내용 검색은 Control + F (윈도우) Command + F (맥 OS)
윈도우 10 기본 프로세스 조사 및 정리. 전부 다 있는 건 아닐 것임.
1. System Idle Process
- 프로세스 설명
유휴 상태에 있는 CPU 자원의 공간을 백분율로 표시한다. 현재 시스템에서 사용하고 있는 CPU 사용량 중에서 실제로 사용하고 있지 않은 여유 CPU 자원을 나타낸다.
2. System.exe
- 프로세스 설명
네트워크 입출력, 디스크 입출력 및 실제 커널 자체를 처리한다.
- 프로세스 절대 경로
C:\Windows\System32\system.exe
3. smss.exe
- 프로세스 설명
사용자 세션을 시작하는 기능을 담당한다. 이 프로세스는 winlogon, Win32(csrss.exe)를 구동시키고, 시스템 변수를 설정한다. 또한 winlogon이나 csrss가 끝나기를 기다려 정상적인 winlogon과 csrss 종료 시 시스템을 종료시킨다.
- 프로세스 절대 경로
C:\Windows\System32\smss.exe
4. csrss.exe
- 프로세스 설명
윈도우 콘솔(cmd와는 다른 것)을 관장하고 스레드 생성, 삭제를 담당한다. 32bit 가상 MS-DOS 모드를 지원한다.
- 프로세스 절대 경로
C:\Windows\System32\csrss.exe
5. wininit.exe
- 프로세스 설명
코어 시스템 프로세스로 윈도우에 필요한 기초적 백그라운드 프로세스들을 시작하는 매우 중요한 프로세스이다.
- 프로세스 절대 경로
C:\Windows\System32\wininit.exe
6. services.exe
- 프로세스 설명
윈도우의 서비스를 관리하는 역할을 한다.
- 프로세스 절대 경로
C:\Windows\System32\services.exe
7. lsass.exe
- 프로세스 설명
Winlogon.exe의 요청에 의해 인증과 관련된 부분을 처리하는 프로세스이다.
- 프로세스 절대 경로
C:\Windows\System32\lsass.exe
- 연관 dll
ntdll.dll, KERNEL32.DLL, KERNELBASE.dll,
RPCRT4.dll, SspiSrv.dll, lsasrv.dll,
msvcrt.dll, sechost.dll, cfgmgr32.dll,
SspiCli.dll, MSASN1.dll, samsrv.dll,
CRYPT32.dll, bcrypt.dll, ncrypt.dll,
NTASN1.dll, bcryptprimitives.dll,
msprivs.DLL, netprovfw.dll, JOINUTIL.DLL,
negoexts.DLL, CRYPTBASE.dll, cryptdll.dll,
kerberos.DLL, KerbClientShared.dll,
WS2_32.dll, NSI.dll, CRYPTSP.dll,
mswsock.dll, msv1_0.DLL, NtlmShared.dll,
netlogon.DLL, powrprof.dll, advapi32.dll,
logoncli.dll, DNSAPI.dll, USERENV.dll,
profapi.dll, tspkg.DLL, pku2u.DLL,
wdigest.DLL, rsaenh.dll, cloudAP.DLL,
MicrosoftAccountCloudAP.dll, combase.dll,
DPAPI.DLL, schannel.DLL, PCPKsp.dll,
ntmarta.dll, PCPTPM12.dll, tbs.dll,
efslsaext.dll, OLEAUT32.dll, srvcli.dll,
netutils.dll, MPR.dll, dpapisrv.dll,
scecli.DLL, winsta.dll, wevtapi.dll,
IPHLPAPI.DLL, WINNSI.DLL, fveapi.dll,
FVECERTS.dll, ncryptsslp.dll,
ncryptprov.dll, dssenh.dll, gpapi.dll,
mskeyprotect.dll, vaultsvc.dll, ktmw32.dll,
keyiso.dll, ngcpopkeysrv.dll, ucrtbase.dll,
msvcp_win.dll, hmkd.dll, AUTHZ.dll,
DSPARSE.dll, cryptngc.dll
8. svchost.exe
- 프로세스 설명
윈도우가 다양한 기능을 수행하는 데 사용하는 다른 개별 서비스를 호스팅 하거나 포함하는 프로세스이다.
- 프로세스 절대 경로
C:\Windows\System32\svchost.exe
- 연관 dll
ntdll.dll, KERNEL32.DLL, KERNELBASE.dll, sechost.dll, RPCRT4.dll, combase.dll, msvcrt.dll, kernel.appcore.dll, bcryptPrimitives.dll, user32.dll, GDI32.dll, IMM32.DLL, MSCTF.dll, aphostservice.dll, NetworkHelper.dll, UserDataPlatformHelperUtil.dll, MCCSPal.dll, ntmarta.dll, ESENT.dll, iertutil.dll, advapi32.dll, shcore.dll, SYNCUTIL.dll, OLEAUT32.dll, VAULTCLI.dll, WINHTTP.dll, UserDataTypeHelperUtil.dll, PIMSTORE.dll, bcrypt.dll, wintypes.dll, dsclient.dll, PhoneUtil.dll, InprocLogger.dll, profapi.dll, sspicli.dll, msv1_0.DLL, NtlmShared.dll, cryptdll.dll, CRYPTBASE.dll, CRYPTSP.dll, clbcatq.dll, SyncController.dll, powrprof.dll, nlaapi.dll, APHostClient.dll, UserDataLanguageUtil.dll, UserDataTimeUtil.dll, AccountAccessor.dll, CEMAPI.dll, TokenBroker.dll, CRYPT32.dll, MSASN1.dll, USERENV.dll, rsaenh.dll, ActXPrxy.dll, wtsapi32.dll, IDStore.dll, SAMLIB.dll
9. spoolsv.exe
- 프로세스 설명
프린터의 스풀링을 담당하는 프로세스이다.
