Volatility 3 Framework 2.27.0

PID	PPID	ImageFileName	Offset(V)	Threads	Handles	SessionId	Wow64	CreateTime	ExitTime	Audit	Cmd	Path

4	0	System	0xdd09a7a99040	108	-	N/A	False	2026-09-03 23:35:27.000000 UTC	N/A	-	-	-
* 344	4	smss.exe	0xdd09a8783040	2	-	N/A	False	2026-09-03 23:35:27.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\smss.exe	\SystemRoot\System32\smss.exe	\SystemRoot\System32\smss.exe
* 92	4	Registry	0xdd09a7bb8040	4	-	N/A	False	2026-09-03 23:35:23.000000 UTC	N/A	Registry	-	-
* 1968	4	MemCompression	0xdd09add29040	30	-	N/A	False	2026-09-03 23:35:43.000000 UTC	N/A	MemCompression	-	-
436	424	csrss.exe	0xdd09ad9d4080	10	-	0	False	2026-09-03 23:35:37.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\csrss.exe	%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16	C:\Windows\system32\csrss.exe
512	424	wininit.exe	0xdd09ad318080	1	-	0	False	2026-09-03 23:35:37.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\wininit.exe	wininit.exe	C:\Windows\system32\wininit.exe
* 784	512	fontdrvhost.ex	0xdd09adcaa140	5	-	0	False	2026-09-03 23:35:40.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\fontdrvhost.exe	"fontdrvhost.exe"	C:\Windows\system32\fontdrvhost.exe
* 668	512	lsass.exe	0xdd09ae8e2080	8	-	0	False	2026-09-03 23:35:38.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\lsass.exe	C:\Windows\system32\lsass.exe	C:\Windows\system32\lsass.exe
* 652	512	services.exe	0xdd09adfbf080	8	-	0	False	2026-09-03 23:35:38.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\services.exe	C:\Windows\system32\services.exe	C:\Windows\system32\services.exe
** 768	652	svchost.exe	0xdd09adc98240	9	-	0	False	2026-09-03 23:35:40.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k DcomLaunch -p	C:\Windows\system32\svchost.exe
*** 5760	768	SkypeBackgroun	0xdd09b00350c0	4	-	1	False	2026-09-03 23:36:18.000000 UTC	N/A	\Device\HarddiskVolume2\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe	"C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe" -ServerName:SkypeBackgroundHost	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe
*** 5824	768	RuntimeBroker.	0xdd09b00c6340	1	-	1	False	2026-09-03 23:36:19.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\RuntimeBroker.exe	C:\Windows\System32\RuntimeBroker.exe -Embedding	C:\Windows\System32\RuntimeBroker.exe
*** 4164	768	RuntimeBroker.	0xdd09b00e2080	1	-	1	False	2026-09-03 23:36:16.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\RuntimeBroker.exe	C:\Windows\System32\RuntimeBroker.exe -Embedding	C:\Windows\System32\RuntimeBroker.exe
*** 4552	768	StartMenuExper	0xdd09afacf080	7	-	1	False	2026-09-03 23:36:15.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe	"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca	C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
*** 5192	768	SearchApp.exe	0xdd09afba1080	40	-	1	False	2026-09-03 23:36:16.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe	"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
*** 5352	768	TextInputHost.	0xdd09b037b300	12	-	1	False	2026-09-03 23:36:59.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe	"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
*** 5000	768	ApplicationFra	0xdd09a85660c0	4	-	1	False	2026-09-03 23:37:00.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\ApplicationFrameHost.exe	C:\Windows\system32\ApplicationFrameHost.exe -Embedding	C:\Windows\system32\ApplicationFrameHost.exe
*** 5420	768	RuntimeBroker.	0xdd09b0054340	13	-	1	False	2026-09-03 23:36:17.