Caption                    CommandLine                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     ExecutablePath                                                                            Handle  
System Idle Process                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  0       
System                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               4       
smss.exe                   \SystemRoot\System32\smss.exe                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             348     
csrss.exe                  %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16                                                                                                                                                                                                              C:\Windows\system32\csrss.exe                                                             552     
wininit.exe                wininit.exe                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     C:\Windows\system32\wininit.exe                                                           624     
csrss.exe                  %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16                                                                                                                                                                                                              C:\Windows\system32\csrss.exe                                                             632     
winlogon.exe               winlogon.exe                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\winlogon.exe                                                          688     
services.exe               C:\Windows\system32\services.exe                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\services.exe                                                          728     
lsass.exe                  C:\Windows\system32\lsass.exe                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   C:\Windows\system32\lsass.exe                                                             736     
lsm.exe                    C:\Windows\system32\lsm.exe                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     C:\Windows\system32\lsm.exe                                                               748     
svchost.exe                C:\Windows\system32\svchost.exe -k DcomLaunch                                                                                                                                                                                                                                                                                                                                                                                                                                                                   C:\Windows\system32\svchost.exe                                                           844     
nvvsvc.exe                 C:\Windows\system32\nvvsvc.exe                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\nvvsvc.exe                                                            908     
svchost.exe                C:\Windows\system32\svchost.exe -k RPCSS                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\svchost.exe                                                           948     
RsMgrSvc.exe               "C:\Program Files\Rising\RSD\RsMgrSvc.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Program Files\Rising\RSD\RsMgrSvc.exe                                                  1036    
ravmond.exe                "C:\Program Files\Rising\RAV\ravmond.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                                                       C:\Program Files\Rising\RAV\ravmond.exe                                                   1104    
ravmond.exe                "C:\Program Files\Rising\RFW\ravmond.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                                                       C:\Program Files\Rising\RFW\ravmond.exe                                                   1160    
svchost.exe                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\svchost.exe                                                           1208    
svchost.exe                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted                                                                                                                                                                                                                                                                                                                                                                                                                                                 C:\Windows\System32\svchost.exe                                                           1248    
svchost.exe                C:\Windows\system32\svchost.exe -k netsvcs                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\svchost.exe                                                           1304    
svchost.exe                C:\Windows\system32\svchost.exe -k LocalService                                                                                                                                                                                                                                                                                                                                                                                                                                                                 C:\Windows\system32\svchost.exe                                                           1444    
svchost.exe                C:\Windows\system32\svchost.exe -k NetworkService                                                                                                                                                                                                                                                                                                                                                                                                                                                               C:\Windows\system32\svchost.exe                                                           1628    
nvxdsync.exe               "C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe                                  1940    
nvvsvc.exe                 C:\Windows\system32\nvvsvc.exe -session -first                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\nvvsvc.exe                                                            1952    
spoolsv.exe                C:\Windows\System32\spoolsv.exe                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 C:\Windows\System32\spoolsv.exe                                                           2016    
svchost.exe                C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation                                                                                                                                                                                                                                                                                                                                                                                                                                               C:\Windows\system32\svchost.exe                                                           496     
svchost.exe                C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\svchost.exe                                                           460     
BOCKeyMon.exe              "C:\Windows\system32\WatchData\Watchdata BOC CSP v3.3\BOCKeyMon.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\WatchData\Watchdata BOC CSP v3.3\BOCKeyMon.exe                        2152    