- 프로세스 절대 경로
C:\Windows\System32\spoolsv.exe
- 연관 dll
ntdll.dll, KERNEL32.DLL, KERNELBASE.dll,
USER32.dll, GDI32.dll, msvcrt.dll,
sechost.dll, RPCRT4.dll, powrprof.dll,
DNSAPI.dll, WS2_32.dll, NSI.dll,
bcrypt.dll, combase.dll,
kernel.appcore.dll, bcryptPrimitives.dll,
SspiCli.dll, mswsock.dll, WTSAPI32.dll,
WINSTA.dll, IPHLPAPI.DLL, WINNSI.DLL,
rasadhlp.dll, fwpuclnt.dll, localspl.dll,
CRYPT32.dll, MSASN1.dll, cfgmgr32.dll,
advapi32.dll, SETUPAPI.dll, srvcli.dll,
SPOOLSS.DLL, sfc_os.dll, ole32.dll,
Secur32.dll, winspool.drv,
PrintIsolationProxy.dll, FXSMON.DLL,
tcpmon.dll, snmpapi.dll, wsnmp3 2.dll,
usbmon.dll, OLEAUT32.dll, DEVOBJ.dll,
WINTRUST.dll, WSDMon.dll, SHLWAPI.dll,
wsdapi.dll, deviceassociation.dll,
netutils.dll, WINHTTP.dll, webservices.dll,
FirewallAPI.dll, fwbase.dll, clbcatq.dll,
msxml6.dll, FunDisc.dll, XmlLite.dll,
fdPnp.dll, ATL.DLL, drvstore.dll,
winprint.dll, USERENV.dll, profapi.dll,
gpapi.dll, DSROLE.dll, win32 spl.dll,
inetpp.dll, CRYPTSP.dll, rsaenh.dll,
CRYPTBASE.dll, cscapi.dll
10. MsMpEng.exe
- 프로세스 설명
마이크로소프트에서 지원하는 자체 악성코드 및 바이러스를 유입을 막는 백신 프로그램인 Windows Defender가 실행되기 위한 구성요소 실행 파일 중 하나이다.
- 프로세스 절대 경로
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1807.18075-0\MsMpEng.exe
11. SearchIndexer.exe
- 프로세스 설명
컴퓨터 내 많은 파일들을 손쉽게 검색하기 위해서 미리 검색하고 자동으로 색인을 해준다. 빠른 시간 내 파일을 찾아주는 장점이 있으나 작업시간에는 컴퓨터가 느려지는 단점이 있다.
- 프로세스 절대 경로
C:\Windows\System32\SearchIndexer.exe
12. SearchProtocolHost.exe
- 프로세스 설명
파일의 내용 및 속성, 전자메일 등을 캐시로 저장하여 인덱싱 해준다. 융통성 있는 쿼리 언어를 통해 파일을 빠르게 검색 또는 액세스 할 수 있다.
- 프로세스 절대 경로
C:\Windows\System32\SearchProtocolHost.exe
13. winlogon.exe
- 프로세스 설명
사용자 로그온/로그오프를 담당하는 프로세스이다. 윈도우 시작/종료 시에 활성화되며 단축키 Ctrl+Alt+Del을 눌러도 활성화된다.
- 프로세스 절대 경로
C:\Windows\System32\winlogon.exe
14. dwm.exe
- 프로세스 설명
데스크톱 창 관리자(Desktop Windows Manager)의 프로세스이다. 해당 프로세스는 바탕 화면 창 관리자 시작 및 유지 관리 서비스를 제공한다. 쉽게 말해 바탕화면의 구성, 윈도우의 창, 시작 메뉴 등의 디자인·그래픽 효과를 주는 역할을 한다고 생각하며 된다.
- 프로세스 절대 경로
C:\Windows\System32\dwm.exe
- 연관 dll
ntdll.dll, KERNEL32.DLL, KERNELBASE.dll, // dll 목록 추가
apphelp.dll, msvcrt.dll, advapi32.dll,
sechost.dll, RPCRT4.dll, gdi32.dll,
USER32.dll, dwmredir.dll, udwm.dll,
dwmcore.dll, OLEAUT32.dll, combase.dll,
dcomp.dll, CoreMessaging.dll, NInput.dll,
IMM32.DLL, MSCTF.dll, uxtheme.dll,
dwmghost.dll, dwmapi.dll, d3d11.dll,
dxgi.dll, WINSTA.dll, WindowsCodecs.dll,
bcrypt.dll, kernel.appcore.dll,
bcryptPrimitives.dll, clbcatq.dll,
UIAnimation.dll, avrt.dll, d2d1.dll,
XmlLite.dll, Cabinet.dll, d3d10warp.dll
15. sihost.exe
- 프로세스 설명
Shell Infrastructure Host를 실행시키는 프로세스이다. Shell Infrastructure Host는 OS의 여러 가지 그래픽 요소를 처리한다. 또한 윈도우 인터페이스의 특정 백그라운드 동작을 제어한다.