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\RuntimeBroker.exe	C:\Windows\System32\RuntimeBroker.exe -Embedding	C:\Windows\System32\RuntimeBroker.exe
*** 2088	768	RuntimeBroker.	0xdd09af959080	1	-	1	False	2026-09-03 23:37:08.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\RuntimeBroker.exe	C:\Windows\System32\RuntimeBroker.exe -Embedding	C:\Windows\System32\RuntimeBroker.exe
*** 5900	768	RuntimeBroker.	0xdd09ae861080	2	-	1	False	2026-09-04 00:35:26.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\RuntimeBroker.exe	C:\Windows\System32\RuntimeBroker.exe -Embedding	C:\Windows\System32\RuntimeBroker.exe
*** 4788	768	dllhost.exe	0xdd09b008f0c0	5	-	1	False	2026-09-03 23:37:00.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\dllhost.exe	C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}	C:\Windows\system32\DllHost.exe
*** 404	768	ShellExperienc	0xdd09b0749080	10	-	1	False	2026-09-04 00:35:22.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe	"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca	C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
*** 1020	768	WinStore.App.e	0xdd09ae43f0c0	13	-	1	False	2026-09-03 23:37:00.000000 UTC	N/A	\Device\HarddiskVolume2\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe	"C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe" -ServerName:App.AppXc75wvwned5vhz4xyxxecvgdjhdkgsdza.mca	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe
** 2816	652	svchost.exe	0xdd09ae5d9300	4	-	0	False	2026-09-03 23:35:46.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc	C:\Windows\system32\svchost.exe
** 4480	652	svchost.exe	0xdd09af8a4240	3	-	0	False	2026-09-03 23:36:09.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker	C:\Windows\system32\svchost.exe
** 2564	652	spoolsv.exe	0xdd09ae6ed200	7	-	0	False	2026-09-03 23:35:45.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\spoolsv.exe	C:\Windows\System32\spoolsv.exe	C:\Windows\System32\spoolsv.exe
** 1800	652	svchost.exe	0xdd09ae2e12c0	5	-	0	False	2026-09-03 23:35:43.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem	C:\Windows\system32\svchost.exe
** 2952	652	svchost.exe	0xdd09ae519140	3	-	0	False	2026-09-03 23:35:47.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks	C:\Windows\System32\svchost.exe
** 4616	652	svchost.exe	0xdd09af95b280	4	-	0	False	2026-09-03 23:36:09.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TabletInputService	C:\Windows\System32\svchost.exe
*** 4680	4616	ctfmon.exe	0xdd09aea082c0	10	-	1	False	2026-09-03 23:36:09.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\ctfmon.exe	"ctfmon.exe"	C:\Windows\system32\ctfmon.exe
** 1420	652	svchost.exe	0xdd09ade19240	6	-	0	False	2026-09-03 23:35:42.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager	C:\Windows\system32\svchost.exe
*** 4300	1420	sihost.exe	0xdd09ae34c080	7	-	1	False	2026-09-03 23:36:09.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\sihost.exe	sihost.exe	C:\Windows\system32\sihost.exe
** 3084	652	svchost.exe	0xdd09ae44e2c0	3	-	0	False	2026-09-03 23:35:48.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k LocalService -p -s WdiServiceHost	C:\Windows\System32\svchost.exe
** 3212	652	svchost.exe	0xdd09ae4b6380	12	-	0	False	2026-09-03 23:35:49.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k netsvcs	C:\Windows\System32\svchost.exe
** 6796	652	svchost.exe	0xdd09a8f88080	2	-	0	False	2026-09-03 23:38:04.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc	C:\Windows\system32\svchost.exe
** 2832	652	svchost.exe	0xdd09ae5db240	10	-	0	False	2026-09-03 23:35:46.