HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\1394ohci
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\1394ohci.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ACPI
    ImagePath    REG_EXPAND_SZ    system32\drivers\ACPI.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AcpiPmi
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\acpipmi.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\adp94xx
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\adp94xx.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\adpahci
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\adpahci.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\adpu320
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\adpu320.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ADWS
    ImagePath    REG_EXPAND_SZ    %systemroot%\ADWS\Microsoft.ActiveDirectory.WebServices.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AeLookupSvc
    ImagePath    REG_EXPAND_SZ    %systemroot%\system32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\afd.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\agp440
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\agp440.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aksdf
    ImagePath    REG_EXPAND_SZ    \??\C:\Windows\system32\drivers\aksdf.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aksfridge
    ImagePath    REG_EXPAND_SZ    \??\C:\Windows\system32\drivers\aksfridge.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ALG
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\alg.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aliide
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\aliide.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amdide
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\amdide.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AmdK8
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\amdk8.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AmdPPM
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\amdppm.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amdsata
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\amdsata.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amdsbs
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\amdsbs.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amdxata
    ImagePath    REG_EXPAND_SZ    system32\drivers\amdxata.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppID
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\appid.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppIDSvc
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Appinfo
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AppMgmt
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\arc
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\arc.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\arcsas
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\arcsas.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ASTGraphics
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\astgrp.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AsyncMac
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\asyncmac.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\atapi
    ImagePath    REG_EXPAND_SZ    system32\drivers\atapi.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AudioEndpointBuilder
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AudioSrv
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\b06bdrv
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\bxvbda.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\b57nd60a
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\b57nd60a.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BFE
    ImagePath    REG_EXPAND_SZ    %systemroot%\system32\svchost.exe -k LocalServiceNoNetwork

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\blbdrive
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\blbdrive.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bowser
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\bowser.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BrFiltLo
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\BrFiltLo.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BrFiltUp
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\BrFiltUp.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Brserid
    ImagePath    REG_EXPAND_SZ    \SystemRoot\System32\Drivers\Brserid.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BrSerWdm
    ImagePath    REG_EXPAND_SZ    \SystemRoot\System32\Drivers\BrSerWdm.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BrUsbMdm
    ImagePath    REG_EXPAND_SZ    \SystemRoot\System32\Drivers\BrUsbMdm.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BrUsbSer
    ImagePath    REG_EXPAND_SZ    \SystemRoot\System32\Drivers\BrUsbSer.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cdfs
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\cdfs.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cdrom
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\cdrom.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertPropSvc
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CISVC
    ImagePath    REG_EXPAND_SZ    %systemroot%\system32\CISVC.EXE

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CLFS
    ImagePath    REG_EXPAND_SZ    System32\CLFS.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\clr_optimization_v2.0.50727_32
    ImagePath    REG_EXPAND_SZ    %systemroot%\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\clr_optimization_v2.0.50727_64
    ImagePath    REG_EXPAND_SZ    %systemroot%\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CmBatt
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\CmBatt.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdide
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\cmdide.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CNG
    ImagePath    REG_EXPAND_SZ    System32\Drivers\cng.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Compbatt
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\compbatt.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CompositeBus
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\CompositeBus.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\COMSysApp
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\crcdisk
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\crcdisk.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CryptSvc
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k NetworkService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DcomLaunch
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k DcomLaunch

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\defragsvc
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k defragsvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dfs
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\dfssvc.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DfsC
    ImagePath    REG_EXPAND_SZ    System32\Drivers\dfsc.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DfsDriver
    ImagePath    REG_EXPAND_SZ    system32\drivers\dfs.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DFSR
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\DFSRs.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DfsrRo
    ImagePath    REG_EXPAND_SZ    system32\drivers\dfsrro.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dhcp
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\discache
    ImagePath    REG_EXPAND_SZ    System32\drivers\discache.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Disk
    ImagePath    REG_EXPAND_SZ    system32\drivers\disk.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dmvsc
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\dmvsc.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS
    ImagePath    REG_EXPAND_SZ    %systemroot%\system32\dns.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k NetworkService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\dot3svc
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DPS
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k LocalServiceNoNetwork