- 프로세스 절대 경로
C:\Windows\System32\sihost.exe
- 연관 dll
ntdll.dll, KERNEL32.DLL, KERNELBASE.dll, msvcrt.dll, combase.dll, RPCRT4.dll, sechost.dll, advapi32.dll, CoreMessaging.dll, CoreUIComponents.dll, kernel.appcore.dll, user32.dll, GDI32.dll, shcore.dll, wintypes.dll, ntmarta.dll, IMM32.DLL, MSCTF.dll, bcryptPrimitives.dll, clbcatq.dll, desktopshellext.dll, Windows.Shell.ServiceHostBuilder.dll, cryptsp.dll, bcrypt.dll, rsaenh.dll, CRYPTBASE.dll, ActXPrxy.dll, uxtheme.dll, ClipboardServer.dll, RMCLIENT.dll, windows.storage.dll, shlwapi.dll, powrprof.dll, profapi.dll, edputil.dll, OLEAUT32.dll, iertutil.dll, policymanager.dll, msvcp110_win.dll, XmlLite.dll, activationmanager.dll, AppointmentActivation.dll, UserDataTypeHelperUtil.dll, dsclient.dll, ole32.dll, modernexecserver.dll, WpPortingLibrary.dll, twinapi.appcore.dll, USERENV.dll, usermgrcli.dll, usermgrproxy.dll, SspiCli.dll, netutils.dll, ExecModelClient.dll, MMDevAPI.DLL, DEVOBJ.dll, PROPSYS.dll, cfgmgr32.dll, NotificationPlatformComponent.dll, AppContracts.dll, OnDemandBrokerClient.dll, ShareHost.dll, CRYPT32.dll, MSASN1.dll, execmodelproxy.dll, twinui.appcore.dll, licensemanagerapi.dll, Windows.StateRepository.dll, StateRepository.Core.dll, tiptsf.dll, dwmapi.dll
15. taskhostw.exe
- 프로세스 설명
dll 형식으로 실행되는 다른 프로세스들의 host 역할을 한다. 해당 형식의 프로세스가 여러 개면 taskhostw.exe도 여러 개씩 실행된다. 최근 이 프로세스로 변조한 악성코드들이 많이 발견되고 있다.
- 프로세스 절대 경로
C:\Windows\System32\taskhostw.exe
- 연관 dll
ntdll.dll, KERNEL32.DLL, KERNELBASE.dll, msvcrt.dll, RPCRT4.dll, combase.dll, OLEAUT32.dll, kernel.appcore.dll, bcryptPrimitives.dll, sechost.dll, user32.dll, GDI32.dll, IMM32.DLL, MSCTF.dll, uxtheme.dll, dwmapi.dll, clbcatq.dll, PlaySndSrv.dll, wininet.dll, iertutil.dll, advapi32.dll, shcore.dll, MsCtfMonitor.dll, MSUTB.dll, WINSTA.dll, WTSAPI32.dll, ESENT.dll, SHELL32.dll, windows.storage.dll, shlwapi.dll, powrprof.dll, profapi.dll, ole32.dll, tiptsf.dll, WINMM.dll, WINMMBASE.dll, cfgmgr32.dll, DEVOBJ.dll, MMDevAPI.DLL, PROPSYS.dll, wdmaud.drv, ksuser.dll, AVRT.dll, AUDIOSES.DLL, wintypes.dll, msacm32.drv, MSACM32.dll, midimap.dll
16. explorer.exe
- 프로세스 설명
윈도우의 그래픽 쉘 관리자인 윈도우 프로그램 관리자 또는 탐색기를 실행한다. 윈도우 프로그램 관리자는 작업표시줄, 시작 메뉴, 바탕화면 및 파일 관리자를 관리한다. 이 프로세스를 제거하면 그래픽 인터페이스가 사라진다.