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt	C:\Windows\system32\svchost.exe
** 5008	652	svchost.exe	0xdd09adf2c080	8	-	1	False	2026-09-03 23:36:11.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc	C:\Windows\system32\svchost.exe
** 1036	652	svchost.exe	0xdd09b0378080	5	-	0	False	2026-09-11 22:19:13.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\csrss.exe	-	-
** 2068	652	svchost.exe	0xdd09add2a080	9	-	0	False	2026-09-03 23:35:43.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p	C:\Windows\System32\svchost.exe
** 4372	652	svchost.exe	0xdd09a7a60080	3	-	1	False	2026-09-03 23:36:09.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s WpnUserService	C:\Windows\system32\svchost.exe
** 4756	652	svchost.exe	0xdd09af8992c0	8	-	0	False	2026-09-03 23:36:10.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc	C:\Windows\system32\svchost.exe
** 3988	652	svchost.exe	0xdd09ad434080	0	-	0	False	2026-09-03 23:38:43.000000 UTC	2026-09-03 23:38:49.000000 UTC	\Device\HarddiskVolume2\Windows\System32\svchost.exe	-	-
** 1176	652	svchost.exe	0xdd09ae11d300	6	-	0	False	2026-09-03 23:35:41.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog	C:\Windows\System32\svchost.exe
** 1816	652	svchost.exe	0xdd09ae2e2080	4	-	0	False	2026-09-03 23:35:43.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s SysMain	C:\Windows\system32\svchost.exe
** 1944	652	svchost.exe	0xdd09ae271240	2	-	0	False	2026-09-03 23:35:43.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS	C:\Windows\system32\svchost.exe
** 2840	652	svchost.exe	0xdd09ae5da080	13	-	0	False	2026-09-03 23:35:46.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork -p -s DPS	C:\Windows\System32\svchost.exe
** 1052	652	svchost.exe	0xdd09ae8c0280	2	-	0	False	2026-09-03 23:35:41.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService	C:\Windows\System32\svchost.exe
** 5912	652	SgrmBroker.exe	0xdd09b02c20c0	6	-	0	False	2026-09-03 23:37:50.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\SgrmBroker.exe	C:\Windows\system32\SgrmBroker.exe	C:\Windows\system32\SgrmBroker.exe
** 1440	652	svchost.exe	0xdd09ade1b300	6	-	0	False	2026-09-03 23:35:42.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp	C:\Windows\system32\svchost.exe
** 1568	652	svchost.exe	0xdd09ade97300	2	-	0	False	2026-09-03 23:35:42.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc	C:\Windows\system32\svchost.exe
** 2296	652	svchost.exe	0xdd09add32080	4	-	0	False	2026-09-03 23:35:44.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p	C:\Windows\system32\svchost.exe
** 2848	652	svchost.exe	0xdd09ae5e7240	11	-	0	False	2026-09-03 23:35:46.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k utcsvc -p	C:\Windows\System32\svchost.exe
** 932	652	svchost.exe	0xdd09adacb240	5	-	0	False	2026-09-03 23:35:40.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM	C:\Windows\system32\svchost.exe
** 2976	652	MsMpEng.exe	0xdd09ae78c080	24	-	0	False	2026-09-03 23:35:47.000000 UTC	N/A	\Device\HarddiskVolume2\Program Files\Windows Defender\MsMpEng.exe	"C:\Program Files\Windows Defender\MsMpEng.exe"	C:\Program Files\Windows Defender\MsMpEng.exe
*** 5164	2976	svchost.exe	0xdd09a83d4340	0	-	0	False	2026-09-11 22:22:14.000000 UTC	2026-09-11 22:22:16.000000 UTC	-	-	-
** 2592	652	svchost.exe	0xdd09aeaab080	1	-	0	False	2026-09-03 23:37:09.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo	C:\Windows\system32\svchost.exe
** 548	652	svchost.exe	0xdd09b0291080	12	-	0	False	2026-09-03 23:37:22.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS	C:\Windows\System32\svchost.exe
** 1704	652	VBoxService.ex	0xdd09ae2c2240	13	-	0	False	2026-09-03 23:35:42.