How can I find out what program is sending DNS queries *.in-addr.arpa?

Question

Windows

Thousands of requests per second.
Investigation has led to the following services (highlighted) being involved in sending DNS traffic:

More specifically, it's the svchost.exe process , which is unremarkable.
But these are the main services. They cannot be disabled. Someone else must be using them? How to find out?
Task manager, resource monitor, command line, total commander, various folders, dnscrypt-proxy, services are open.
Regular windows 7.

Answer 1

It was the resource monitor .
The Network tab displays all connections. The resource monitor "sees" only ip and really wants to know the real names of domains in order to display them.

Answer 2

TCPViewer
CurrPorts
NetworkConnectLog
And anyway, download both packages!
download.sysinternals.com/files/SysinternalsSuite.zip
launcher.nirsoft.net/downloads/index.html + download.nirsoft.net/nirsoft_package_russian.zip
It seems to me that these programs will close all your questions for the next 5 years :D

Answer 3

svchost.exe is a service launcher, it does nothing by itself. Any service, if you look at its command line, is launched through svchost, even if it has nothing to do with Microsoft (in the sense, it’s not hacked by them)