- 프로세스 절대 경로
C:\Windows\explorer.exe
- 연관 dll
ntdll.dll, KERNEL32.DLL, KERNELBASE.dll, apphelp.dll, msvcrt.dll, OLEAUT32.dll, combase.dll, RPCRT4.dll, powrprof.dll, USER32.dll, GDI32.dll, SHCORE.dll, SHLWAPI.dll, SHELL32.dll, windows.storage.dll, advapi32.dll, sechost.dll, kernel.appcore.dll, profapi.dll, CRYPT32.dll, MSASN1.dll, PROPSYS.dll, UxTheme.dll, dwmapi.dll, TWINAPI.dll, d3d11.dll, dcomp.dll, SspiCli.dll, USERENV.dll, SLC.dll, dxgi.dll, sppc.dll, IMM32.DLL, MSCTF.dll, bcryptPrimitives.dll, ole32.dll, comctl32.dll, clbcatq.dll, themeui.dll, WINSTA.dll, cryptsp.dll, bcrypt.dll, rsaenh.dll, CRYPTBASE.dll, ActXPrxy.dll, IDStore.dll, SAMLIB.dll, iertutil.dll, Bcp47 Langs.dll, TwinUI.dll, twinapi.appcore.dll, Windows.UI.Immersive.dll, wintypes.dll, LINKINFO.dll, MrmCoreR.dll, urlmon.dll, ieframe.dll, Secur32.dll, MLANG.dll, WININET.dll, apprepapi.dll, tbs.dll, gdiplus.dll, XmlLite.dll, tiptsf.dll, NetworkExplorer.dll, veeventdispatcher.dll, Windows.StateRepository.dll, StateRepository.Core.dll, taskschd.dll, ntshrui.dll, srvcli.dll, cscapi.dll, Windows.Storage.Search.dll, msxml6.dll, edputil.dll, policymanager.dll, msvcp110_win.dll, ntmarta.dll, NotificationObjFactory.dll, SettingSyncCore.dll, SettingSync.dll, wevtapi.dll, settingsyncpolicy.dll, TokenBroker.dll, wtsapi32.dll, Windows.UI.dll, NInput.dll, wkscli.dll, WinLangdb.dll, netutils.dll, coml2.dll, SndVolSSO.DLL, HID.DLL, MMDevApi.dll, DEVOBJ.dll, cfgmgr32.dll, OLEACC.dll, dataexchange.dll, d2d1.dll, windowscodecs.dll, explorerframe.dll, tabbtn.dll, TabBtnEx.dll, windows.immersiveshell.serviceprovider.dll, uiautomationcore.dll, WLDP.DLL, WINTRUST.dll, sxs.dll, imkrtip.dll, imetip.dll, DUI70.dll, imkrapi.dll, VERSION.dll, imjkapi.dll, PhotoMetadataHandler.dll, WINBRAND.dll, ieproxy.dll, twinui.appcore.dll, CoreMessaging.dll, CoreUIComponents.dll, ApplicationFrame.dll, elscore.dll, thumbcache.dll, provsvc.dll, WS2_32.dll, NSI.dll, EhStorShell.dll, SETUPAPI.dll, cscui.dll, CSCDLL.dll, mssprxy.dll, wpncore.dll, WINHTTP.dll, NotificationController.dll, BitsProxy.dll, execmodelproxy.dll, AboveLockAppHost.dll, wlidprov.dll, Windows.Networking.Connectivity.dll, SystemEventsBrokerClient.dll, d3d10 warp.dll, UIAnimation.dll, rmclient.dll, dsreg.dll, WLDAP32.dll, samcli.dll, ncrypt.dll, NTASN1.dll, DPAPI.DLL, TimeBrokerClient.dll, EventAggregation.dll, npmproxy.dll, IPHLPAPI.DLL, WINNSI.DLL, wlanapi.dll, wwapi.dll, wcmapi.dll, webio.dll, mswsock.dll, DNSAPI.dll, rasadhlp.dll, stobject.dll, BatMeter.dll, WMICLNT.dll, MFPlat.DLL, RTWorkQ.DLL, AVRT.dll, NotificationControllerPS.dll, vaultcli.dll, profext.dll, InputSwitch.dll, Windows.UI.Shell.dll, wincorlib.DLL, prnfldr.dll, WINSPOOL.DRV, es.dll, imagehlp.dll, gpapi.dll, atlthunk.dll, dxp.dll, SHDOCVW.dll, Syncreg.dll, Actioncenter.dll, authui.dll, winmm.dll, WINMMBASE.dll, AUDIOSES.DLL, wpdshserviceobj.dll, PortableDeviceTypes.dll, PortableDeviceApi.dll, SettingMonitor.dll, cscobj.dll, srchadmin.dll, Windows.Globalization.dll, Windows.Gaming.Input.dll, SyncCenter.dll, imapi2.dll, hgcpl.dll, DUser.dll, shacct.dll, netprofm.dll, pnidui.dll, NetworkStatus.dll, bthprops.cpl, BluetoothApis.dll, dhcpcsvc6.DLL, dhcpcsvc.DLL, SetNetworkLocation.dll, dwrite.dll, shpafact.dll, comsvcs.dll, pcacli.dll, MPR.dll, sfc_os.dll, wscinterop.dll, WSCAPI.dll, wscui.cpl, ReAgent.dll, WDSCORE.dll, DismApi.DLL, werconcpl.dll, framedynos.dll, wer.dll, wercplsupport.dll, hcproviders.dll, wpnapps.dll, wdmaud.drv, ksuser.dll, msacm32.drv, MSACM32.dll, midimap.dll, drprov.dll, ntlanman.dll, davclnt.dll, DAVHLPR.dll
17. dllhost.exe
- 프로세스 설명
하나의 코드 블록으로 여러 파일에서 실행할 수 있도록 하는 Dynamic Link Library(DLL) Host를 실행한다. 하나 이상의 윈도우 서비스나 응용프로그램을 실행하도록 설계되었다.
- 프로세스 절대 경로
C:\Windows\System32\dllhost.exe
- 연관 dll
ntdll.dll, KERNEL32.DLL, KERNELBASE.dll, msvcrt.dll, combase.dll, RPCRT4.dll, kernel.appcore.dll, bcryptPrimitives.dll, clbcatq.dll, sechost.dll, cryptsp.dll, bcrypt.dll, rsaenh.dll, CRYPTBASE.dll, user32.dll, GDI32.dll, IMM32.DLL, MSCTF.dll, uxtheme.dll, wininet.dll, iertutil.dll, advapi32.dll, shcore.dll, SHELL32.dll, windows.storage.dll, shlwapi.dll, powrprof.dll, profapi.dll, OLEAUT32.dll, ESENT.dll, userenv.dll, profext.dll, ntmarta.dll, tiptsf.dll
18. TabTip.exe
- 프로세스 설명
태블릿 PC의 입력판에 입력된 필기를 텍스트로 변환해주는 프로세스이다.
