFile:    'C:\WINDOWS\system32\svchost.exe'
    CommandLine:  'C:\WINDOWS\system32\svchost.exe -k NetworkService'

第四个：CommandLine:  'C:\WINDOWS\system32\svchost.exe -k LocalService'

0: kd> !peb
PEB at 7ffdf000
    InheritedAddressSpace:    No
    ReadImageFileExecOptions: No
    BeingDebugged:            No
    ImageBaseAddress:         01000000
    NtGlobalFlag:             440000
    NtGlobalFlag2:            0
    Ldr                       77fba600
    Ldr.Initialized:          Yes
    Ldr.InInitializationOrderModuleList: 00182508 . 00182bf8
    Ldr.InLoadOrderModuleList:           001824a0 . 00182dd0
    Ldr.InMemoryOrderModuleList:         001824a8 . 00182dd8
            Base TimeStamp                     Module
         1000000 66e5bf0e Sep 15 00:51:26 2024 C:\WINDOWS\system32\svchost.exe
        77f20000 66e651b9 Sep 15 11:17:13 2024 C:\WINDOWS\system32\ntdll.dll
        77e20000 66e651b9 Sep 15 11:17:13 2024 C:\WINDOWS\system32\kernel32.dll
        77d70000 66e651bb Sep 15 11:17:15 2024 C:\WINDOWS\system32\ADVAPI32.dll
        77bd0000 66e651bb Sep 15 11:17:15 2024 C:\WINDOWS\system32\RPCRT4.dll
        768a0000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\system32\NTMARTA.DLL
        77b00000 66e651bc Sep 15 11:17:16 2024 C:\WINDOWS\system32\msvcrt.dll
        77ca0000 66e651bb Sep 15 11:17:15 2024 C:\WINDOWS\system32\USER32.dll
        77b60000 66e651bb Sep 15 11:17:15 2024 C:\WINDOWS\system32\GDI32.dll
        76be0000 66e651c3 Sep 15 11:17:23 2024 C:\WINDOWS\system32\WLDAP32.dll
        59730000 66e65595 Sep 15 11:33:41 2024 C:\WINDOWS\system32\SAMLIB.dll
        76ed0000 66e651c3 Sep 15 11:17:23 2024 C:\WINDOWS\system32\ole32.dll
        73fa0000 66e651d7 Sep 15 11:17:43 2024 c:\windows\system32\lmhsvc.dll
        76940000 66e651c5 Sep 15 11:17:25 2024 c:\windows\system32\iphlpapi.dll
        70550000 66e651ed Sep 15 11:18:05 2024 c:\windows\system32\WS2_32.dll
        70540000 66e651ed Sep 15 11:18:05 2024 c:\windows\system32\WS2HELP.dll
    SubSystemData:     00000000
    ProcessHeap:       00080000
    ProcessParameters: 00020000
    CurrentDirectory:  'C:\WINDOWS\system32\'
    WindowTitle:  'C:\WINDOWS\system32\svchost.exe'
    ImageFile:    'C:\WINDOWS\system32\svchost.exe'
    CommandLine:  'C:\WINDOWS\system32\svchost.exe -k LocalService'
    DllPath:      'C:\WINDOWS\system32;C:\WINDOWS\system32;C:\WINDOWS\system;C:\WINDOWS;.;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem'
    Environment:  00010000
        ALLUSERSPROFILE=C:\Documents and Settings\All Users
        ClusterLog=C:\WINDOWS\Cluster\cluster.log
        CommonProgramFiles=C:\Program Files\Common Files
        COMPUTERNAME=NTDEV-QQTQSNLDX
        ComSpec=C:\WINDOWS\system32\cmd.exe
        NUMBER_OF_PROCESSORS=2
        OS=Windows_NT
        Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
        PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