CAJSHost.exe               "C:\Program Files\TTKN\CAJVD\CAJSHost.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Program Files\TTKN\CAJVD\CAJSHost.exe                                                  2176    
DhMachineSvc.exe           "C:\Program Files\Microsoft Device Health\DhMachineSvc.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                                     C:\Program Files\Microsoft Device Health\DhMachineSvc.exe                                 2280    
DhPluginMgr.exe            "C:\Program Files\Microsoft Device Health\PluginManager\DhPluginMgr.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Program Files\Microsoft Device Health\PluginManager\DhPluginMgr.exe                    2380    
HZ_CommSrv.exe             C:\Windows\system32\HZ_CommSrv.exe                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\HZ_CommSrv.exe                                                        2572    
knatsvc.exe                "D:\Program Files\kingsoft\kwifi\knatsvc.exe" /service knatsvc                                                                                                                                                                                                                                                                                                                                                                                                                                                  D:\Program Files\kingsoft\kwifi\knatsvc.exe                                               2656    
mitsijm.exe                "C:\Program Files\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Program Files\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe                          2752    
PMBDeviceInfoProvider.exe  "C:\Program Files\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                             C:\Program Files\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe                         2924    
secbizsrv.exe              "C:\Program Files\alipay\aliedit\5.3.0.3807\secbizsrv.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Program Files\alipay\aliedit\5.3.0.3807\secbizsrv.exe                                  2956    
snmp.exe                   C:\Windows\System32\snmp.exe                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\snmp.exe                                                              2988    
TBSecSvc.exe               "C:\Program Files\TaobaoProtect\TBSecSvc.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                                                   C:\Program Files\TaobaoProtect\TBSecSvc.exe                                               3040    
webboost.exe               "C:\Program Files\rsafebrowser\webboost.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Program Files\rsafebrowser\webboost.exe                                                3096    
ExtraService.exe           extraservice.exe                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Program Files\rsafebrowser\extraservice.exe                                            3164    
svchost.exe                C:\Windows\system32\svchost -k XLServicePlatform                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\svchost.exe                                                           3212    
WmiPrvSE.exe               C:\Windows\system32\wbem\wmiprvse.exe                                                                                                                                                                                                                                                                                                                                                                                                                                                                           C:\Windows\system32\wbem\wmiprvse.exe                                                     3416    
WUDFHost.exe               "C:\Windows\system32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:HostProcess-4bf2a49c-0f31-4f9e-980d-67086e64ee91 -SystemEventPortName:HostProcess-e5df3b96-6b55-4a60-a398-8ecc4d470a73 -IoCancelEventPortName:HostProcess-7ef2df58-477b-4122-9300-bd1bc3eb3b9e -NonStateChangingEventPortName:HostProcess-a992c4bf-7f28-4f07-8ae3-4c8070c3ea5b -ServiceSID:S-1-5-80-2652678385-582572993-1835434367-1344795993-749280709 -LifetimeId:42adb331-5b31-4311-b288-e6ead03cdb32  C:\Windows\system32\WUDFHost.exe                                                          3952    
unsecapp.exe               C:\Windows\system32\wbem\unsecapp.exe -Embedding                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\wbem\unsecapp.exe                                                     4016    
svchost.exe                C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe                                                           2668    
taskhost.exe               "taskhost.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\taskhost.exe                                                          2536    
dwm.exe                    "C:\Windows\system32\Dwm.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   C:\Windows\system32\Dwm.exe                                                               3944    
explorer.exe               C:\Windows\Explorer.EXE                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         C:\Windows\Explorer.EXE                                                                   784     
aliwssv.exe                "C:\Program Files\alipay\aliedit\5.3.0.3807\aliwssv.exe" /W                                                                                                                                                                                                                                                                                                                                                                                                                                                     C:\Program Files\alipay\aliedit\5.3.0.3807\aliwssv.exe                                    3024    
conhost.exe                \??\C:\Windows\system32\conhost.exe "-1616206876-1651118789276781695720990611878481329-1585573369-1843180188-124638420                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\conhost.exe                                                           3032    
TaobaoProtect.exe          C:\Users\Administrator\AppData\Roaming\TaobaoProtect\TaobaoProtect.exe                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Administrator\AppData\Roaming\TaobaoProtect\TaobaoProtect.exe                    3060    
ThunderPlatform.exe        -AutoRun                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        c:\program files\common files\thunder network\tp\ver1\1.1.2.256_1111\thunderplatform.exe  4360    
CCBCertificate.exe         "C:\Program Files\CCBComponents\DMWZ\CCBCertificate.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Program Files\CCBComponents\DMWZ\CCBCertificate.exe                                    4700    
USBKeyTools.exe            "C:\Program Files\CCBComponents\HDZB\USBKeyTools.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                                           C:\Program Files\CCBComponents\HDZB\USBKeyTools.exe                                       4732    
SogouCloud.exe             "D:\软件安装\SogouInput\7.7.0.6390\SogouCloud.exe" -daemon                                                                                                                                                                                                                                                                                                                                                                                                                                                      D:\软件安装\SogouInput\7.7.0.6390\SogouCloud.exe                                          4768    