- 프로세스 절대 경로
C:\Program Files\Common Files\microsoft shared\ink\tabtip.exe
19. TabTip32.exe
- 프로세스 설명
TabTip의 32비트 버전이다.
- 프로세스 절대 경로
C:\Program Files\Common Files\microsoft shared\ink\tabtip32.exe
20. ShellExperienceHost.exe
- 프로세스 설명
범용 응용프로그램을 윈도우 쉘과 통합할 수 있게 해 준다.
- 프로세스 절대 경로
C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.17134.1_none_e25af7236818e9ce\shellExperienceHost.exe
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\shellExperienceHost.exe
- 연관 dll
ntdll.dll, KERNEL32.DLL, KERNELBASE.dll, combase.dll, msvcrt.dll, RPCRT4.dll, ole32.dll, sechost.dll, GDI32.dll, USER32.dll, wincorlib.DLL, OLEAUT32.dll, IMM32.DLL, MSCTF.dll, kernel.appcore.dll, bcryptPrimitives.dll, Windows.UI.Xaml.dll, wintypes.dll, CoreMessaging.dll, Bcp47 Langs.dll, iertutil.dll, advapi32.dll, shcore.dll, NInput.dll, cryptsp.dll, bcrypt.dll, rsaenh.dll, CRYPTBASE.dll, twinapi.appcore.dll, USERENV.dll, profapi.dll, ActXPrxy.dll, uxtheme.dll, tiptsf.dll, dwmapi.dll, dxgi.dll, d3d11.dll, d3d10 warp.dll, d2d1.dll, StartUI.dll, SHLWAPI.dll, VEEventDispatcher.dll, dcomp.dll, CoreUIComponents.dll, QuickActions.dll, Windows.UI.ActionCenter.dll, QuickActionsDataModel.dll, XmlLite.dll, MrmCoreR.dll, Windows.UI.dll, DataExchange.dll, NotificationObjFactory.dll, urlmon.dll, Windows.Globalization.dll, dwrite.dll, Windows.Globalization.Fontgroups.dll, fontgroupsoverride.dll, Windows.Storage.ApplicationData.dll, windows.storage.dll, powrprof.dll, PROPSYS.dll, Windows.Graphics.dll, threadpoolwinrt.dll, Windows.Internal.Shell.Broker.dll, SHELL32.dll, netutils.dll, wkscli.dll, SspiCli.dll, samcli.dll, WTSAPI32.dll, SLC.dll, ntoskrnl.exe, sppc.dll, policymanager.dll, msvcp110_win.dll, logoncli.dll, msxml6.dll, Windows.StateRepository.dll, StateRepository.Core.dll, windowscodecs.dll, directmanipulation.dll, winsta.dll, PhotoMetadataHandler.dll, RTMediaFrame.dll, NotificationControllerPS.dll, twinapi.dll, audioses.dll, MMDevAPI.DLL, DEVOBJ.dll, cfgmgr32.dll
21. SearchUI.exe
- 프로세스 설명
윈도우 기본 검색 도우미인 Cortana의 필수 구성요소 프로세스이다.
- 프로세스 절대 경로
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
- 연관 dll
ntdll.dll, KERNEL32.DLL, KERNELBASE.dll, msvcrt.dll, combase.dll, RPCRT4.dll, wincorlib.DLL, OLEAUT32.dll, DNSAPI.dll, WS2_32.dll, sechost.dll, NSI.dll, kernel.appcore.dll, bcryptPrimitives.dll, Windows.UI.Xaml.dll, user32.dll, GDI32.dll, wintypes.dll, CoreMessaging.dll, Bcp47 Langs.dll, iertutil.dll, advapi32.dll, shcore.dll, NInput.dll, IMM32.DLL, MSCTF.dll, twinapi.appcore.dll, USERENV.dll, profapi.dll, bcrypt.dll, cryptsp.dll, rsaenh.dll, CRYPTBASE.dll, CortanaApi.dll, BingConfigurationClient.dll, windows.cortana.pal.desktop.dll, Cortana.Core.dll, AISTokenManager.dll, urlmon.dll, shlwapi.dll, OnlineServices.dll, Windows.Storage.ApplicationData.dll, ActXPrxy.dll, uxtheme.dll, XmlLite.dll, logoncli.dll, tiptsf.dll, dwmapi.dll, dxgi.dll, d3d11.dll, d3d10 warp.dll, d2d1.dll, dcomp.dll, PersonaX.dll, policymanager.dll, msvcp110_win.dll, Windows.ApplicationModel.dll, BingIdentityManagerInternal.DLL, MrmCoreR.dll, Windows.UI.dll, CoreUIComponents.dll, windows.storage.dll, powrprof.dll, threadpoolwinrt.dll, Windows.Web.Http.dll, CRYPT32.dll, MSASN1.dll, Windows.Networking.Connectivity.dll, WININET.dll, SspiCli.dll, shell32.dll, ondemandconnroutehelper.dll, IPHLPAPI.DLL, WINNSI.DLL, winhttp.dll, Windows.Globalization.dll, PROPSYS.dll, mswsock.dll, DataExchange.dll, ncrypt.dll, NTASN1.dll, NLAapi.dll, RASAPI32.dll, rasman.dll, rasadhlp.dll, profext.dll, ntmarta.dll, Windows.Media.Speech.dll, RemoteNaturalLanguage.dll, CommsTypeHelperUtil_ca.dll, GeoLocatorHelper.dll, ole32.dll, fwpuclnt.dll, schannel.DLL, mskeyprotect.dll, ncryptsslp.dll, DPAPI.DLL, WINTRUST.dll, gpapi.dll, cryptnet.dll, WLDAP32.dll, twinapi.dll, dwrite.dll, Windows.Graphics.dll, directmanipulation.dll, dhcpcsvc6.DLL, biwinrt.dll, Windows.ApplicationModel.Background.TimeBrok er.dll, dhcpcsvc.DLL, webio.dll, msftedit.dll, globinputhost.dll, imkrtip.dll, imetip.dll, OLEACC.dll, DUI70.dll, imkrapi.dll, VERSION.dll, imjkapi.dll, RemindersUI.dll, Windows.Globalization.Fontgroups.dll, fontgroupsoverride.dll, edgehtml.dll, chakra.dll, MLANG.dll, msimtf.dll, ieapfltr.dll, rometadata.dll, StructuredQuery.dll, Windows.Shell.ServiceHostBuilder.dll
22. RuntimeBroker.exe
- 프로세스 설명
응용 프로그램의 권한을 확인하는 Runtime Borker를 실행하는 프로세스이다. Runtime Broker는 응용프로그램 및 사용 권한을 하는데 도움이 되는 윈도우의 핵심 프로세스이다. 응용프로그램이 최종 사용자의 개인정보를 침해하지 않도록 각 권한을 확인한다.
