> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-artifacts/windows-services/dosvc-delivery-optimization.md).

# DoSvc (Delivery Optimization)

* **Executable**: `svchost.exe -k DoSvc`
* **Purpose**: Manages the download and upload of Windows updates.
* **Intent**: To optimize the retrieval of Windows updates by allowing PCs to get updates from, and send updates to, local PCs and the internet.
* **Normal Activity**: Downloading or distributing updates, especially when updates are released. Background data transfer might be seen.
* <mark style="color:red;">**Malicious Use**</mark><mark style="color:red;">:</mark> An attacker might mimic its behavior to exfiltrate data or download malicious payloads, as the service legitimately downloads large amounts of data.