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\VBoxService.exe	C:\Windows\System32\VBoxService.exe	C:\Windows\System32\VBoxService.exe
** 2600	652	svchost.exe	0xdd09ae7852c0	11	-	0	False	2026-09-03 23:35:45.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p	C:\Windows\system32\svchost.exe
** 3620	652	svchost.exe	0xdd09b074c080	6	-	0	False	2026-09-03 23:37:22.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV	C:\Windows\system32\svchost.exe
** 2988	652	svchost.exe	0xdd09ae5ea080	3	-	0	False	2026-09-03 23:35:47.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService	C:\Windows\system32\svchost.exe
** 3884	652	NisSrv.exe	0xdd09ae786080	4	-	0	False	2026-09-03 23:35:53.000000 UTC	N/A	\Device\HarddiskVolume2\Program Files\Windows Defender\NisSrv.exe	"C:\Program Files\Windows Defender\NisSrv.exe"	C:\Program Files\Windows Defender\NisSrv.exe
** 1840	652	svchost.exe	0xdd09ae2e5240	3	-	0	False	2026-09-03 23:35:43.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes	C:\Windows\System32\svchost.exe
** 2228	652	svchost.exe	0xdd09add2e080	2	-	0	False	2026-09-03 23:35:44.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc	C:\Windows\system32\svchost.exe
** 2356	652	svchost.exe	0xdd09ae668240	5	-	0	False	2026-09-03 23:35:44.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository	C:\Windows\system32\svchost.exe
** 2936	652	svchost.exe	0xdd09a7a9b080	5	-	0	False	2026-09-03 23:35:46.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k NetSvcs -p -s iphlpsvc	C:\Windows\System32\svchost.exe
** 1336	652	svchost.exe	0xdd09ae1882c0	3	-	0	False	2026-09-03 23:35:42.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k LocalService -p	C:\Windows\system32\svchost.exe
** 1080	652	svchost.exe	0xdd09ae8c2300	0	-	0	False	2026-09-03 23:35:41.000000 UTC	2026-09-11 21:07:41.000000 UTC	\Device\HarddiskVolume2\Windows\System32\svchost.exe	-	-
** 3512	652	SearchIndexer.	0xdd09ae94c240	14	-	0	False	2026-09-03 23:35:51.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\SearchIndexer.exe	C:\Windows\system32\SearchIndexer.exe /Embedding	C:\Windows\system32\SearchIndexer.exe
** 3548	652	svchost.exe	0xdd09afdac340	3	-	0	False	2026-09-11 21:34:18.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts	C:\Windows\System32\svchost.exe
** 2368	652	svchost.exe	0xdd09aebd4300	6	-	0	False	2026-09-03 23:35:57.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc	C:\Windows\System32\svchost.exe
** 3392	652	svchost.exe	0xdd09ad3ac240	3	-	0	False	2026-09-11 21:07:52.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k netsvcs -p	C:\Windows\System32\svchost.exe
** 1348	652	svchost.exe	0xdd09ae1cd2c0	2	-	0	False	2026-09-03 23:35:42.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k LocalService -p -s nsi	C:\Windows\system32\svchost.exe
** 1992	652	svchost.exe	0xdd09add2b280	3	-	0	False	2026-09-03 23:35:43.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder	C:\Windows\System32\svchost.exe
** 3400	652	svchost.exe	0xdd09ad9fa300	8	-	0	False	2026-09-03 23:37:51.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc	C:\Windows\System32\svchost.exe
** 1228	652	svchost.exe	0xdd09ae152240	8	-	0	False	2026-09-03 23:35:41.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule	C:\Windows\system32\svchost.exe
*** 4448	1228	taskhostw.exe	0xdd09ae9482c0	6	-	1	False	2026-09-03 23:36:09.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\taskhostw.exe	taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}	C:\Windows\system32\taskhostw.exe
** 2252	652	svchost.exe	0xdd09add30300	9	-	0	False	2026-09-03 23:35:44.