WDCertM_CCB.exe            "C:\Windows\System32\WatchData\Watchdata CCB OCL CSP v3.2\WDCertM_CCB.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\System32\WatchData\Watchdata CCB OCL CSP v3.2\WDCertM_CCB.exe                  4776    
PMBVolumeWatcher.exe       "C:\Program Files\Sony\PlayMemories Home\PMBVolumeWatcher.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Program Files\Sony\PlayMemories Home\PMBVolumeWatcher.exe                              4848    
rstray.exe                 "C:\Program Files\Rising\RAV\rstray.exe" -system                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Program Files\Rising\RAV\rstray.exe                                                    4936    
rstray.exe                 "C:\Program Files\Rising\RFW\rstray.exe" -system                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Program Files\Rising\RFW\rstray.exe                                                    5016    
rsturboball.exe            "C:\Program Files\Rising\RAV\rsturboball.exe" -system                                                                                                                                                                                                                                                                                                                                                                                                                                                           C:\Program Files\Rising\RAV\rsturboball.exe                                               5056    
netsession_win.exe         "C:\Users\Administrator\AppData\Local\Akamai\netsession_win.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Administrator\AppData\Local\Akamai\netsession_win.exe                            5268    
AdSync.exe                 "C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe                                        5604    
xmp.exe                    "C:\Users\Public\Thunder Network\XMP4\Core\Program\xmp.exe" /embedding /sstartfrom Startup101                                                                                                                                                                                                                                                                                                                                                                                                                   C:\Users\Public\Thunder Network\XMP4\Core\Program\xmp.exe                                 5636    
netsession_win.exe         "C:/Users/Administrator/AppData/Local/Akamai/netsession_win.exe" --client                                                                                                                                                                                                                                                                                                                                                                                                                                       C:\Users\Administrator\AppData\Local\Akamai\netsession_win.exe                            5644    
wmpnetwk.exe               "C:\Program Files\Windows Media Player\wmpnetwk.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Program Files\Windows Media Player\wmpnetwk.exe                                        7952    
Alipaybsm.exe              "C:\ProgramData\alipay\Alipaybsm.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                                                           C:\ProgramData\alipay\Alipaybsm.exe                                                       6224    
tray.exe                   "C:\Program Files\Rising\RAD\tray.exe" -system                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Program Files\Rising\RAD\tray.exe                                                      8672    
tray_proxy(2626).exe       "C:\Program Files\Rising\RAD\tray_proxy(2626).exe" -system                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Program Files\Rising\RAD\tray_proxy(2626).exe                                          8680    
msiexec.exe                C:\Windows\system32\msiexec.exe /V                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\msiexec.exe                                                           10188   
rundll32.exe               "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\WININET.dll",DispatchAPICall 1                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\rundll32.exe                                                          6028    
QQProtect.exe              "C:\Program Files\Common Files\Tencent\QQProtect\Bin\QQProtect.exe"                                                                                                                                                                                                                                                                                                                                                                                                                                             C:\Program Files\Common Files\Tencent\QQProtect\Bin\QQProtect.exe                         10268   
audiodg.exe                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          11916   
cmd.exe                    cmd /c ""C:\Users\Administrator\Downloads\异常信息收集2011.bat" "                                                                                                                                                                                                                                                                                                                                                                                                                                               C:\Windows\system32\cmd.exe                                                               568     
conhost.exe                \??\C:\Windows\system32\conhost.exe "922775211-852644486-1279060367524827290-17901982282140232418-972186240-960672757                                                                                                                                                                                                                                                                                                                                                                                           C:\Windows\system32\conhost.exe                                                           10196   
TrustedInstaller.exe       C:\Windows\servicing\TrustedInstaller.exe                                                                                                                                                                                                                                                                                                                                                                                                                                                                       C:\Windows\servicing\TrustedInstaller.exe                                                 6632    
taskeng.exe                taskeng.exe {DC588A52-18A6-49E2-870A-C9A9FBB5134D}                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\taskeng.exe                                                           11840   
WMIC.exe                   wmic  process get caption,handle,commandline,executablepath                                                                                                                                                                                                                                                                                                                                                                                                                                                     C:\Windows\System32\Wbem\WMIC.exe                                                         8628    