        PROCESSOR_ARCHITECTURE=x86
        PROCESSOR_IDENTIFIER=x86 Family 6 Model 5 Stepping 3, GenuineIntel
        PROCESSOR_LEVEL=6
        PROCESSOR_REVISION=0503
        ProgramFiles=C:\Program Files
        SystemDrive=C:
        SystemRoot=C:\WINDOWS
        TEMP=C:\DOCUME~1\LOCALS~1\LOCALS~1\Temp
        TMP=C:\DOCUME~1\LOCALS~1\LOCALS~1\Temp
        USERDOMAIN=NT AUTHORITY
        USERNAME=LOCAL SERVICE
        USERPROFILE=C:\Documents and Settings\LocalService
        windir=C:\WINDOWS

第五个： CommandLine:  'C:\WINDOWS\System32\svchost.exe -k netsvcs'

0: kd> !peb
PEB at 7ffdf000
    InheritedAddressSpace:    No
    ReadImageFileExecOptions: No
    BeingDebugged:            No
    ImageBaseAddress:         01000000
    NtGlobalFlag:             440000
    NtGlobalFlag2:            0
    Ldr                       77fba600
    Ldr.Initialized:          Yes
    Ldr.InInitializationOrderModuleList: 00182508 . 00186bc0
    Ldr.InLoadOrderModuleList:           001824a0 . 00186c50
    Ldr.InMemoryOrderModuleList:         001824a8 . 00186c58
            Base TimeStamp                     Module
         1000000 66e5bf0e Sep 15 00:51:26 2024 C:\WINDOWS\System32\svchost.exe
        77f20000 66e651b9 Sep 15 11:17:13 2024 C:\WINDOWS\system32\ntdll.dll
        77e20000 66e651b9 Sep 15 11:17:13 2024 C:\WINDOWS\system32\kernel32.dll
        77d70000 66e651bb Sep 15 11:17:15 2024 C:\WINDOWS\system32\ADVAPI32.dll
        77bd0000 66e651bb Sep 15 11:17:15 2024 C:\WINDOWS\system32\RPCRT4.dll
        768a0000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\System32\NTMARTA.DLL
        77b00000 66e651bc Sep 15 11:17:16 2024 C:\WINDOWS\system32\msvcrt.dll
        77ca0000 66e651bb Sep 15 11:17:15 2024 C:\WINDOWS\system32\USER32.dll
        77b60000 66e651bb Sep 15 11:17:15 2024 C:\WINDOWS\system32\GDI32.dll
        76be0000 66e651c3 Sep 15 11:17:23 2024 C:\WINDOWS\system32\WLDAP32.dll
        59730000 66e65595 Sep 15 11:33:41 2024 C:\WINDOWS\System32\SAMLIB.dll
        76ed0000 66e651c3 Sep 15 11:17:23 2024 C:\WINDOWS\system32\ole32.dll
        76990000 66e651c5 Sep 15 11:17:25 2024 c:\windows\system32\wzcsvc.dll
        76ac0000 66e651c5 Sep 15 11:17:25 2024 c:\windows\system32\rtutils.dll
        76910000 66e651c5 Sep 15 11:17:25 2024 c:\windows\system32\WMI.dll
        76960000 66e651c5 Sep 15 11:17:25 2024 c:\windows\system32\DHCPCSVC.DLL
        76b80000 66e651c3 Sep 15 11:17:23 2024 c:\windows\system32\DNSAPI.dll
        70550000 66e651ed Sep 15 11:18:05 2024 c:\windows\system32\WS2_32.dll
        70540000 66e651ed Sep 15 11:18:05 2024 c:\windows\system32\WS2HELP.dll
        76940000 66e651c5 Sep 15 11:17:25 2024 c:\windows\system32\iphlpapi.dll
        76c30000 66e651c3 Sep 15 11:17:23 2024 c:\windows\system32\Secur32.dll
        76df0000 3e801272 Mar 25 16:25:22 2003 C:\WINDOWS\system32\OLEAUT32.dll