- 프로세스 절대 경로
C:\Windows\System32\RuntimeBroker.exe
- 연관 dll
ntdll.dll, KERNEL32.DLL, KERNELBASE.dll, msvcrt.dll, RPCRT4.dll, combase.dll, powrprof.dll, kernel.appcore.dll, bcryptPrimitives.dll, ole32.dll, sechost.dll, GDI32.dll, USER32.dll, IMM32.DLL, MSCTF.dll, clbcatq.dll, cryptsp.dll, bcrypt.dll, rsaenh.dll, CRYPTBASE.dll, Windows.UI.Immersive.dll, shcore.dll, ActXPrxy.dll, UxTheme.dll, execmodelclient.dll, CoreMessaging.dll, MMDevAPI.DLL, DEVOBJ.dll, cfgmgr32.dll, PROPSYS.dll, OLEAUT32.dll, twinapi.appcore.dll, USERENV.dll, profapi.dll, Windows.Internal.Shell.Broker.dll, SHELL32.dll, windows.storage.dll, advapi32.dll, shlwapi.dll, netutils.dll, wkscli.dll, SspiCli.dll, samcli.dll, WTSAPI32.dll, SLC.dll, ntoskrnl.exe, MrmCoreR.dll, sppc.dll, tiptsf.dll, wwapi.dll, WinTypes.dll, sxs.dll, StructuredQuery.dll, Windows.Storage.Search.dll, edputil.dll, iertutil.dll, policymanager.dll, msvcp110_win.dll, XmlLite.dll, apphelp.dll, TwinUI.dll, dwmapi.dll, Bcp47 Langs.dll, urlmon.dll, thumbcache.dll, comctl32.dll, windows.cortana.Desktop.dll, WindowsCodecs.dll, LINKINFO.dll, profext.dll, ntmarta.dll, korwbrkr.dll, MbaeApiPublic.dll, ieproxy.dll, Windows.Networking.Connectivity.dll, IPHLPAPI.DLL, NSI.dll, WINNSI.DLL, wlanapi.dll, Windows.Networking.HostName.dll, netprofm.dll, npmproxy.dll, Windows.Cortana.ProxyStub.dll
23. dasHost.exe
- 프로세스 설명
윈도우와 유무선 장치를 연결하고 페어링 하는 장치 연결 프레임워크 공급자 호스트를 실행한다. 작업 관리자는 연결된 각 장치에 대해 별도의 프로세스를 표시한다.
- 프로세스 절대 경로
C:\Windows\System32\dasHost.exe
- 연관 dll
ntdll.dll, KERNEL32.DLL, KERNELBASE.dll,
msvcrt.dll, RPCRT4.dll, sechost.dll,
cfgmgr32.dll, dafupnp.dll, OLEAUT32.dll,
combase.dll, WS2_32.dll, NSI.dll,
IPHLPAPI.DLL, bcrypt.dll, WINHTTP.dll,
SSDPAPI.dll, deviceassociation.dll,
WINNSI.DLL, kernel.appcore.dll,
bcryptPrimitives.dll, DAFWSD.dll,
wsdapi.dll, FirewallAPI.dll,
webservices.dll, fwbase.dll, CRYPT32.dll,
MSASN1.dll, dhcpcsvc6.DLL, dhcpcsvc.DLL,
mswsock.dll, wshqos.dll, wshtcpip.DLL,
wship6.dll, powrprof.dll,
FWPolicyIOMgr.dll, CRYPTSP.dll, rsaenh.dll,
CRYPTBASE.dll, XmlLite.dll, webio.dll,
SspiCli.dll, DNSAPI.dll, clbcatq.dll,
user32.dll, GDI32.dll, netprofm.dll,
npmproxy.dll, ondemandconnroutehelper.dll
24. WmiPrvSE.exe
- 프로세스 설명
한 번에 여러 인스턴스를 실행할 수 있고 각 인스턴스는 Windows Management Instrumentation 공급자 루틴을 구현한다. 윈도우에서 구현되는 분산 처리 관리자의 표준이다.
