event log--C:\WINNT\system32\services.exe
logical disk manager--C:\WINNT\System32\services.exe
plug and play --C:\WINNT\system32\services.exe
remote procedure caol(rpc)--C:\WINNT\system32\svchost -k rpcss
windows managem instrumentation---------- \System32\WBEM\WinMgmt.exe
workstation -----------C:\WINNT\system32\services.exe