Volatility 3 Framework 2.27.0

PID	PPID	ImageFileName	Offset(V)	Threads	Handles	SessionId	Wow64	CreateTime	ExitTime	File output

4	0	System	0xdd09a7a99040	108	-	N/A	False	2026-09-03 23:35:27.000000 UTC	N/A	Disabled
92	4	Registry	0xdd09a7bb8040	4	-	N/A	False	2026-09-03 23:35:23.000000 UTC	N/A	Disabled
344	4	smss.exe	0xdd09a8783040	2	-	N/A	False	2026-09-03 23:35:27.000000 UTC	N/A	Disabled
436	424	csrss.exe	0xdd09ad9d4080	10	-	0	False	2026-09-03 23:35:37.000000 UTC	N/A	Disabled
512	424	wininit.exe	0xdd09ad318080	1	-	0	False	2026-09-03 23:35:37.000000 UTC	N/A	Disabled
524	504	csrss.exe	0xdd09ad31d140	11	-	1	False	2026-09-03 23:35:37.000000 UTC	N/A	Disabled
584	504	winlogon.exe	0xdd09ae0e8080	5	-	1	False	2026-09-03 23:35:37.000000 UTC	N/A	Disabled
652	512	services.exe	0xdd09adfbf080	8	-	0	False	2026-09-03 23:35:38.000000 UTC	N/A	Disabled
668	512	lsass.exe	0xdd09ae8e2080	8	-	0	False	2026-09-03 23:35:38.000000 UTC	N/A	Disabled
768	652	svchost.exe	0xdd09adc98240	9	-	0	False	2026-09-03 23:35:40.000000 UTC	N/A	Disabled
784	512	fontdrvhost.ex	0xdd09adcaa140	5	-	0	False	2026-09-03 23:35:40.000000 UTC	N/A	Disabled
792	584	fontdrvhost.ex	0xdd09adcac140	5	-	1	False	2026-09-03 23:35:40.000000 UTC	N/A	Disabled
888	652	svchost.exe	0xdd09adac62c0	9	-	0	False	2026-09-03 23:35:40.000000 UTC	N/A	Disabled
932	652	svchost.exe	0xdd09adacb240	5	-	0	False	2026-09-03 23:35:40.000000 UTC	N/A	Disabled
992	584	dwm.exe	0xdd09ae81f080	18	-	1	False	2026-09-03 23:35:41.000000 UTC	N/A	Disabled
728	652	svchost.exe	0xdd09ae885080	5	-	0	False	2026-09-03 23:35:41.000000 UTC	N/A	Disabled
1052	652	svchost.exe	0xdd09ae8c0280	2	-	0	False	2026-09-03 23:35:41.000000 UTC	N/A	Disabled
1080	652	svchost.exe	0xdd09ae8c2300	0	-	0	False	2026-09-03 23:35:41.000000 UTC	2026-09-11 21:07:41.000000 UTC	Disabled
1108	652	svchost.exe	0xdd09ae81e080	2	-	0	False	2026-09-03 23:35:41.000000 UTC	N/A	Disabled
1176	652	svchost.exe	0xdd09ae11d300	6	-	0	False	2026-09-03 23:35:41.000000 UTC	N/A	Disabled
1228	652	svchost.exe	0xdd09ae152240	8	-	0	False	2026-09-03 23:35:41.000000 UTC	N/A	Disabled
1244	652	svchost.exe	0xdd09ae1542c0	3	-	0	False	2026-09-03 23:35:41.000000 UTC	N/A	Disabled
1276	652	svchost.exe	0xdd09ae186240	3	-	0	False	2026-09-03 23:35:41.000000 UTC	N/A	Disabled
1336	652	svchost.exe	0xdd09ae1882c0	3	-	0	False	2026-09-03 23:35:42.000000 UTC	N/A	Disabled
1348	652	svchost.exe	0xdd09ae1cd2c0	2	-	0	False	2026-09-03 23:35:42.000000 UTC	N/A	Disabled
1420	652	svchost.exe	0xdd09ade19240	6	-	0	False	2026-09-03 23:35:42.000000 UTC	N/A	Disabled
1440	652	svchost.exe	0xdd09ade1b300	6	-	0	False	2026-09-03 23:35:42.000000 UTC	N/A	Disabled
1568	652	svchost.exe	0xdd09ade97300	2	-	0	False	2026-09-03 23:35:42.000000 UTC	N/A	Disabled