- 프로세스 절대 경로
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy
25. NisSrv.exe
- 프로세스 설명
윈도우를 부팅할 때 실시간으로 들어오는 네트워크 트래픽을 모니터링하는 네트워크 검사 서비스(NIS)를 구현하여 의심스러운 패턴을 찾는 프로세스이다.
- 프로세스 절대 경로
C:\Windows\WinSxS\amd64_windows-defender-nis-service_31bf3856ad364e35_10.0.17134.1_none_03732c587c19dd6d\NisSrv.exe
26. audiodg.exe
- 프로세스 설명
컴퓨터가 공급업체 오디오 응용프로그램의 코드를 받아 컴퓨터 시스템에서 사운드를 실행할 수 있도록 하는 프로세스이다. 오디오 파일을 중단 없이 청취할 수 있고 DRM도 처리할 수 있다.
- 프로세스 절대 경로
C:\Windows\System32\audiodg.exe
27. TrustedInstaller.exe
- 프로세스 설명
윈도우 모듈 설치 관리자이다. 윈도우즈 업데이트를 위해 PC의 운영체제를 검사하고 필요한, 가능한 업데이트가 있는지 진단한다.
- 프로세스 절대 경로
C:\Windows\servicing\TrustedInstaller.exe
28. TiWorker.exe
- 프로세스 설명
윈도우 모듈설치 프로그램 서비스의 일부이다. OS 구성요소를 업데이트를 한다.
- 프로세스 절대 경로
C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.17134.1_none_92c1521c78176f18\TiWorker.exe
- 연관 dll
ntdll.dll, KERNEL32.DLL, KERNELBASE.dll,
msvcrt.dll, combase.dll, RPCRT4.dll,
sechost.dll, advapi32.dll, wdscore.dll,
OLEAUT32.dll, dbghelp.dll, dbgcore.DLL,
kernel.appcore.dll, bcryptPrimitives.dll,
user32.dll, GDI32.dll, cryptsp.dll,
bcrypt.dll, rsaenh.dll, CRYPTBASE.dll,
clbcatq.dll, CbsApi.dll
29. WUDFHost.exe
- 프로세스 설명
윈도우와 하드웨어 장치 통신 에이전트이다. 사용자 모드 드라이버 호스트 프로세스를 관리하고 카메라, 휴대용 음악 플레이어와 같은 직렬 버스 기반 장치를 지원하는 드라이버를 생성하는 것을 지원한다. 윈도우에 중요한 구성요소이고 시스템의 전반적인 안정성에 필수적인 요소이다.
- 프로세스 절대 경로
C:\Windows\System32\WUDFHost.exe
- 연관 dll
ntdll.dll, KERNEL32.DLL, KERNELBASE.dll, // dll 추가
RPCRT4.dll, combase.dll, msvcrt.dll,
sechost.dll, DEVOBJ.dll, cfgmgr32.dll,
WUDFPlatform.dll, advapi32.dll,
SspiCli.dll, kernel.appcore.dll,
bcryptPrimitives.dll, SensorsHid.dll,
HID.DLL, PROPSYS.dll, OLEAUT32.dll,
SensorsUtilsV2.dll, dbghelp.dll,
WUDFx02000.dll, SensorsCx.dll,
WppRecorderUM.dll, clbcatq.dll,
Geolocation.dll, msvcp110_win.dll,
BiWinrt.dll, twinapi.appcore.dll,
USERENV.dll, profapi.dll, bcrypt.dll,
user32.dll, GDI32.dll, cryptsp.dll,
rsaenh.dll, CRYPTBASE.dll,
deviceaccess.dll, LocationFrameworkPS.dll,
WinTypes.dll
30. SearchFilterHost.exe
- 프로세스 설명
사용자 검색이 빠르고 용이하도록 인덱싱 해주는 프로세스이다.