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DXGKrnl
    ImagePath    REG_EXPAND_SZ    \SystemRoot\System32\drivers\dxgkrnl.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\e1rexpress
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\e1r62x64.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EapHost
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ebdrv
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\evbda.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EFS
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\lsass.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\elxstor
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\elxstor.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ErrDev
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\errdev.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\eventlog
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventSystem
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FCRegSvc
    ImagePath    REG_EXPAND_SZ    %systemroot%\system32\svchost.exe -k LocalServiceNetworkRestricted

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fdc
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\fdc.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fdPHost
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FDResPub
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FileInfo
    ImagePath    REG_EXPAND_SZ    system32\drivers\fileinfo.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Filetrace
    ImagePath    REG_EXPAND_SZ    system32\drivers\filetrace.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FirebirdGuardianDefaultInstance
    ImagePath    REG_EXPAND_SZ    C:\Program Files (x86)\Firebird\Firebird_2_0\bin\fbguard.exe -s

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FirebirdServerDefaultInstance
    ImagePath    REG_EXPAND_SZ    C:\Program Files (x86)\Firebird\Firebird_2_0\bin\fbserver.exe -s

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\flpydisk
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\flpydisk.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FltMgr
    ImagePath    REG_EXPAND_SZ    system32\drivers\fltmgr.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FontCache
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FontCache3.0.0.0
    ImagePath    REG_EXPAND_SZ    %systemroot%\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FsDepends
    ImagePath    REG_EXPAND_SZ    System32\drivers\FsDepends.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gagp30kx
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\gagp30kx.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gpsvc
    ImagePath    REG_EXPAND_SZ    %systemroot%\system32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hardlock
    ImagePath    REG_EXPAND_SZ    \??\C:\Windows\system32\drivers\hardlock.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hasplms
    ImagePath    REG_EXPAND_SZ    C:\Windows\system32\hasplms.exe  -run

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HDAudBus
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\HDAudBus.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HidBatt
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\HidBatt.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hidserv
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HidUsb
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\hidusb.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hkmsvc
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HpSAMD
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\HpSAMD.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP
    ImagePath    REG_EXPAND_SZ    system32\drivers\HTTP.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hvboot
    ImagePath    REG_EXPAND_SZ    system32\drivers\hvboot.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hwpolicy
    ImagePath    REG_EXPAND_SZ    System32\drivers\hwpolicy.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\i8042prt.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iaStorA
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\iaStorA.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iaStorF
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\iaStorF.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iaStorS
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\iaStorS.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iaStorV
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\iaStorV.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\idsvc
    ImagePath    REG_EXPAND_SZ    "%systemroot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iirsp
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\iirsp.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IKEEXT
    ImagePath    REG_EXPAND_SZ    %systemroot%\system32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Intel(R) PROSet Monitoring Service
    ImagePath    REG_EXPAND_SZ    C:\Windows\system32\IProsetMonitor.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\intelide
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\intelide.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\intelppm
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\intelppm.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ioatdma
    ImagePath    REG_EXPAND_SZ    \SystemRoot\System32\Drivers\qd260x64.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPBusEnum
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IpFilterDriver
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\ipfltdrv.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iphlpsvc
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k NetSvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPMIDRV
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\IPMIDrv.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPNAT
    ImagePath    REG_EXPAND_SZ    System32\drivers\ipnat.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\isapnp
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\isapnp.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iScsiPrt
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\msiscsi.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IsmServ
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\ismserv.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iusb3hub
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\iusb3hub.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iusb3xhc
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\iusb3xhc.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdclass
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\kbdclass.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\kbdhid.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kdc
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\lsass.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KeyIso
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\lsass.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KSecDD
    ImagePath    REG_EXPAND_SZ    System32\Drivers\ksecdd.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KSecPkg
    ImagePath    REG_EXPAND_SZ    System32\Drivers\ksecpkg.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ksthunk
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\ksthunk.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KtmRm
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k NetworkServiceAndNoImpersonation