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache	C:\Windows\system32\svchost.exe
** 6220	652	svchost.exe	0xdd09b04f5340	3	-	1	False	2026-09-03 23:37:51.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k UnistackSvcGroup	C:\Windows\system32\svchost.exe
** 1108	652	svchost.exe	0xdd09ae81e080	2	-	0	False	2026-09-03 23:35:41.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc	C:\Windows\system32\svchost.exe
** 728	652	svchost.exe	0xdd09ae885080	5	-	0	False	2026-09-03 23:35:41.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc	C:\Windows\system32\svchost.exe
** 1244	652	svchost.exe	0xdd09ae1542c0	3	-	0	False	2026-09-03 23:35:41.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p	C:\Windows\system32\svchost.exe
** 2012	652	svchost.exe	0xdd09add2d2c0	6	-	0	False	2026-09-03 23:35:43.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache	C:\Windows\system32\svchost.exe
** 2652	652	svchost.exe	0xdd09ae78b300	5	-	0	False	2026-09-03 23:35:45.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation	C:\Windows\System32\svchost.exe
** 2908	652	svchost.exe	0xdd09ae5eb2c0	2	-	0	False	2026-09-03 23:35:46.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k LocalService -p -s SstpSvc	C:\Windows\system32\svchost.exe
** 1632	652	svchost.exe	0xdd09ade1e080	6	-	0	False	2026-09-03 23:35:42.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc	C:\Windows\System32\svchost.exe
** 2272	652	svchost.exe	0xdd09add31080	3	-	0	False	2026-09-03 23:35:44.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p	C:\Windows\System32\svchost.exe
** 4320	652	svchost.exe	0xdd09aea90080	9	-	1	False	2026-09-03 23:36:09.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc	C:\Windows\system32\svchost.exe
** 3040	652	svchost.exe	0xdd09ad87f280	3	-	0	False	2026-09-03 23:37:51.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc	C:\Windows\System32\svchost.exe
** 2404	652	svchost.exe	0xdd09ae6b2240	3	-	0	False	2026-09-03 23:35:44.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection	C:\Windows\System32\svchost.exe
** 4068	652	svchost.exe	0xdd09aead02c0	4	-	0	False	2026-09-03 23:35:54.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager	C:\Windows\System32\svchost.exe
** 2788	652	svchost.exe	0xdd09b05a5280	8	-	0	False	2026-09-11 21:07:50.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc	C:\Windows\system32\svchost.exe
** 1384	652	svchost.exe	0xdd09b0204080	8	-	0	False	2026-09-03 23:37:51.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc	C:\Windows\system32\svchost.exe
** 2668	652	svchost.exe	0xdd09b071d340	1	-	0	False	2026-09-11 22:19:13.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k wsappx -p -s ClipSVC	C:\Windows\System32\svchost.exe
** 1904	652	svchost.exe	0xdd09ae29b2c0	8	-	0	False	2026-09-03 23:35:43.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm	C:\Windows\System32\svchost.exe
** 2928	652	svchost.exe	0xdd09ae515240	5	-	0	False	2026-09-03 23:35:46.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer	C:\Windows\system32\svchost.exe
** 1776	652	SecurityHealth	0xdd09b00c10c0	6	-	0	False	2026-09-03 23:36:28.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\SecurityHealthService.exe	C:\Windows\system32\SecurityHealthService.exe	C:\Windows\system32\SecurityHealthService.exe
** 888	652	svchost.exe	0xdd09adac62c0	9	-	0	False	2026-09-03 23:35:40.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k RPCSS -p	C:\Windows\system32\svchost.exe
** 1276	652	svchost.exe	0xdd09ae186240	3	-	0	False	2026-09-03 23:35:41.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\svchost.exe	C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc	C:\Windows\system32\svchost.exe
524	504	csrss.exe	0xdd09ad31d140	11	-	1	False	2026-09-03 23:35:37.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\csrss.exe	%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16	C:\Windows\system32\csrss.exe
