Caption                  CommandLine                                                                                                                                                                                                                                                                                                                                                                                                                 ExecutablePath                                                                                     Handle  
System Idle Process                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     0       
System                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4       
smss.exe                 \SystemRoot\System32\smss.exe                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  344     
csrss.exe                %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16                                                                                                                          C:\Windows\system32\csrss.exe                                                                      492     
wininit.exe              wininit.exe                                                                                                                                                                                                                                                                                                                                                                                                                 C:\Windows\system32\wininit.exe                                                                    560     
csrss.exe                %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16                                                                                                                          C:\Windows\system32\csrss.exe                                                                      572     
services.exe             C:\Windows\system32\services.exe                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\services.exe                                                                   620     
lsass.exe                C:\Windows\system32\lsass.exe                                                                                                                                                                                                                                                                                                                                                                                               C:\Windows\system32\lsass.exe                                                                      632     
lsm.exe                  C:\Windows\system32\lsm.exe                                                                                                                                                                                                                                                                                                                                                                                                 C:\Windows\system32\lsm.exe                                                                        640     
winlogon.exe             winlogon.exe                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\winlogon.exe                                                                   732     
svchost.exe              C:\Windows\system32\svchost.exe -k DcomLaunch                                                                                                                                                                                                                                                                                                                                                                               C:\Windows\system32\svchost.exe                                                                    812     
nvvsvc.exe               C:\Windows\system32\nvvsvc.exe                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\nvvsvc.exe                                                                     1036    
svchost.exe              C:\Windows\system32\svchost.exe -k RPCSS                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe                                                                    1112    
RsMgrSvc.exe             "C:\Program Files\Rising\RSD\RsMgrSvc.exe"                                                                                                                                                                                                                                                                                                                                                                                  C:\Program Files\Rising\RSD\RsMgrSvc.exe                                                           1284    
RavMonD.exe              "C:\Program Files\Rising\RIS\RavMonD.exe"                                                                                                                                                                                                                                                                                                                                                                                   C:\Program Files\Rising\RIS\RavMonD.exe                                                            1408    
svchost.exe              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\svchost.exe                                                                    1536    
svchost.exe              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted                                                                                                                                                                                                                                                                                                                                                             C:\Windows\System32\svchost.exe                                                                    1568    
svchost.exe              C:\Windows\system32\svchost.exe -k netsvcs                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe                                                                    1612    
stacsv.exe               C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\STacSV.exe                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\STacSV.exe   1652    
svchost.exe              C:\Windows\system32\svchost.exe -k LocalService                                                                                                                                                                                                                                                                                                                                                                             C:\Windows\system32\svchost.exe                                                                    1912    
nvvsvc.exe               C:\Windows\system32\nvvsvc.exe -session -first                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\nvvsvc.exe                                                                     1964    
hpservice.exe            C:\Windows\system32\Hpservice.exe                                                                                                                                                                                                                                                                                                                                                                                           C:\Windows\system32\Hpservice.exe                                                                  2020    
SbieSvc.exe              "C:\Program Files\Sandboxie\SbieSvc.exe"                                                                                                                                                                                                                                                                                                                                                                                    C:\Program Files\Sandboxie\SbieSvc.exe                                                             304     
svchost.exe              C:\Windows\system32\svchost.exe -k NetworkService                                                                                                                                                                                                                                                                                                                                                                           C:\Windows\system32\svchost.exe                                                                    556     
kxescore.exe             "C:\Program Files\Common Files\Kingsoft\kiscommon\kxescore.exe" /service kxescore                                                                                                                                                                                                                                                                                                                                           C:\Program Files\Common Files\Kingsoft\kiscommon\kxescore.exe                                      980     
kxesapp.exe              "C:\Program Files\Common Files\Kingsoft\kiscommon\kxesapp.exe" /service kxesapp                                                                                                                                                                                                                                                                                                                                             C:\Program Files\Common Files\Kingsoft\kiscommon\kxesapp.exe                                       1072    
spoolsv.exe              C:\Windows\System32\spoolsv.exe                                                                                                                                                                                                                                                                                                                                                                                             C:\Windows\System32\spoolsv.exe                                                                    1464    