        75c10000 66e651ca Sep 15 11:17:30 2024 C:\WINDOWS\system32\CRYPT32.dll
        75bf0000 66e651ca Sep 15 11:17:30 2024 C:\WINDOWS\system32\MSASN1.dll
        76bd0000 66e651c3 Sep 15 11:17:23 2024 c:\windows\system32\WTSAPI32.dll
        75cd0000 66e651ca Sep 15 11:17:30 2024 c:\windows\system32\WINSTA.dll
        705a0000 66e651ec Sep 15 11:18:04 2024 c:\windows\system32\NETAPI32.dll
        770c0000 66e651c2 Sep 15 11:17:22 2024 C:\WINDOWS\system32\SHLWAPI.dll
        67440000 66e6524a Sep 15 11:19:38 2024 c:\windows\system32\ESENT.dll
        743c0000 66e651d5 Sep 15 11:17:41 2024 C:\WINDOWS\System32\rastls.dll
        76690000 3e801277 Mar 25 16:25:27 2003 C:\WINDOWS\System32\ATL.DLL
        74ad0000 66e651d0 Sep 15 11:17:36 2024 C:\WINDOWS\System32\CRYPTUI.dll
        767f0000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\System32\WINTRUST.dll
        76850000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\system32\imagehlp.dll
        761f0000 66e651c8 Sep 15 11:17:28 2024 C:\WINDOWS\System32\NTDSAPI.dll
        76920000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\System32\MPRAPI.dll
        76a80000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\System32\ACTIVEDS.dll
        76a50000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\System32\adsldpc.dll
        767b0000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\System32\credui.dll
        77200000 66e651bc Sep 15 11:17:16 2024 C:\WINDOWS\system32\SHELL32.dll
        76070000 66e651c8 Sep 15 11:17:28 2024 C:\WINDOWS\System32\SETUPAPI.dll
        76b30000 66e651c4 Sep 15 11:17:24 2024 C:\WINDOWS\System32\RASAPI32.dll
        76ad0000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\System32\rasman.dll
        76af0000 66e651c5 Sep 15 11:17:25 2024 C:\WINDOWS\System32\TAPI32.dll
        766b0000 66e651c7 Sep 15 11:17:27 2024 C:\WINDOWS\System32\WINMM.dll
        76260000 66e651c8 Sep 15 11:17:28 2024 C:\WINDOWS\System32\SCHANNEL.dll
        751c0000 66e651ce Sep 15 11:17:34 2024 C:\WINDOWS\system32\USERENV.dll
        70f10000 66e651e8 Sep 15 11:18:00 2024 C:\WINDOWS\System32\WinSCard.dll
        6f730000 66e651f2 Sep 15 11:18:10 2024 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_5.82.0.0_x-ww_8A69BA05\COMCTL32.dll
        6f610000 66e651f2 Sep 15 11:18:10 2024 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.100.0_x-ww_8417450B\Comctl32.dll
        743f0000 66e651d5 Sep 15 11:17:41 2024 C:\WINDOWS\System32\raschap.dll
        76760000 66e651c6 Sep 15 11:17:26 2024 c:\windows\system32\shsvcs.dll
        76c80000 3e801273 Mar 25 16:25:23 2003 C:\WINDOWS\System32\CLBCatQ.DLL
        76d20000 3e801273 Mar 25 16:25:23 2003 C:\WINDOWS\System32\COMRes.dll
        77af0000 66e651bc Sep 15 11:17:16 2024 C:\WINDOWS\system32\VERSION.dll
        74740000 66e651d2 Sep 15 11:17:38 2024 c:\windows\system32\schedsvc.dll
