Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.16384 (winblue_rtm.130821-1623)	0.68%
6.2.9200.16384 (win8_rtm.120725-1247)	1.02%
6.1.7600.16385 (win7_rtm.090713-1255)	9.83%
6.1.7600.16385 (win7_rtm.090713-1255)	8.14%
6.0.6000.16386 (vista_rtm.061101-2205)	3.05%
6.0.6000.16386 (vista_rtm.061101-2205)	0.68%
5.2.3790.3959 (srv03_sp2_rtm.070216-1710)	0.34%
5.2.3790.3959 (srv03_sp2_rtm.070216-1710)	0.68%
5.1.2600.5512 (xpsp.080413-0852)	56.95%
5.1.2600.5512 (xpsp.080413-0852)	0.34%
5.1.2600.5512 (xpsp.080413-0852)	1.69%
5.1.2600.5512 (xpsp.080413-0852)	0.34%
5.1.2600.5512 (xpsp.080413-0852)	0.34%
5.1.2600.3311 (xpsp.080211-1047)	0.68%
5.1.2600.3300 (xpsp.080125-0707)	0.34%
5.1.2600.3244 (xpsp.071030-0319)	0.34%
5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)	14.24%
5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)	0.34%

Relationships

services.exe (Services and Controller app by Microsoft)

PE file structure

Show functions

Import table

advapi32.dll

RegSetValueExW, RegisterEventSourceW, StartServiceCtrlDispatcherW, RegisterServiceCtrlHandlerW, DeregisterEventSource, ChangeServiceConfigW, RegCreateKeyW, SetServiceStatus, ControlService, DeleteService, CreateServiceW, OpenSCManagerW, OpenServiceW, CloseServiceHandle, CryptAcquireContextW, RegSetKeySecurity, GetSecurityDescriptorLength, MakeSelfRelativeSD, ReportEventW, LsaOpenPolicy, LsaQueryInformationPolicy, LsaFreeMemory, LsaClose, CryptReleaseContext, RegNotifyChangeKeyValue, AllocateAndInitializeSid, CryptGenRandom, FreeSid, RegDeleteValueW, SetSecurityDescriptorDacl, RegEnumKeyExW, LookupPrivilegeValueW, AdjustTokenPrivileges, EqualSid, RegDeleteKeyW, RegQueryInfoKeyW, RegQueryValueExW, RegCloseKey, RegCreateKeyExW, RegOpenKeyExW, InitializeSecurityDescriptor, GetLengthSid, SetSecurityDescriptorOwner, SetSecurityDescriptorGroup, GetTokenInformation, OpenProcessToken, GetAce, InitializeAcl, AddAccessAllowedAce

kernel32.dll

WaitForMultipleObjects, SetErrorMode, InterlockedDecrement, GetSystemDirectoryW, GetACP, SetFilePointer, GetLocalTime, GetCommandLineW, Sleep, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleHandleA, GetStartupInfoW, ExpandEnvironmentStringsW, GetConsoleCP, LocalAlloc, FormatMessageW, LocalFree, CreateMutexW, CreateNamedPipeW, HeapFree, HeapAlloc, GetProcessHeap, VirtualFree, VirtualAlloc, WriteFile, lstrlenW, lstrcpyW, GetLastError, InterlockedIncrement, lstrcmpiW, MultiByteToWideChar, WideCharToMultiByte, lstrlenA, LeaveCriticalSection, EnterCriticalSection, GetCurrentThreadId, CloseHandle, GetCurrentProcess, WaitForSingleObject, InitializeCriticalSection, DeleteCriticalSection, lstrcatW, GetModuleFileNameW, lstrcpynW, FreeLibrary, SizeofResource, LoadResource, FindResourceW, LoadLibraryExW, GetFileSize, CreateFileW, GetProcAddress, LoadLibraryA, GetSystemDirectoryA, CreateEventW, InterlockedExchange, ReleaseMutex, PostQueuedCompletionStatus, SetLastError, GetOEMCP, SetHandleInformation, CreateIoCompletionPort, CreateProcessW, ReadFile, OpenProcess, PeekNamedPipe, GetSystemTime, SetEvent, TerminateThread, GetVersionExW, GetQueuedCompletionStatus, CreateThread, DuplicateHandle, InterlockedCompareExchange, ResetEvent