1632	652	svchost.exe	0xdd09ade1e080	6	-	0	False	2026-09-03 23:35:42.000000 UTC	N/A	Disabled
1704	652	VBoxService.ex	0xdd09ae2c2240	13	-	0	False	2026-09-03 23:35:42.000000 UTC	N/A	Disabled
1800	652	svchost.exe	0xdd09ae2e12c0	5	-	0	False	2026-09-03 23:35:43.000000 UTC	N/A	Disabled
1816	652	svchost.exe	0xdd09ae2e2080	4	-	0	False	2026-09-03 23:35:43.000000 UTC	N/A	Disabled
1840	652	svchost.exe	0xdd09ae2e5240	3	-	0	False	2026-09-03 23:35:43.000000 UTC	N/A	Disabled
1904	652	svchost.exe	0xdd09ae29b2c0	8	-	0	False	2026-09-03 23:35:43.000000 UTC	N/A	Disabled
1944	652	svchost.exe	0xdd09ae271240	2	-	0	False	2026-09-03 23:35:43.000000 UTC	N/A	Disabled
1968	4	MemCompression	0xdd09add29040	30	-	N/A	False	2026-09-03 23:35:43.000000 UTC	N/A	Disabled
1992	652	svchost.exe	0xdd09add2b280	3	-	0	False	2026-09-03 23:35:43.000000 UTC	N/A	Disabled
2012	652	svchost.exe	0xdd09add2d2c0	6	-	0	False	2026-09-03 23:35:43.000000 UTC	N/A	Disabled
2068	652	svchost.exe	0xdd09add2a080	9	-	0	False	2026-09-03 23:35:43.000000 UTC	N/A	Disabled
2228	652	svchost.exe	0xdd09add2e080	2	-	0	False	2026-09-03 23:35:44.000000 UTC	N/A	Disabled
2252	652	svchost.exe	0xdd09add30300	9	-	0	False	2026-09-03 23:35:44.000000 UTC	N/A	Disabled
2272	652	svchost.exe	0xdd09add31080	3	-	0	False	2026-09-03 23:35:44.000000 UTC	N/A	Disabled
2296	652	svchost.exe	0xdd09add32080	4	-	0	False	2026-09-03 23:35:44.000000 UTC	N/A	Disabled
2356	652	svchost.exe	0xdd09ae668240	5	-	0	False	2026-09-03 23:35:44.000000 UTC	N/A	Disabled
2404	652	svchost.exe	0xdd09ae6b2240	3	-	0	False	2026-09-03 23:35:44.000000 UTC	N/A	Disabled
2564	652	spoolsv.exe	0xdd09ae6ed200	7	-	0	False	2026-09-03 23:35:45.000000 UTC	N/A	Disabled
2600	652	svchost.exe	0xdd09ae7852c0	11	-	0	False	2026-09-03 23:35:45.000000 UTC	N/A	Disabled
2652	652	svchost.exe	0xdd09ae78b300	5	-	0	False	2026-09-03 23:35:45.000000 UTC	N/A	Disabled
2816	652	svchost.exe	0xdd09ae5d9300	4	-	0	False	2026-09-03 23:35:46.000000 UTC	N/A	Disabled
2832	652	svchost.exe	0xdd09ae5db240	10	-	0	False	2026-09-03 23:35:46.000000 UTC	N/A	Disabled
2840	652	svchost.exe	0xdd09ae5da080	13	-	0	False	2026-09-03 23:35:46.000000 UTC	N/A	Disabled
2848	652	svchost.exe	0xdd09ae5e7240	11	-	0	False	2026-09-03 23:35:46.000000 UTC	N/A	Disabled
2908	652	svchost.exe	0xdd09ae5eb2c0	2	-	0	False	2026-09-03 23:35:46.000000 UTC	N/A	Disabled
2928	652	svchost.exe	0xdd09ae515240	5	-	0	False	2026-09-03 23:35:46.000000 UTC	N/A	Disabled
2936	652	svchost.exe	0xdd09a7a9b080	5	-	0	False	2026-09-03 23:35:46.000000 UTC	N/A	Disabled
2952	652	svchost.exe	0xdd09ae519140	3	-	0	False	2026-09-03 23:35:47.000000 UTC	N/A	Disabled
2976	652	MsMpEng.exe	0xdd09ae78c080	24	-	0	False	2026-09-03 23:35:47.000000 UTC	N/A	Disabled
2988	652	svchost.exe	0xdd09ae5ea080	3	-	0	False	2026-09-03 23:35:47.000000 UTC	N/A	Disabled