svchost.exe              C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe                                                                    1860    
AEstSrv.exe              C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\aestsrv.exe                                                                                                                                                                                                                                                                                                                           C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\aestsrv.exe  864     
ansysli_server.exe       "C:\Program Files\ANSYS Inc\Shared Files\Licensing\win32\ansysli_server.exe" -nodaemon -k runservice                                                                                                                                                                                                                                                                                                                        C:\Program Files\ANSYS Inc\Shared Files\Licensing\win32\ansysli_server.exe                         2116    
defensewall_serv.exe     C:\Windows\system32\defensewall_serv.exe                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\defensewall_serv.exe                                                           2140    
FNPLicensingService.exe  "C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe"                                                                                                                                                                                                                                                                                                                                C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe         2244    
IMEDICTUPDATE.EXE        "C:\Program Files\Common Files\Microsoft Shared\IME14\SHARED\IMEDICTUPDATE.EXE"                                                                                                                                                                                                                                                                                                                                             C:\Program Files\Common Files\Microsoft Shared\IME14\SHARED\IMEDICTUPDATE.EXE                      2324    
smpd.exe                 "C:\Program Files\Intel\MPI-RT\3.2.1.009\ia32\bin\smpd.exe"                                                                                                                                                                                                                                                                                                                                                                 C:\Program Files\Intel\MPI-RT\3.2.1.009\ia32\bin\smpd.exe                                          2360    
upsvc.exe                "C:\Program Files\Common Files\Kingsoft\kiscommon\upsvc.exe"                                                                                                                                                                                                                                                                                                                                                                C:\Program Files\Common Files\Kingsoft\kiscommon\upsvc.exe                                         2416    
taskhost.exe             "taskhost.exe"                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\taskhost.exe                                                                   2468    
sqlservr.exe             "C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS                                                                                                                                                                                                                                                                                                                                        C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe                              2552    
ansysli_monitor.exe      "C:\Program Files\ANSYS Inc\Shared Files\Licensing\win32\ansysli_monitor.exe" -monitor 2116 -service -nodaemon                                                                                                                                                                                                                                                                                                              C:\Program Files\ANSYS Inc\Shared Files\Licensing\win32\ansysli_monitor.exe                        2604    
conhost.exe              \??\C:\Windows\system32\conhost.exe                                                                                                                                                                                                                                                                                                                                                                                         C:\Windows\system32\conhost.exe                                                                    2636    
NLSSRV32.EXE             C:\Windows\system32\NLSSRV32.EXE                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\NLSSRV32.EXE                                                                   2648    
sqlbrowser.exe           "C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe"                                                                                                                                                                                                                                                                                                                                                            C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe                                     2728    
sqlwriter.exe            "C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"                                                                                                                                                                                                                                                                                                                                                             C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe                                      2752    
lmgrd.exe                "C:\Program Files\ANSYS Inc\Shared Files\Licensing\win32\lmgrd.exe"  -c "C:\Program Files\ANSYS Inc\Shared Files\Licensing\license.dat" -l "C:\Program Files\ANSYS Inc\Shared Files\Licensing\license.log" -z2                                                                                                                                                                                                              C:\Program Files\ANSYS Inc\Shared Files\Licensing\win32\lmgrd.exe                                  2760    
USBSRService.exe         "D:\Program Files\USB Safely Remove\USBSRService.exe"                                                                                                                                                                                                                                                                                                                                                                       D:\Program Files\USB Safely Remove\USBSRService.exe                                                2800    
dwm.exe                  "C:\Windows\system32\Dwm.exe"                                                                                                                                                                                                                                                                                                                                                                                               C:\Windows\system32\Dwm.exe                                                                        2888    
ansyslmd.exe             ansyslmd.exe -T MekHero-PC 10.8 -1 -c "C:\Program Files\ANSYS Inc\Shared Files\Licensing\license.dat" --lmgrd_start 4d855d2e  -l "C:\Program Files\ANSYS Inc\Shared Files\Licensing\license.log"                                                                                                                                                                                                                            C:\Program Files\ANSYS Inc\Shared Files\Licensing\win32\ansyslmd.exe                               2924    
explorer.exe             C:\Windows\Explorer.EXE                                                                                                                                                                                                                                                                                                                                                                                                     C:\Windows\Explorer.EXE                                                                            3052    
WPService.exe            "C:\Program Files\CMBCHINA\WebProtect\WPService.exe" /alone                                                                                                                                                                                                                                                                                                                                                                 C:\Program Files\CMBCHINA\WebProtect\WPService.exe                                                 3364    
USBSafelyRemove.exe      "D:\Program Files\USB Safely Remove\USBSafelyRemove.exe" /startup                                                                                                                                                                                                                                                                                                                                                           D:\Program Files\USB Safely Remove\USBSafelyRemove.exe                                             3412    
kxetray.exe              "C:\Program Files\Common Files\Kingsoft\kiscommon\kxetray.exe" /no_detect_level                                                                                                                                                                                                                                                                                                                                             C:\Program Files\Common Files\Kingsoft\kiscommon\kxetray.exe                                       3532    