584	504	winlogon.exe	0xdd09ae0e8080	5	-	1	False	2026-09-03 23:35:37.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\winlogon.exe	winlogon.exe	C:\Windows\system32\winlogon.exe
* 792	584	fontdrvhost.ex	0xdd09adcac140	5	-	1	False	2026-09-03 23:35:40.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\fontdrvhost.exe	"fontdrvhost.exe"	C:\Windows\system32\fontdrvhost.exe
* 992	584	dwm.exe	0xdd09ae81f080	18	-	1	False	2026-09-03 23:35:41.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\dwm.exe	"dwm.exe"	C:\Windows\system32\dwm.exe
* 4784	584	userinit.exe	0xdd09af898080	0	-	1	False	2026-09-03 23:36:10.000000 UTC	2026-09-03 23:36:35.000000 UTC	\Device\HarddiskVolume2\Windows\System32\userinit.exe	-	-
** 4832	4784	explorer.exe	0xdd09af89d080	55	-	1	False	2026-09-03 23:36:10.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\explorer.exe	C:\Windows\Explorer.EXE	C:\Windows\Explorer.EXE
*** 6752	4832	powershell.exe	0xdd09b0714340	10	-	1	False	2026-09-11 22:09:19.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" 	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
**** 1688	6752	go-winpmem_amd	0xdd09b04b0340	8	-	1	False	2026-09-11 22:22:13.000000 UTC	N/A	\Device\Mup\VBoxSvr\Downloads\go-winpmem_amd64_1.0-rc2_signed.exe	"Z:\go-winpmem_amd64_1.0-rc2_signed.exe" acquire --nosparse Z:\WIN10_T3_POST.raw	Z:\go-winpmem_amd64_1.0-rc2_signed.exe
**** 396	6752	conhost.exe	0xdd09b010b340	4	-	1	False	2026-09-11 22:09:20.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\conhost.exe	\??\C:\Windows\system32\conhost.exe 0x4	C:\Windows\system32\conhost.exe
*** 1864	4832	SecurityHealth	0xdd09b028e0c0	1	-	1	False	2026-09-03 23:36:28.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\SecurityHealthSystray.exe	"C:\Windows\System32\SecurityHealthSystray.exe" 	C:\Windows\System32\SecurityHealthSystray.exe
*** 2056	4832	OneDrive.exe	0xdd09adf36080	13	-	1	True	2026-09-03 23:36:29.000000 UTC	N/A	\Device\HarddiskVolume2\Users\forensicuser\AppData\Local\Microsoft\OneDrive\OneDrive.exe	"C:\Users\forensicuser\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background	C:\Users\forensicuser\AppData\Local\Microsoft\OneDrive\OneDrive.exe
*** 5740	4832	VBoxTray.exe	0xdd09afe750c0	11	-	1	False	2026-09-03 23:36:28.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\VBoxTray.exe	"C:\Windows\System32\VBoxTray.exe" 	C:\Windows\System32\VBoxTray.exe
*** 7164	4832	cmd.exe	0xdd09b029e080	1	-	1	False	2026-09-03 23:39:11.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\cmd.exe	"C:\Windows\system32\cmd.exe" 	C:\Windows\system32\cmd.exe
**** 5784	7164	notepad.exe	0xdd09afd5b340	2	-	1	False	2026-09-11 21:49:21.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\notepad.exe	notepad  C:\T1_Simulator.ps1	C:\Windows\system32\notepad.exe
**** 2104	7164	notepad.exe	0xdd09b053e340	2	-	1	False	2026-09-11 22:06:32.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\notepad.exe	notepad  C:\T1_Simulator.ps1	C:\Windows\system32\notepad.exe
**** 7140	7164	conhost.exe	0xdd09a8f82080	4	-	1	False	2026-09-03 23:39:11.000000 UTC	N/A	\Device\HarddiskVolume2\Windows\System32\conhost.exe	\??\C:\Windows\system32\conhost.exe 0x4	C:\Windows\system32\conhost.exe