3084	652	svchost.exe	0xdd09ae44e2c0	3	-	0	False	2026-09-03 23:35:48.000000 UTC	N/A	Disabled
3212	652	svchost.exe	0xdd09ae4b6380	12	-	0	False	2026-09-03 23:35:49.000000 UTC	N/A	Disabled
3512	652	SearchIndexer.	0xdd09ae94c240	14	-	0	False	2026-09-03 23:35:51.000000 UTC	N/A	Disabled
3884	652	NisSrv.exe	0xdd09ae786080	4	-	0	False	2026-09-03 23:35:53.000000 UTC	N/A	Disabled
4068	652	svchost.exe	0xdd09aead02c0	4	-	0	False	2026-09-03 23:35:54.000000 UTC	N/A	Disabled
2368	652	svchost.exe	0xdd09aebd4300	6	-	0	False	2026-09-03 23:35:57.000000 UTC	N/A	Disabled
4300	1420	sihost.exe	0xdd09ae34c080	7	-	1	False	2026-09-03 23:36:09.000000 UTC	N/A	Disabled
4320	652	svchost.exe	0xdd09aea90080	9	-	1	False	2026-09-03 23:36:09.000000 UTC	N/A	Disabled
4372	652	svchost.exe	0xdd09a7a60080	3	-	1	False	2026-09-03 23:36:09.000000 UTC	N/A	Disabled
4448	1228	taskhostw.exe	0xdd09ae9482c0	6	-	1	False	2026-09-03 23:36:09.000000 UTC	N/A	Disabled
4480	652	svchost.exe	0xdd09af8a4240	3	-	0	False	2026-09-03 23:36:09.000000 UTC	N/A	Disabled
4616	652	svchost.exe	0xdd09af95b280	4	-	0	False	2026-09-03 23:36:09.000000 UTC	N/A	Disabled
4680	4616	ctfmon.exe	0xdd09aea082c0	10	-	1	False	2026-09-03 23:36:09.000000 UTC	N/A	Disabled
4756	652	svchost.exe	0xdd09af8992c0	8	-	0	False	2026-09-03 23:36:10.000000 UTC	N/A	Disabled
4784	584	userinit.exe	0xdd09af898080	0	-	1	False	2026-09-03 23:36:10.000000 UTC	2026-09-03 23:36:35.000000 UTC	Disabled
4832	4784	explorer.exe	0xdd09af89d080	55	-	1	False	2026-09-03 23:36:10.000000 UTC	N/A	Disabled
5008	652	svchost.exe	0xdd09adf2c080	8	-	1	False	2026-09-03 23:36:11.000000 UTC	N/A	Disabled
4552	768	StartMenuExper	0xdd09afacf080	7	-	1	False	2026-09-03 23:36:15.000000 UTC	N/A	Disabled
4164	768	RuntimeBroker.	0xdd09b00e2080	1	-	1	False	2026-09-03 23:36:16.000000 UTC	N/A	Disabled
5192	768	SearchApp.exe	0xdd09afba1080	40	-	1	False	2026-09-03 23:36:16.000000 UTC	N/A	Disabled
5420	768	RuntimeBroker.	0xdd09b0054340	13	-	1	False	2026-09-03 23:36:17.000000 UTC	N/A	Disabled
5760	768	SkypeBackgroun	0xdd09b00350c0	4	-	1	False	2026-09-03 23:36:18.000000 UTC	N/A	Disabled
5824	768	RuntimeBroker.	0xdd09b00c6340	1	-	1	False	2026-09-03 23:36:19.000000 UTC	N/A	Disabled
1864	4832	SecurityHealth	0xdd09b028e0c0	1	-	1	False	2026-09-03 23:36:28.000000 UTC	N/A	Disabled
1776	652	SecurityHealth	0xdd09b00c10c0	6	-	0	False	2026-09-03 23:36:28.000000 UTC	N/A	Disabled
5740	4832	VBoxTray.exe	0xdd09afe750c0	11	-	1	False	2026-09-03 23:36:28.000000 UTC	N/A	Disabled
2056	4832	OneDrive.exe	0xdd09adf36080	13	-	1	True	2026-09-03 23:36:29.000000 UTC	N/A	Disabled
5352	768	TextInputHost.	0xdd09b037b300	12	-	1	False	2026-09-03 23:36:59.000000 UTC	N/A	Disabled