- 프로세스 절대 경로
C:\Windows\System32\SearchFilterHost.exe
31. OneDrive.exe
3780 ntdll.dll, wow64.dll, wow64 win.dll, wow64 cpu.dll
32. OneDriveSetup.exe
220 ntdll.dll, wow64.dll, wow64 win.dll,
33. rundll32.exe
5080 ntdll.dll, KERNEL32.DLL, KERNELBASE.dll,
msvcrt.dll, combase.dll, RPCRT4.dll,
shcore.dll, imagehlp.dll, generaltel.dll,
wevtapi.dll, WDSCORE.dll, OLEAUT32.dll,
bcrypt.dll, user32.dll, GDI32.dll,
ole32.dll, sechost.dll,
bcryptPrimitives.dll, ADVAPI32.dll
34. CompatTelRunner.exe
496 ntdll.dll, KERNEL32.DLL, KERNELBASE.dll,
msvcrt.dll, appraiser.dll, SHLWAPI.dll,
combase.dll, RPCRT4.dll, GDI32.dll,
USER32.dll, ADVAPI32.dll, sechost.dll,
ole32.dll, OLEAUT32.dll, SETUPAPI.dll,
CFGMGR32.dll, SHELL32.dll,
windows.storage.dll, kernel.appcore.dll,
shcore.dll, powrprof.dll, profapi.dll,
WDSCORE.dll, VERSION.dll, XmlLite.dll,
IPHLPAPI.DLL, NSI.dll, NETAPI32.dll,
sfc.dll, gdiplus.dll, webservices.dll,
WINNSI.DLL, wkscli.dll, srvcli.dll,
netutils.dll, bcrypt.dll, SAMCLI.DLL,
sfc_os.DLL, bcryptPrimitives.dll,
WINHTTP.dll, WS2_32.dll,
ondemandconnroutehelper.dll, webio.dll,
mswsock.dll, SspiCli.dll, DNSAPI.dll,
fwpuclnt.dll, rasadhlp.dll, schannel.DLL,
CRYPT32.dll, MSASN1.dll, mskeyprotect.dll,
ncrypt.dll, NTASN1.dll, ncryptsslp.dll,
CRYPTSP.dll, rsaenh.dll, CRYPTBASE.dll,
gpapi.dll, DPAPI.DLL, GeneralTel.dll,
wevtapi.dll, acmigration.dll,
dhcpcsvc6.DLL, dhcpcsvc.DLL, apphelp.dll,
aeinv.dll, msi.dll, urlmon.dll,
iertutil.dll, devinv.dll, WINTRUST.dll,
dbghelp.dll, WINSPOOL.DRV, SAMLIB.dll,
clbcatq.dll, wbemprox.dll, wbemcomn.dll,
wbemsvc.dll, fastprox.dll, DEVOBJ.dll,
wlanapi.dll, NetSetupShim.dll,
NetSetupApi.dll, dxgi.dll, D3D11.dll,
drvstore.dll, DismApi.DLL, dbgcore.DLL,
DismCore.dll, DEVRTL.dll,
AppXDeploymentClient.dll,
Windows.ApplicationModel.dll,
twinapi.appcore.dll, USERENV.dll,
psapi.dll, DismCorePS.dll, dismprov.dll,
LogProvider.dll, FolderProvider.dll,
WimProvider.dll, WIMGAPI.DLL, FLTLIB.DLL,
ntmarta.dll, VHDProvider.dll,
ImagingProvider.dll, CompatProvider.dll,
FfuProvider.dll, PROPSYS.dll, comctl32.dll,
Secur32.dll, MLANG.dll, WININET.dll,
cryptnet.dll, WLDAP32.dll, SPINF.dll
35. DismHost.exe
4836 ntdll.dll, KERNEL32.DLL, KERNELBASE.dll,
msvcrt.dll, combase.dll, RPCRT4.dll,
OLEAUT32.dll, kernel.appcore.dll,
bcryptPrimitives.dll, user32.dll,
GDI32.dll, sechost.dll, clbcatq.dll,
cryptsp.dll, bcrypt.dll, rsaenh.dll,
CRYPTBASE.dll, DismCorePS.dll,
dismprov.dll, OSProvider.dll, advapi32.dll,
LogProvider.dll, dbghelp.dll, dbgcore.DLL,
DmiProvider.dll, drvstore.dll,
drupdate.dll, cfgmgr32.dll, SETUPAPI.dll,
DEVRTL.dll, SPINF.dll, DEVOBJ.dll,
WINTRUST.dll, MSASN1.dll, CRYPT32.dll,
gpapi.dll
36. conhost.exe
4032 ntdll.dll, KERNEL32.DLL, KERNELBASE.dll,
msvcrt.dll, ConhostV2.dll, combase.dll,
RPCRT4.dll, USER32.dll, GDI32.dll,
ole32.dll, sechost.dll, IMM32.dll,
MSCTF.dll, OLEAUT32.dll, PROPSYS.dll,
kernel.appcore.dll, bcryptPrimitives.dll,
uxtheme.dll, tiptsf.dll, clbcatq.dll,
windows.storage.dll, advapi32.dll,
shlwapi.dll, shcore.dll, powrprof.dll,
profapi.dll, SHELL32.dll, dwmapi.dll,
wtsapi32.dll, WINSTA.dll, comctl32.DLL,
uiautomationcore.dll, USERENV.dll,
cryptsp.dll, bcrypt.dll, rsaenh.dll,
CRYPTBASE.dll, sxs.dll, OLEACC.dll,
imkrtip.dll, imetip.dll, DUI70.dll,
imkrapi.dll, VERSION.dll, imjkapi.dll,
ntmarta.dll
37. backgroundTaskHost.exe
2664 N/A
38. WmiPrvSE.exe
4672 ntdll.dll, KERNEL32.DLL, KERNELBASE.dll,
msvcrt.dll, FastProx.dll, combase.dll,
RPCRT4.dll, NCObjAPI.DLL, wbemcomn.dll,
WS2_32.dll, sechost.dll, NSI.dll,
bcrypt.dll, advapi32.dll, user32.dll,
GDI32.dll, kernel.appcore.dll,
bcryptPrimitives.dll, clbcatq.dll,
wbemprox.dll, OLEAUT32.dll, cryptsp.dll,
rsaenh.dll, CRYPTBASE.dll, wbemsvc.dll,
wmiutils.dll, cimwin32.dll, powrprof.dll,
framedynos.dll, SspiCli.dll, winbrand.dll
'IT 내용 정리' 카테고리의 다른 글
| 가트너 10대 기술 요약 및 정리 (0) | 2019.07.14 |
|---|---|
| 금융권 보안 (0) | 2019.07.14 |
| 내가 랜섬웨어 유포자라면 어찌 했을까? (0) | 2019.07.14 |
| 홈서버 운영 - fail2ban 을 써보자! (0) | 2019.06.11 |
| 홈서버 운영 - 해외 IP를 차단해보자! (0) | 2019.06.11 |