FSCapture.exe            "D:\Program Files\FastStone Capture\FSCapture.exe" -Silent                                                                                                                                                                                                                                                                                                                                                                  D:\Program Files\FastStone Capture\FSCapture.exe                                                   3780    
USBGuard.exe             "D:\Program Files\USB Disk Security\USBGuard.exe"                                                                                                                                                                                                                                                                                                                                                                           D:\Program Files\USB Disk Security\USBGuard.exe                                                    3864    
svchost.exe              C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe                                                                    4016    
svchost.exe              C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation                                                                                                                                                                                                                                                                                                                                                           C:\Windows\system32\svchost.exe                                                                    4376    
RsTray.exe               "C:\Program Files\Rising\RIS\rstray.exe" -system                                                                                                                                                                                                                                                                                                                                                                            C:\Program Files\Rising\RIS\rstray.exe                                                             4636    
srun300.exe              "C:\Users\MekHero\Desktop\srun300.exe"                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\MekHero\Desktop\srun300.exe                                                               5288    
IAStorDataMgrSvc.exe     "C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe"                                                                                                                                                                                                                                                                                                                                             C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe                      5424    
svchost.exe              C:\Windows\System32\svchost.exe -k secsvcs                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\svchost.exe                                                                    5544    
sogouexplorer.exe        "D:\Program Files\SogouExplorer\sogouexplorer.exe"                                                                                                                                                                                                                                                                                                                                                                          D:\Program Files\SogouExplorer\sogouexplorer.exe                                                   4656    
sogouexplorer.exe        "D:\Program Files\SogouExplorer\sogouexplorer.exe" -! 2 1482274962                                                                                                                                                                                                                                                                                                                                                          D:\Program Files\SogouExplorer\sogouexplorer.exe                                                   4728    
sogouexplorer.exe        "D:\Program Files\SogouExplorer\sogouexplorer.exe" -! 0 1521252367 132550                                                                                                                                                                                                                                                                                                                                                   D:\Program Files\SogouExplorer\sogouexplorer.exe                                                   3172    
audiodg.exe                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             4092    
QQ.exe                   "D:\Program Files\Tencent\QQ\Bin\QQ.exe"                                                                                                                                                                                                                                                                                                                                                                                    D:\Program Files\Tencent\QQ\Bin\QQ.exe                                                             3044    
TXPlatform.exe           "d:\Program Files\Tencent\QQ\Bin\TXPlatform.exe" -Embedding                                                                                                                                                                                                                                                                                                                                                                 d:\Program Files\Tencent\QQ\Bin\TXPlatform.exe                                                     2500    
QQExp.exe                "C:\Users\MekHero\AppData\Roaming\Tencent\QQ\Misc\QQExp.exe" 894452789 5 1 "C:\Users\MekHero\AppData\Roaming\Tencent\QQ\Misc\UserSoftReportData" 5000 23 QQ.exe msnmsgr.exe msmsgs.exe AliTalk.exe WangWang.exe 51GG.exe fetionfx.exe Skype.exe uc.exe BaiduHi.exe xntalk.exe 5QIM.exe POPO.exe yahoomessenger.exe gtalk.exe aliim.exe caihong.exe Fetion.exe MyPopo.exe googletalk.exe duospeak.exe sinauc.exe qqtalk.exe  C:\Users\MekHero\AppData\Roaming\Tencent\QQ\Misc\QQExp.exe                                         5848    
TrustedInstaller.exe     C:\Windows\servicing\TrustedInstaller.exe                                                                                                                                                                                                                                                                                                                                                                                   C:\Windows\servicing\TrustedInstaller.exe                                                          6028    
rsmain.exe               "C:\Program Files\Rising\RIS\rsmain.exe"                                                                                                                                                                                                                                                                                                                                                                                    C:\Program Files\Rising\RIS\rsmain.exe                                                             1492    
sogouexplorer.exe        "D:\Program Files\SogouExplorer\sogouexplorer.exe" -! 1 1619115240 394824                                                                                                                                                                                                                                                                                                                                                   D:\Program Files\SogouExplorer\sogouexplorer.exe                                                   4544    
cmd.exe                  "C:\Windows\System32\cmd.exe" /C "C:\Users\MekHero\Desktop\异常信息收集2011\异常信息收集2011.bat"                                                                                                                                                                                                                                                                                                                           C:\Windows\System32\cmd.exe                                                                        5372    
conhost.exe              \??\C:\Windows\system32\conhost.exe                                                                                                                                                                                                                                                                                                                                                                                         C:\Windows\system32\conhost.exe                                                                    2952    
WmiPrvSE.exe             C:\Windows\system32\wbem\wmiprvse.exe                                                                                                                                                                                                                                                                                                                                                                                       C:\Windows\system32\wbem\wmiprvse.exe                                                              6104    
WMIC.exe                 wmic  process get caption,handle,commandline,executablepath                                                                                                                                                                                                                                                                                                                                                                 C:\Windows\System32\Wbem\WMIC.exe                                                                  1948    