4788	768	dllhost.exe	0xdd09b008f0c0	5	-	1	False	2026-09-03 23:37:00.000000 UTC	N/A	Disabled
5000	768	ApplicationFra	0xdd09a85660c0	4	-	1	False	2026-09-03 23:37:00.000000 UTC	N/A	Disabled
1020	768	WinStore.App.e	0xdd09ae43f0c0	13	-	1	False	2026-09-03 23:37:00.000000 UTC	N/A	Disabled
2088	768	RuntimeBroker.	0xdd09af959080	1	-	1	False	2026-09-03 23:37:08.000000 UTC	N/A	Disabled
2592	652	svchost.exe	0xdd09aeaab080	1	-	0	False	2026-09-03 23:37:09.000000 UTC	N/A	Disabled
548	652	svchost.exe	0xdd09b0291080	12	-	0	False	2026-09-03 23:37:22.000000 UTC	N/A	Disabled
3620	652	svchost.exe	0xdd09b074c080	6	-	0	False	2026-09-03 23:37:22.000000 UTC	N/A	Disabled
5912	652	SgrmBroker.exe	0xdd09b02c20c0	6	-	0	False	2026-09-03 23:37:50.000000 UTC	N/A	Disabled
3040	652	svchost.exe	0xdd09ad87f280	3	-	0	False	2026-09-03 23:37:51.000000 UTC	N/A	Disabled
1384	652	svchost.exe	0xdd09b0204080	8	-	0	False	2026-09-03 23:37:51.000000 UTC	N/A	Disabled
3400	652	svchost.exe	0xdd09ad9fa300	8	-	0	False	2026-09-03 23:37:51.000000 UTC	N/A	Disabled
6220	652	svchost.exe	0xdd09b04f5340	3	-	1	False	2026-09-03 23:37:51.000000 UTC	N/A	Disabled
6796	652	svchost.exe	0xdd09a8f88080	2	-	0	False	2026-09-03 23:38:04.000000 UTC	N/A	Disabled
3988	652	svchost.exe	0xdd09ad434080	0	-	0	False	2026-09-03 23:38:43.000000 UTC	2026-09-03 23:38:49.000000 UTC	Disabled
7164	4832	cmd.exe	0xdd09b029e080	1	-	1	False	2026-09-03 23:39:11.000000 UTC	N/A	Disabled
7140	7164	conhost.exe	0xdd09a8f82080	4	-	1	False	2026-09-03 23:39:11.000000 UTC	N/A	Disabled
404	768	ShellExperienc	0xdd09b0749080	10	-	1	False	2026-09-04 00:35:22.000000 UTC	N/A	Disabled
5900	768	RuntimeBroker.	0xdd09ae861080	2	-	1	False	2026-09-04 00:35:26.000000 UTC	N/A	Disabled
2788	652	svchost.exe	0xdd09b05a5280	8	-	0	False	2026-09-11 21:07:50.000000 UTC	N/A	Disabled
3392	652	svchost.exe	0xdd09ad3ac240	3	-	0	False	2026-09-11 21:07:52.000000 UTC	N/A	Disabled
3548	652	svchost.exe	0xdd09afdac340	3	-	0	False	2026-09-11 21:34:18.000000 UTC	N/A	Disabled
5784	7164	notepad.exe	0xdd09afd5b340	2	-	1	False	2026-09-11 21:49:21.000000 UTC	N/A	Disabled
2104	7164	notepad.exe	0xdd09b053e340	2	-	1	False	2026-09-11 22:06:32.000000 UTC	N/A	Disabled
6752	4832	powershell.exe	0xdd09b0714340	10	-	1	False	2026-09-11 22:09:19.000000 UTC	N/A	Disabled
396	6752	conhost.exe	0xdd09b010b340	4	-	1	False	2026-09-11 22:09:20.000000 UTC	N/A	Disabled
2668	652	svchost.exe	0xdd09b071d340	1	-	0	False	2026-09-11 22:19:13.000000 UTC	N/A	Disabled
1688	6752	go-winpmem_amd	0xdd09b04b0340	8	-	1	False	2026-09-11 22:22:13.000000 UTC	N/A	Disabled
5164	2976	svchost.exe	0xdd09a83d4340	0	-	0	False	2026-09-11 22:22:14.000000 UTC	2026-09-11 22:22:16.000000 UTC	Disabled
1036	652	svchost.exe	0xdd09b0378080	5	-	0	False	2026-09-11 22:19:13.000000 UTC	N/A	Disabled