        76880000 66e651c5 Sep 15 11:17:25 2024 c:\windows\system32\AUTHZ.dll
        70440000 66e651ed Sep 15 11:18:05 2024 C:\WINDOWS\System32\mswsock.dll
        70400000 66e651ed Sep 15 11:18:05 2024 C:\WINDOWS\System32\wshtcpip.dll
        74430000 66e651d5 Sep 15 11:17:41 2024 C:\WINDOWS\System32\MSIDLE.DLL
        6f120000 66e65204 Sep 15 11:18:28 2024 c:\windows\system32\audiosrv.dll
        746c0000 66e651d3 Sep 15 11:17:39 2024 c:\windows\system32\wkssvc.dll
        564a0000 66e655a5 Sep 15 11:33:57 2024 C:\WINDOWS\System32\wiarpc.dll
        74490000 66e651d4 Sep 15 11:17:40 2024 c:\windows\system32\cryptsvc.dll
        74910000 66e651d1 Sep 15 11:17:37 2024 c:\windows\system32\certcli.dll
        767a0000 66e651c6 Sep 15 11:17:26 2024 c:\windows\system32\PSAPI.DLL
        58130000 66e65582 Sep 15 11:33:22 2024 c:\windows\system32\VSSAPI.DLL
        76730000 66e651c7 Sep 15 11:17:27 2024 c:\windows\system32\sfc.dll
        76820000 66e651c5 Sep 15 11:17:25 2024 c:\windows\system32\sfc_os.dll
        74480000 66e651d5 Sep 15 11:17:41 2024 c:\windows\system32\dmserver.dll
        766f0000 3e801277 Mar 25 16:25:27 2003 c:\windows\system32\es.dll
        74410000 66e651d5 Sep 15 11:17:41 2024 c:\windows\pchealth\helpctr\binaries\pchsvc.dll
        745d0000 66e651d3 Sep 15 11:17:39 2024 c:\windows\system32\srvsvc.dll
        72b50000 66e651de Sep 15 11:17:50 2024 c:\windows\system32\seclogon.dll
        70db0000 66e651e9 Sep 15 11:18:01 2024 c:\windows\system32\sens.dll
        745a0000 66e651d3 Sep 15 11:17:39 2024 c:\windows\system32\trkwks.dll
        76210000 66e651c8 Sep 15 11:17:28 2024 c:\windows\system32\w32time.dll
        780c0000 3cf54155 May 30 05:00:05 2002 c:\windows\system32\MSVCP60.dll
        54f90000 66e655af Sep 15 11:34:07 2024 c:\windows\system32\wbem\wmisvc.dll
        74370000 66e651d6 Sep 15 11:17:42 2024 c:\windows\system32\wuauserv.dll
        744f0000 66e651d4 Sep 15 11:17:40 2024 C:\WINDOWS\System32\wuaueng.dll
        74800000 66e651d2 Sep 15 11:17:38 2024 C:\WINDOWS\System32\ADVPACK.dll
        75b30000 66e651ca Sep 15 11:17:30 2024 C:\WINDOWS\system32\WININET.dll
        76c50000 66e651c3 Sep 15 11:17:23 2024 C:\WINDOWS\System32\winrnr.dll
        744d0000 66e651d4 Sep 15 11:17:40 2024 c:\windows\system32\browser.dll
        756d0000 66e651cc Sep 15 11:17:32 2024 C:\WINDOWS\System32\SXS.DLL
        74db0000 3e801284 Mar 25 16:25:40 2003 C:\WINDOWS\System32\comsvcs.dll
        74a50000 66e651d1 Sep 15 11:17:37 2024 C:\WINDOWS\System32\Wbem\wbemcore.dll
        748d0000 66e651d2 Sep 15 11:17:38 2024 C:\WINDOWS\System32\Wbem\esscli.dll
        74830000 66e651d2 Sep 15 11:17:38 2024 C:\WINDOWS\System32\Wbem\wbemcomn.dll
        74d30000 66e651cf Sep 15 11:17:35 2024 C:\WINDOWS\System32\Wbem\FastProx.dll
        74380000 66e651d5 Sep 15 11:17:41 2024 C:\WINDOWS\system32\wbem\wbemsvc.dll