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k NetworkService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lltdio
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\lltdio.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lltdsvc
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k LocalService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lmhosts
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalServiceNetworkRestricted

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LSClientService
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k lsclientservice

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LSI_FC
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\lsi_fc.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LSI_SAS
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\lsi_sas.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LSI_SAS2
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\lsi_sas2.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LSI_SCSI
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\lsi_scsi.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\luafv
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\luafv.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\megasas
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\megasas.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MegaSR
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\MegaSR.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MMCSS
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Modem
    ImagePath    REG_EXPAND_SZ    system32\drivers\modem.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\monitor
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\monitor.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mouclass
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\mouclass.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mouhid
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\mouhid.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mountmgr
    ImagePath    REG_EXPAND_SZ    System32\drivers\mountmgr.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mpio
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\mpio.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mpsdrv
    ImagePath    REG_EXPAND_SZ    System32\drivers\mpsdrv.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MpsSvc
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalServiceNoNetwork

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mrxsmb
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\mrxsmb.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mrxsmb10
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\mrxsmb10.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mrxsmb20
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\mrxsmb20.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msahci
    ImagePath    REG_EXPAND_SZ    system32\drivers\msahci.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msdsm
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\msdsm.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSDTC
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\msdtc.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mshidkmdf
    ImagePath    REG_EXPAND_SZ    \SystemRoot\System32\drivers\mshidkmdf.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msisadrv
    ImagePath    REG_EXPAND_SZ    system32\drivers\msisadrv.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSiSCSI
    ImagePath    REG_EXPAND_SZ    %systemroot%\system32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\msiserver
    ImagePath    REG_EXPAND_SZ    %systemroot%\system32\msiexec.exe /V

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mssmbios
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\mssmbios.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MTConfig
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\MTConfig.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mup
    ImagePath    REG_EXPAND_SZ    System32\Drivers\mup.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\napagent
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k NetworkService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NDIS
    ImagePath    REG_EXPAND_SZ    system32\drivers\ndis.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisCap
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\ndiscap.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisTapi
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\ndistapi.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ndisuio
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\ndisuio.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NdisWan
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\ndiswan.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Net Driver HPZ12
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k HPZ12

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBIOS
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\netbios.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT
    ImagePath    REG_EXPAND_SZ    System32\DRIVERS\netbt.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon
    ImagePath    REG_EXPAND_SZ    %systemroot%\system32\lsass.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netman
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\netprofm
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k LocalService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetTcpPortSharing
    ImagePath    REG_EXPAND_SZ    "%systemroot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nfrd960
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\nfrd960.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k NetworkService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nsi
    ImagePath    REG_EXPAND_SZ    %systemroot%\system32\svchost.exe -k LocalService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nsiproxy
    ImagePath    REG_EXPAND_SZ    system32\drivers\nsiproxy.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\lsass.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NtFrs
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\ntfrs.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nvraid
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\nvraid.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nvspwmi
    ImagePath    REG_EXPAND_SZ    %systemroot%\system32\svchost -k nvspwmi

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nvstor
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\nvstor.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nv_agp
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\nv_agp.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\odserv
    ImagePath    REG_EXPAND_SZ    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ohci1394
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\ohci1394.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ose
    ImagePath    REG_EXPAND_SZ    "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Parport
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\parport.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\partmgr
    ImagePath    REG_EXPAND_SZ    System32\drivers\partmgr.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\passthruparser
    ImagePath    REG_EXPAND_SZ    system32\drivers\passthruparser.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pci
    ImagePath    REG_EXPAND_SZ    system32\drivers\pci.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pciide
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\pciide.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pcmcia
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\pcmcia.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pcw
    ImagePath    REG_EXPAND_SZ    System32\drivers\pcw.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PEAUTH
    ImagePath    REG_EXPAND_SZ    system32\drivers\peauth.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfHost
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\SysWow64\perfhost.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pla
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k LocalServiceNoNetwork