msvcrt.dll

DllMain

ntlsapi.dll

NtLicenseRequestA, NtLSFreeHandle

ole32.dll

CoInitializeSecurity, CoUninitialize, CoTaskMemRealloc, CoTaskMemAlloc, CoTaskMemFree, CoRegisterClassObject, CoRevokeClassObject, CoInitialize, CoInitializeEx

psapi.dll

EnumProcesses

user32.dll

LoadStringW, CloseWindowStation, CloseDesktop, wsprintfW, CreateDesktopW, SetProcessWindowStation, CreateWindowStationW, OpenWindowStationW, GetProcessWindowStation, wsprintfA, LoadStringA, MessageBoxW, CharNextW

ws2_32.dll

WSASetEvent, WSACloseEvent, WSAResetEvent, WSADuplicateSocketW, WSACreateEvent, WSAEventSelect, WSAEnumNetworkEvents

tlntsvr.exe

Telnet by Microsoft

Remove tlntsvr.exe

Version:	6.0.6000.16386 (vista_rtm.061101-2205)
MD5:	5e1bc006cb4a26507d4512795cf08373
SHA1:	3ca7710b94902b7696393b0a64deb1d727eee8f0
SHA256:	c1ff1d0b3ad488046d90dc6b7cec2460a23c275332217fe47d0dd8fafb5477f3

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is tlntsvr.exe?

Telnet is a network protocol used on the Internet or local area networks to provide a bidirectional interactive text-oriented communication facility using a virtual terminal connection. User data is interspersed in-band with Telnet control information in an 8-bit byte oriented data connection over the Transmission Control Protocol (TCP).

Overview

tlntsvr.exe runs as a service under the name Telnet (TlntSvr) with minimum LOCAL SERVICE privileges (predefined local account used by the service control manager) on the local PC and presents anonymous credentials on the network. This version is designed to run on Windows Vista and is compiled as a 32 bit program.

Details

File name:	tlntsvr.exe
Publisher:	Microsoft Corporation
Product name:	Telnet
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\tlntsvr.exe
File version:	6.0.6000.16386 (vista_rtm.061101-2205)
Product version:	6.0.6000.16386
Size:	69.5 KB (71,168 bytes)
Digital DNA
PE subsystem:	Windows GUI
Entropy:	5.911052
File packed:	No
Code language:	Microsoft Visual C++
.NET CLR:	No

More details

Behaviors

Services

Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)

'TlntSvr' (Telnet)
'TlntSvr'

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.00042407%	0.028634%
Kernel CPU:	0.00021204%	0.013761%
User CPU:	0.00021204%	0.014873%
Kernel CPU time:	31 ms/min	100,923,805ms/min
CPU cycles:	15,775/sec	17,470,203/sec
Memory
Private memory:	1.07 MB	21.59 MB
Private (maximum):	3.85 MB
Private (minimum):	104 KB
Non-paged memory:	1.07 MB	21.59 MB
Virtual memory:	33.34 MB	140.96 MB
Virtual memory (peak):	33.84 MB	169.69 MB
Working set:	176 KB	18.61 MB
Working set (peak):	3.86 MB	37.95 MB
Page faults:	1,388/min	2,039/min
I/O
I/O read transfer:	88 Bytes/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	4 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	21 Bytes/sec	448.09 KB/min
I/O other operations:	4/sec	1,671/min
Resource allocations
Threads:	3	12
Handles:	70	600

Process properties

Integrety level:	System
Platform:	32-bit
Command line:	C:\Windows\System32\tlntsvr.exe
Owner:	LOCAL SERVICE
Windows Service
Service name:	TlntSvr
Display name:	Telnet
Description:	“Enables a remote user to log on to this computer and run programs, and supports various TCP/IP Telnet clients, including UNIX-based and Windows-based computers. If this service is stopped, remote user access to programs might be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start.”
Type:	Win32OwnProcess, InteractiveProcess
Parent process:	services.exe (Services and Controller app by Microsoft)

Threads