        74540000 66e651d4 Sep 15 11:17:40 2024 C:\WINDOWS\system32\wbem\wmiutils.dll
        74790000 66e651d2 Sep 15 11:17:38 2024 C:\WINDOWS\system32\wbem\repdrvfs.dll
        54ff0000 66e655ac Sep 15 11:34:04 2024 C:\WINDOWS\system32\wbem\wmiprvsd.dll
        5c830000 66e65578 Sep 15 11:33:12 2024 C:\WINDOWS\system32\NCObjAPI.DLL
        74970000 66e651d1 Sep 15 11:17:37 2024 C:\WINDOWS\system32\wbem\wbemess.dll
         ffd0000 3e801389 Mar 25 16:30:01 2003 C:\WINDOWS\System32\rsaenh.dll
        70690000 66e651ec Sep 15 11:18:04 2024 C:\WINDOWS\system32\actxprxy.dll
        769f0000 66e651c5 Sep 15 11:17:25 2024 c:\windows\system32\netman.dll
        71da0000 66e651e4 Sep 15 11:17:56 2024 c:\windows\system32\WZCSAPI.DLL
        754a0000 66e651cd Sep 15 11:17:33 2024 C:\WINDOWS\system32\NETSHELL.dll
        744b0000 66e651d4 Sep 15 11:17:40 2024 C:\WINDOWS\system32\CLUSAPI.dll
        74c00000 66e651d0 Sep 15 11:17:36 2024 C:\WINDOWS\system32\netcfgx.dll
        730e0000 66e651dc Sep 15 11:17:48 2024 C:\WINDOWS\system32\WINIPSEC.DLL
        65f50000 66e6522c Sep 15 11:19:08 2024 C:\WINDOWS\system32\hnetcfg.dll
        74390000 66e651d5 Sep 15 11:17:41 2024 C:\WINDOWS\system32\wbem\wbemprox.dll
        74b50000 66e651d0 Sep 15 11:17:36 2024 C:\WINDOWS\System32\RASDLG.dll
        76c70000 66e651c3 Sep 15 11:17:23 2024 C:\WINDOWS\System32\rasadhlp.dll
        6f7f0000 66e651f2 Sep 15 11:18:10 2024 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.WinHTTP_6595b64144ccf1df_5.1.0.0_x-ww_E0651936\winhttp.dll
        6ba20000 66e65213 Sep 15 11:18:43 2024 C:\WINDOWS\System32\dbghelp.dll
    SubSystemData:     00000000
    ProcessHeap:       00080000
    ProcessParameters: 00020000
    CurrentDirectory:  'C:\WINDOWS\system32\'
    WindowTitle:  'C:\WINDOWS\System32\svchost.exe'
    ImageFile:    'C:\WINDOWS\System32\svchost.exe'
    CommandLine:  'C:\WINDOWS\System32\svchost.exe -k netsvcs'
    DllPath:      'C:\WINDOWS\System32;C:\WINDOWS\system32;C:\WINDOWS\system;C:\WINDOWS;.;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem'
    Environment:  00010000
        ALLUSERSPROFILE=C:\Documents and Settings\All Users
        ClusterLog=C:\WINDOWS\Cluster\cluster.log
        CommonProgramFiles=C:\Program Files\Common Files
        COMPUTERNAME=NTDEV-QQTQSNLDX
        ComSpec=C:\WINDOWS\system32\cmd.exe
        NUMBER_OF_PROCESSORS=2
        OS=Windows_NT
        Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
        PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
        PROCESSOR_ARCHITECTURE=x86
        PROCESSOR_IDENTIFIER=x86 Family 6 Model 5 Stepping 3, GenuineIntel
        PROCESSOR_LEVEL=6
        PROCESSOR_REVISION=0503
        ProgramFiles=C:\Program Files
        SystemDrive=C:
        SystemRoot=C:\WINDOWS
        TEMP=C:\WINDOWS\TEMP
        TMP=C:\WINDOWS\TEMP
        USERPROFILE=C:\Documents and Settings\LocalService
        windir=C:\WINDOWS