name CommandLine

---- -----------
avp.exe "C:\Program Files (x86)\Kaspersky Lab\Kaspersky
Endpoint Security for
Windows\avp.exe" -r
avpsus.exe "C:\Program Files (x86)\Kaspersky Lab\Kaspersky
Endpoint Security for
Windows\avpsus.exe"
avpui.exe "C:\Program Files (x86)\Kaspersky Lab\Kaspersky
Endpoint Security for
Windows\avpui.exe" -splash
cb.exe C:\Windows\CarbonBlack\cb.exe
cmd.exe "C:\Windows\system32\cmd.exe"
cmd.exe "C:\Windows\System32\cmd.exe"
conhost.exe \??\C:\Windows\system32\conhost.exe 0x4
conhost.exe \??\C:\Windows\system32\conhost.exe 0x4
conhost.exe \??\C:\Windows\system32\conhost.exe 0x4
conhost.exe \??\C:\Windows\system32\conhost.exe 0x4
conhost.exe \??\C:\Windows\system32\conhost.exe 0x4
conhost.exe \??\C:\Windows\system32\conhost.exe 0x4
conhost.exe \??\C:\Windows\system32\conhost.exe 0x4
csrss.exe
csrss.exe
csrss.exe
dllhost.exe C:\Windows\system32\DllHost.exe /Processid:
{3EB3C877-1F16-487C-9050-104DBCD66683}
dllhost.exe C:\Windows\system32\dllhost.exe /Processid:
{02D4B3F1-FD88-11D1-960D-00805FC79235}
dwm.exe "dwm.exe"
dwm.exe "dwm.exe"
explorer.exe "C:\Windows\explorer.exe" /LOADSAVEDWINDOWS
inetinfo.exe C:\Windows\system32\inetsrv\inetinfo.exe
InetMgr.exe "C:\Windows\system32\inetsrv\InetMgr.exe"
IOffice Connector Organ.exe "D:\Tool-Dong-Bo\Organ\IOffice-Connector\bin\
Release\IOffice Connector Organ.exe"
IOffice Connector RecvEdoc.exe "D:\Tool-Dong-Bo\RecvEdoc\IOffice-Connector\bin\
Release\IOffice Connector
RecvEdoc.exe"
IOffice Connector RecvStatus.exe "D:\Tool-Dong-Bo\RecvStatus\IOffice-Connector\bin\
Release1\IOffice Connector
RecvStatus.exe"
IOffice Connector SendEdoc.exe "D:\Tool-Dong-Bo\SendEdoc\IOffice-Connector\bin\
Release1\IOffice Connector
SendEdoc.exe"
IOffice Connector SendStatus.exe "D:\Tool-Dong-Bo\SendStatus\IOffice-Connector\bin\
Release1\IOffice Connector
SendStatus.exe"
jucheck.exe "C:\Program Files (x86)\Common Files\Java\Java
Update\jucheck.exe" -auto -critical
jusched.exe "C:\Program Files (x86)\Common Files\Java\Java
Update\jusched.exe"
klnagent.exe "C:\Program Files (x86)\Kaspersky Lab\
NetworkAgent\klnagent.exe"
LogonUI.exe "LogonUI.exe" /flags:0x0
lsass.exe C:\Windows\system32\lsass.exe
ManagementAgentHost.exe "C:\Program Files\VMware\VMware Tools\VMware CAF\
pme\bin\ManagementAgentHost.exe"
mmc.exe "C:\Windows\system32\mmc.exe" "C:\Windows\
system32\taskschd.msc" /s
mmc.exe "C:\Windows\system32\mmc.exe" "C:\Windows\
system32\eventvwr.msc" /s
msdtc.exe C:\Windows\System32\msdtc.exe
nfsclnt.exe C:\Windows\system32\nfsclnt.exe
notepad.exe "C:\Windows\system32\NOTEPAD.EXE" D:\115.txt
notepad.exe "C:\Windows\system32\NOTEPAD.EXE" D:\114.txt
notepad++.exe "C:\Program Files\Notepad++\notepad++.exe" "C:\
Deploy\20240320\IT360-1078352.sql"
plsqldev.exe "C:\Program Files\PLSQL Developer 12\plsqldev.exe"
plsqldev.exe "C:\Program Files\PLSQL Developer 12\plsqldev.exe"