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PlugPlay
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k DcomLaunch

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Pml Driver HPZ12
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k HPZ12

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k NetworkServiceNetworkRestricted

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Power
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k DcomLaunch

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PptpMiniport
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\raspptp.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Processor
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\processr.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProfSvc
    ImagePath    REG_EXPAND_SZ    %systemroot%\system32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ProtectedStorage
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\lsass.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Psched
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\pacer.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql2300
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\ql2300.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ql40xx
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\ql40xx.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAcd
    ImagePath    REG_EXPAND_SZ    System32\DRIVERS\rasacd.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAgileVpn
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\AgileVpn.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasAuto
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rasl2tp
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\rasl2tp.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasPppoe
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\raspppoe.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasSstp
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\rassstp.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdbss
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\rdbss.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdpbus
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\rdpbus.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPCDD
    ImagePath    REG_EXPAND_SZ    System32\DRIVERS\RDPCDD.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPDR
    ImagePath    REG_EXPAND_SZ    System32\drivers\rdpdr.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPENCDD
    ImagePath    REG_EXPAND_SZ    system32\drivers\rdpencdd.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RDPREFMP
    ImagePath    REG_EXPAND_SZ    system32\drivers\rdprefmp.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rdvgsm
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k regsvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcEptMapper
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k RPCSS

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcLocator
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\locator.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k rpcss

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RSoPProv
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\RSoPProv.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rspndr
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\rspndr.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\s3cap
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\vms3cap.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sacdrv
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\sacdrv.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sacsvr
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SamSs
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\lsass.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sbp2port
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\sbp2port.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SCardSvr
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\scfilter
    ImagePath    REG_EXPAND_SZ    System32\DRIVERS\scfilter.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Schedule
    ImagePath    REG_EXPAND_SZ    %systemroot%\system32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SCPolicySvc
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seclogon
    ImagePath    REG_EXPAND_SZ    %windir%\system32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SENS
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serenum
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\serenum.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Serial
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\serial.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sermouse
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\sermouse.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SessionEnv
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sffdisk
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\sffdisk.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sffp_mmc
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\sffp_mmc.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sffp_sd
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\sffp_sd.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sfloppy
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\sfloppy.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ShellHWDetection
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SiSRaid2
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\SiSRaid2.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SiSRaid4
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\sisraid4.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Smb
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\smb.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMPTRAP
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\snmptrap.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Spooler
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\spoolsv.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sppsvc
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\sppsvc.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sppuinotify
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srv
    ImagePath    REG_EXPAND_SZ    System32\DRIVERS\srv.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srv2
    ImagePath    REG_EXPAND_SZ    System32\DRIVERS\srv2.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srvnet
    ImagePath    REG_EXPAND_SZ    System32\DRIVERS\srvnet.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SSDPSRV
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SstpSvc
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\stexstor
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\stexstor.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\storflt
    ImagePath    REG_EXPAND_SZ    system32\drivers\vmstorfl.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\storvsc
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\storvsc.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\storvsp
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\storvsp.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swenum
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\swenum.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\swprv
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k swprv

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\synth3dvsp
    ImagePath    REG_EXPAND_SZ    System32\drivers\synth3dvsp.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TapiSrv
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k tapisrv

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TBS
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k LocalServiceAndNoImpersonation

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip
    ImagePath    REG_EXPAND_SZ    System32\drivers\tcpip.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TCPIP6
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\tcpip.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tcpipreg
    ImagePath    REG_EXPAND_SZ    System32\drivers\tcpipreg.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDPIPE
    ImagePath    REG_EXPAND_SZ    system32\drivers\tdpipe.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDTCP
    ImagePath    REG_EXPAND_SZ    system32\drivers\tdtcp.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdx
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\tdx.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermDD
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\termdd.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermService
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k termsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TermServLicensing
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost -k TSLicensing

