Advertisement
guyrleech

Show details of svchost.exe hosted services

Jan 19th, 2023
1,457
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PowerShell 0.53 KB | Source Code | 0 0
  1. ## Get services that are hosted by svchost.exe and show details of dll providing service from the registry
  2.  
  3. gcim win32_service | ? pathname -match '\\svchost\.exe\b' | % { $dll=gp "HKLM:SYSTEM\CurrentControlSet\Services\$($_.name)\Parameters" -name ServiceDll|Select -expand Servicedll ; select -InputObject $_ name,displayname,state,pathname,@{n='dll';e={ $dll }},@{n='vendor';e={ gp $dll | Select -expand versioninfo | select -expand companyname}},@{n='Signing';e={Get-AuthenticodeSignature $dll -EA 0 | Select -ExpandProperty Status }}}
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement