Volatility 3 Framework 2.27.0

PID	Process	Args

4	System	-
92	Registry	-
344	smss.exe	\SystemRoot\System32\smss.exe
436	csrss.exe	%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
512	wininit.exe	wininit.exe
524	csrss.exe	%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
584	winlogon.exe	winlogon.exe
652	services.exe	C:\Windows\system32\services.exe
668	lsass.exe	C:\Windows\system32\lsass.exe
768	svchost.exe	C:\Windows\system32\svchost.exe -k DcomLaunch -p
784	fontdrvhost.ex	"fontdrvhost.exe"
792	fontdrvhost.ex	"fontdrvhost.exe"
888	svchost.exe	C:\Windows\system32\svchost.exe -k RPCSS -p
932	svchost.exe	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
992	dwm.exe	"dwm.exe"
728	svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
1052	svchost.exe	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1080	svchost.exe	-
1108	svchost.exe	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1176	svchost.exe	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1228	svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1244	svchost.exe	C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1276	svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1336	svchost.exe	C:\Windows\system32\svchost.exe -k LocalService -p
1348	svchost.exe	C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1420	svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1440	svchost.exe	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1568	svchost.exe	C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1632	svchost.exe	C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1704	VBoxService.ex	C:\Windows\System32\VBoxService.exe
1800	svchost.exe	C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1816	svchost.exe	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s SysMain
1840	svchost.exe	C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1904	svchost.exe	C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1944	svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1968	MemCompression	-
1992	svchost.exe	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
2012	svchost.exe	C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
2068	svchost.exe	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
2228	svchost.exe	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
2252	svchost.exe	C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
2272	svchost.exe	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
2296	svchost.exe	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
2356	svchost.exe	C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
2404	svchost.exe	C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
2564	spoolsv.exe	C:\Windows\System32\spoolsv.exe
2600	svchost.exe	C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
2652	svchost.exe	C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
2816	svchost.exe	C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
2832	svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
2840	svchost.exe	C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork -p -s DPS
2848	svchost.exe	C:\Windows\System32\svchost.exe -k utcsvc -p
2908	svchost.exe	C:\Windows\system32\svchost.exe -k LocalService -p -s SstpSvc
2928	svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
2936	svchost.exe	C:\Windows\System32\svchost.exe -k NetSvcs -p -s iphlpsvc
2952	svchost.exe	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
2976	MsMpEng.exe	"C:\Program Files\Windows Defender\MsMpEng.exe"
2988	svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
3084	svchost.exe	C:\Windows\System32\svchost.exe -k LocalService -p -s WdiServiceHost
3212	svchost.exe	C:\Windows\System32\svchost.exe -k netsvcs
3512	SearchIndexer.	C:\Windows\system32\SearchIndexer.exe /Embedding
3884	NisSrv.exe	"C:\Program Files\Windows Defender\NisSrv.exe"
4068	svchost.exe	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
2368	svchost.exe	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
4300	sihost.exe	sihost.exe
4320	svchost.exe	C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
4372	svchost.exe	C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService
4448	taskhostw.exe	taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
4480	svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
4616	svchost.exe	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TabletInputService
4680	ctfmon.exe	"ctfmon.exe"
4756	svchost.exe	C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
4784	userinit.exe	-
4832	explorer.exe	C:\Windows\Explorer.EXE
5008	svchost.exe	C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
4552	StartMenuExper	"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
4164	RuntimeBroker.	C:\Windows\System32\RuntimeBroker.exe -Embedding
5192	SearchApp.exe	"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
5420	RuntimeBroker.	C:\Windows\System32\RuntimeBroker.exe -Embedding
5760	SkypeBackgroun	"C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe" -ServerName:SkypeBackgroundHost
5824	RuntimeBroker.	C:\Windows\System32\RuntimeBroker.exe -Embedding
1864	SecurityHealth	"C:\Windows\System32\SecurityHealthSystray.exe" 
1776	SecurityHealth	C:\Windows\system32\SecurityHealthService.exe
5740	VBoxTray.exe	"C:\Windows\System32\VBoxTray.exe" 
2056	OneDrive.exe	"C:\Users\forensicuser\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
5352	TextInputHost.	"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca
4788	dllhost.exe	C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
5000	ApplicationFra	C:\Windows\system32\ApplicationFrameHost.exe -Embedding
1020	WinStore.App.e	"C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe" -ServerName:App.AppXc75wvwned5vhz4xyxxecvgdjhdkgsdza.mca
2088	RuntimeBroker.	C:\Windows\System32\RuntimeBroker.exe -Embedding
2592	svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
548	svchost.exe	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
3620	svchost.exe	C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
5912	SgrmBroker.exe	C:\Windows\system32\SgrmBroker.exe
3040	svchost.exe	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1384	svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
3400	svchost.exe	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
6220	svchost.exe	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
6796	svchost.exe	C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc
3988	svchost.exe	-
7164	cmd.exe	"C:\Windows\system32\cmd.exe" 
7140	conhost.exe	\??\C:\Windows\system32\conhost.exe 0x4
404	ShellExperienc	"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
5900	RuntimeBroker.	C:\Windows\System32\RuntimeBroker.exe -Embedding
2788	svchost.exe	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
3392	svchost.exe	C:\Windows\System32\svchost.exe -k netsvcs -p
3548	svchost.exe	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
5784	notepad.exe	notepad  C:\T1_Simulator.ps1
2104	notepad.exe	notepad  C:\T1_Simulator.ps1
6752	powershell.exe	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" 
396	conhost.exe	\??\C:\Windows\system32\conhost.exe 0x4
2668	svchost.exe	C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC
1688	go-winpmem_amd	"Z:\go-winpmem_amd64_1.0-rc2_signed.exe" acquire --nosparse Z:\WIN10_T3_POST.raw
5164	svchost.exe	-
1036	svchost.exe	-