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\THREADORDER
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrkWks
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TrustedInstaller
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\servicing\TrustedInstaller.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tssecsrv
    ImagePath    REG_EXPAND_SZ    System32\DRIVERS\tssecsrv.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TsUsbFlt
    ImagePath    REG_EXPAND_SZ    system32\drivers\tsusbflt.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TsUsbGD
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\TsUsbGD.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tunnel
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\tunnel.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\uagp35
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\uagp35.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\udfs
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\udfs.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UI0Detect
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\UI0Detect.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\uliagpkx
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\uliagpkx.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\umbus
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\umbus.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UmPass
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\umpass.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UmRdpService
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\upnphost
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalServiceAndNoImpersonation

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbccgp
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\usbccgp.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbehci
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\usbehci.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbhub
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\usbhub.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbohci
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\usbohci.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbprint
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\usbprint.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\USBSTOR.SYS

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usbuhci
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\usbuhci.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UxSms
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VaultSvc
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\lsass.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vdrvroot
    ImagePath    REG_EXPAND_SZ    system32\drivers\vdrvroot.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vds
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\vds.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vga
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\vgapnp.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VgaSave
    ImagePath    REG_EXPAND_SZ    \SystemRoot\System32\drivers\vga.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vhdmp
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\vhdmp.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vhdparser
    ImagePath    REG_EXPAND_SZ    system32\drivers\vhdparser.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vhdsvc
    ImagePath    REG_EXPAND_SZ    %systemroot%\system32\svchost -k virtsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\viaide
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\viaide.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Vid
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\Vid.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vmbus
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\vmbus.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VMBusHID
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\VMBusHID.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VmHostAgent
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k NetworkServiceRemoteDesktopHyperVAgent

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vmms
    ImagePath    REG_EXPAND_SZ    %systemroot%\system32\vmms.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VMSMP
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\vmswitch.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VMSP
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\vmswitch.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\volmgr
    ImagePath    REG_EXPAND_SZ    system32\drivers\volmgr.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\volmgrx
    ImagePath    REG_EXPAND_SZ    System32\drivers\volmgrx.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\volsnap
    ImagePath    REG_EXPAND_SZ    system32\drivers\volsnap.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vsmraid
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\vsmraid.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VSS
    ImagePath    REG_EXPAND_SZ    %systemroot%\system32\vssvc.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WacomPen
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\wacompen.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WANARP
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\wanarp.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wanarpv6
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\wanarp.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wbengine
    ImagePath    REG_EXPAND_SZ    "%systemroot%\system32\wbengine.exe"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WcsPlugInService
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k wcssvc

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wd
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\wd.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wdf01000
    ImagePath    REG_EXPAND_SZ    system32\drivers\Wdf01000.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdiServiceHost
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k LocalService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WdiSystemHost
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Wecsvc
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k NetworkService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wercplsupport
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WerSvc
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k WerSvcGroup

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WfpLwf
    ImagePath    REG_EXPAND_SZ    system32\DRIVERS\wfplwf.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WIMMount
    ImagePath    REG_EXPAND_SZ    system32\drivers\wimmount.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinHttpAutoProxySvc
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winmgmt
    ImagePath    REG_EXPAND_SZ    %systemroot%\system32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinRM
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\System32\svchost.exe -k NetworkService

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmiAcpi
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\wmiacpi.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wmiApSrv
    ImagePath    REG_EXPAND_SZ    %systemroot%\system32\wbem\WmiApSrv.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WPDBusEnum
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ws2ifsl
    ImagePath    REG_EXPAND_SZ    \SystemRoot\system32\drivers\ws2ifsl.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv
    ImagePath    REG_EXPAND_SZ    %systemroot%\system32\svchost.exe -k netsvcs

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WudfPf
    ImagePath    REG_EXPAND_SZ    system32\drivers\WudfPf.sys

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wudfsvc
    ImagePath    REG_EXPAND_SZ    %SystemRoot%\system32\svchost.exe -k LocalSystemNetworkRestricted

Поиск завершен: найдено совпадений: 362.