plsqldev.exe "C:\Program Files\PLSQL Developer 12\plsqldev.exe"
plsqldev.exe "C:\Program Files\PLSQL Developer 12\plsqldev.exe"
powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\
powershell.exe
C:\Backup\bot\test_request_max.ps1
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\
powershell.exe"
powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\
powershell.exe"
python.exe "c:\salt\bin\python.exe" -E -s c:\salt\bin\
Scripts\salt-minion -c c:\salt\conf -l
quiet
python.exe "c:\salt\bin\python.exe" "-s" "-E" "-c" "from
multiprocessing.forking import main;
main()" "--multiprocessing-fork" "1012"
rdpclip.exe rdpclip
services.exe
smss.exe
sqlwriter.exe "C:\Program Files\Microsoft SQL Server\90\Shared\
sqlwriter.exe"
ssm.exe c:\salt\bin\ssm.exe
svchost.exe C:\Windows\System32\svchost.exe -k termsvcs
svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
svchost.exe C:\Windows\System32\svchost.exe -k
LocalSystemNetworkRestricted
svchost.exe C:\Windows\system32\svchost.exe -k iissvcs
svchost.exe C:\Windows\system32\svchost.exe -k
NetworkServiceNetworkRestricted
svchost.exe C:\Windows\system32\svchost.exe -k
LocalServiceNoNetwork
svchost.exe C:\Windows\System32\svchost.exe -k utcsvc
svchost.exe C:\Windows\system32\svchost.exe -k NetworkService
svchost.exe C:\Windows\system32\svchost.exe -k LocalService
svchost.exe C:\Windows\system32\svchost.exe -k apphost
svchost.exe C:\Windows\system32\svchost.exe -k RPCSS
svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch
svchost.exe C:\Windows\system32\svchost.exe -k
LocalServiceAndNoImpersonation
svchost.exe C:\Windows\system32\svchost.exe -k netsvcs
svchost.exe C:\Windows\System32\svchost.exe -k
LocalServiceNetworkRestricted
System
System Idle Process
taskeng.exe taskeng.exe {B2261995-6444-40AF-A1C0-327CBC58200F}
taskhostex.exe taskhostex.exe
Taskmgr.exe "C:\Windows\system32\taskmgr.exe" /4
UniKeyNT.exe "C:\Program Files\Unikey\UniKeyNT.exe"
unsecapp.exe C:\Windows\system32\wbem\unsecapp.exe -Embedding
vapm.exe "C:\Program Files (x86)\Kaspersky Lab\
NetworkAgent\vapm.exe"
VGAuthService.exe "C:\Program Files\VMware\VMware Tools\VMware
VGAuth\VGAuthService.exe"
vmtoolsd.exe "C:\Program Files\VMware\VMware Tools\
vmtoolsd.exe"
w3wp.exe c:\windows\system32\inetsrv\w3wp.exe -ap
"EDOC_POOL_01" -v "v4.0" -l "webengine4.dll"
-a \\.\pipe\iisipm6c746934-f09a-4970-ad56-
9cdd9fa6e224 -h
"C:\inetpub\temp\apppools\EDOC_POOL_01\
EDOC_POOL_01.config" -w "" -m 0 -t 20 -ta 0
w3wp.exe c:\windows\system32\inetsrv\w3wp.exe -ap
"EDOC_POOL_02" -v "v4.0" -l "webengine4.dll"
-a \\.\pipe\iisipm0696c43f-58fb-4be2-a372-
095f74954ee5 -h
"C:\inetpub\temp\apppools\EDOC_POOL_02\
EDOC_POOL_02.config" -w "" -m 0 -t 20 -ta 0
w3wp.exe c:\windows\system32\inetsrv\w3wp.exe -ap "bentre"
-v "v4.0" -l "webengine4.dll" -a
\\.\pipe\iisipmccec577c-d8d5-4ddf-86d4-
caa37ee8c6e6 -h
"C:\inetpub\temp\apppools\bentre\bentre.config" -w
"" -m 0 -t 20 -ta 0
w3wp.exe c:\windows\system32\inetsrv\w3wp.exe -ap "phuyen"
-v "v4.0" -l "webengine4.dll" -a
\\.\pipe\iisipm01fa7036-0cc4-4254-a4b8-
20877f0b49c1 -h
"C:\inetpub\temp\apppools\phuyen\phuyen.config" -w
"" -m 0 -t 20 -ta 0
w3wp.exe c:\windows\system32\inetsrv\w3wp.exe -ap "nghean"
-v "v4.0" -l "webengine4.dll" -a
\\.\pipe\iisipmf1e9c63a-447a-45e3-9ed1-
a33ddbf4aa2d -h
"C:\inetpub\temp\apppools\nghean\nghean.config" -w
"" -m 0 -t 20 -ta 0
w3wp.exe c:\windows\system32\inetsrv\w3wp.exe -ap
"vpdt_pass" -v "v4.0" -l "webengine4.dll" -a
\\.\pipe\iisipmcb68ca36-56b0-487b-af91-
5c42d4cebbd4 -h
"C:\inetpub\temp\apppools\vpdt_pass\
vpdt_pass.config" -w "" -m 0 -t 20 -ta 0
w3wp.exe c:\windows\system32\inetsrv\w3wp.exe -ap
"edoc_vicem_web" -v "v4.0" -l
"webengine4.dll" -a \\.\pipe\iisipmf5cddc4f-606b-
4404-b236-1e06493dcbf3 -h
"C:\inetpub\temp\apppools\edoc_vicem_web\
edoc_vicem_web.config" -w "" -m 0 -t 20 -ta 0
w3wp.exe c:\windows\system32\inetsrv\w3wp.exe -ap "lamdong"
-v "v4.0" -l "webengine4.dll" -a
\\.\pipe\iisipm31fa7e9a-feb5-48e4-b601-
93a5f3fa1d0b -h
"C:\inetpub\temp\apppools\lamdong\lamdong.config"
-w "" -m 0 -t 20 -ta 0
w3wp.exe c:\windows\system32\inetsrv\w3wp.exe -ap
"binhphuoc" -v "v4.0" -l "webengine4.dll" -a
\\.\pipe\iisipm5fbd7edf-ef24-4549-8d53-
928bff426c86 -h
"C:\inetpub\temp\apppools\binhphuoc\
binhphuoc.config" -w "" -m 0 -t 20 -ta 0
w3wp.exe c:\windows\system32\inetsrv\w3wp.exe -ap
"DefaultAppPool" -v "v4.0" -l
"webengine4.dll" -a \\.\pipe\iisipmbf0fea5e-99e0-
4550-bd38-8b62d14535b1 -h
"C:\inetpub\temp\apppools\DefaultAppPool\
DefaultAppPool.config" -w "" -m 0 -t 20 -ta 0
w3wp.exe c:\windows\system32\inetsrv\w3wp.exe -ap "travinh"
-v "v4.0" -l "webengine4.dll" -a
\\.\pipe\iisipm2239c90f-58b1-4440-8427-
e75c13f02c1c -h
"C:\inetpub\temp\apppools\travinh\travinh.config"
-w "" -m 0 -t 20 -ta 0
WinCollect.exe WinCollect.exe
WinCollectSvc.exe "C:\Program Files\IBM\WinCollect\bin\
WinCollectSvc.exe"
wininit.exe wininit.exe
winlogon.exe winlogon.exe
winlogon.exe winlogon.exe
WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe
WmiPrvSE.exe C:\Windows\sysWOW64\wbem\wmiprvse.exe -Embedding
WUDFHost.exe "C:\Windows\System32\WUDFHost.exe" -HostGUID:
{193a1820-d9ac-4997-8c55-be817523f6aa}
-IoEventPortName:HostProcess-26a53e07-b889-4b82-
abf4-70b4a6dbe10d
-SystemEventPortName:HostProcess-c1242a95-0f92-
481e-b7e2-a5222e7bb961
-IoCancelEventPortName:HostProcess-1a2761d1-84f9-
47b0-9d2a-4b845735ccfc
-NonStateChangingEventPortName:HostProcess-
3680eb38-e2f1-4c75-9db2-f4283a0c1178
-ServiceSID:S-1-5-80-2652678385-582572993-
1835434367-1344795993-749280709
-LifetimeId:42c006bc-9efb-441f-b5d6-281d1f798d0d -
DeviceGroupId:WpdFsGroup
zabbix_agentd.exe "C:\Program Files\Zabbix Agent\zabbix_agentd.exe"
--config "C:\Program Files\Zabbix
Agent\zabbix_agentd.conf"