Volatility 3 Framework 2.27.0

PID	PPID	ImageFileName	Offset(V)	Threads	Handles	SessionId	Wow64	CreateTime	ExitTime	File output

1332	3920	powershell.exe	0x3925b00	10	655	0	True	2018-08-31 01:31:25.000000 UTC	N/A	Disabled
2676	776	WmiPrvSE.exe	0x71cfb00	10	343	0	False	2018-08-30 05:14:54.000000 UTC	N/A	Disabled
3920	2676	powershell.exe	0xa3e8b00	12	281	0	False	2018-08-31 01:31:24.000000 UTC	N/A	Disabled
4412	4844	chrome.exe	0xc363b00	14	234	5	True	2018-09-04 21:53:43.000000 UTC	N/A	Disabled
960	5472	iexplore.exe	0x1427f060	19	498	5	True	2018-09-04 21:53:21.000000 UTC	N/A	Disabled
3548	652	subject_srv.ex	0x2bde8b00	13	155	0	True	2018-09-06 19:37:40.000000 UTC	N/A	Disabled
5692	652	taskhost.exe	0x329b7a40	0	-	0	False	2018-09-05 04:38:35.000000 UTC	2018-09-05 04:42:09.000000 UTC	Disabled
3440	6908	csrss.exe	0x3627ca40	10	512	5	False	2018-09-04 21:51:59.000000 UTC	N/A	Disabled
4848	132	MSOSYNC.EXE	0x51ca4b00	24	680	5	True	2018-09-06 18:44:23.000000 UTC	N/A	Disabled
2780	4844	chrome.exe	0x55bfe6f0	13	171	5	True	2018-09-05 05:15:31.000000 UTC	N/A	Disabled
4308	4844	chrome.exe	0x596a5b00	16	223	5	True	2018-09-04 21:54:20.000000 UTC	N/A	Disabled
7116	4844	chrome.exe	0x5d193b00	8	94	5	True	2018-09-04 21:53:42.000000 UTC	N/A	Disabled
568	496	conhost.exe	0x7e266b00	1	32	0	False	2018-08-31 01:14:45.000000 UTC	N/A	Disabled
4432	496	conhost.exe	0x80b22720	2	33	0	False	2018-08-31 01:31:24.000000 UTC	N/A	Disabled
4064	2676	powershell.exe	0x82517b00	12	283	0	False	2018-08-31 01:23:24.000000 UTC	N/A	Disabled
4736	496	conhost.exe	0x8e13ab00	1	32	0	False	2018-08-31 01:23:25.000000 UTC	N/A	Disabled
4664	5284	vmtoolsd.exe	0x946b2b00	5	140	5	False	2018-09-04 21:52:13.000000 UTC	N/A	Disabled
3720	1332	rundll32.exe	0x97e46060	0	-	0	False	2018-08-31 21:07:21.000000 UTC	2018-08-31 21:07:28.000000 UTC	Disabled
5472	776	iexplore.exe	0x9825e060	13	553	5	False	2018-09-04 21:53:21.000000 UTC	N/A	Disabled
4192	496	conhost.exe	0x98a008d0	1	32	0	False	2018-08-31 01:31:25.000000 UTC	N/A	Disabled
4844	5284	chrome.exe	0xaba5b060	39	1022	5	True	2018-09-04 21:53:42.000000 UTC	N/A	Disabled
6256	4844	chrome.exe	0xae607060	2	66	5	True	2018-09-04 21:53:43.000000 UTC	N/A	Disabled
6552	652	taskhost.exe	0xaed19060	12	271	5	False	2018-09-04 21:52:08.000000 UTC	N/A	Disabled
5508	4032	shstat.exe	0xaf7c7760	14	267	5	True	2018-09-04 21:52:16.000000 UTC	N/A	Disabled
4600	5284	OUTLOOK.EXE	0xb012f170	40	2925	5	True	2018-09-04 21:53:10.000000 UTC	N/A	Disabled
132	5284	GROOVE.EXE	0xb0dfa820	33	1005	5	True	2018-09-04 21:52:16.000000 UTC	N/A	Disabled
7040	1008	dwm.exe	0xb32e4320	3	91	5	False	2018-09-04 21:52:10.000000 UTC	N/A	Disabled
4232	1104	rdpclip.exe	0xb564e4c0	4	97	5	False	2018-09-04 21:52:09.000000 UTC	N/A	Disabled
2536	496	conhost.exe	0xba9e1060	2	33	0	False	2018-08-31 01:23:24.000000 UTC	N/A	Disabled
5252	4844	chrome.exe	0xbab6db00	14	177	5	True	2018-09-04 21:56:22.000000 UTC	N/A	Disabled
6892	776	WmiPrvSE.exe	0xbb11d060	7	207	0	False	2018-08-31 20:21:45.000000 UTC	N/A	Disabled
2972	652	svchost.exe	0xbb2636e0	5	102	0	False	2018-08-30 05:14:56.000000 UTC	N/A	Disabled
2668	776	unsecapp.exe	0xbb5247c0	4	75	0	False	2018-08-30 05:14:54.000000 UTC	N/A	Disabled
2380	652	mcshield.exe	0xbb755550	45	566	0	False	2018-08-30 05:14:50.000000 UTC	N/A	Disabled
2388	1496	FireTray.exe	0xbb75e060	0	-	0	False	2018-08-30 05:14:50.000000 UTC	2018-08-30 05:14:50.000000 UTC	Disabled
2244	1816	mfefire.exe	0xbb808b00	9	235	0	False	2018-08-30 05:14:50.000000 UTC	N/A	Disabled
1984	652	VGAuthService.	0xbb80d060	3	89	0	False	2018-08-30 05:14:47.000000 UTC	N/A	Disabled
2016	496	conhost.exe	0xbb830060	2	32	0	False	2018-08-30 05:14:48.000000 UTC	N/A	Disabled
2028	1816	mfevtps.exe	0xbb8357a0	8	267	0	False	2018-08-30 05:14:48.000000 UTC	N/A	Disabled
1428	652	vmtoolsd.exe	0xbb8c0b00	11	310	0	False	2018-08-30 05:14:48.000000 UTC	N/A	Disabled
1172	652	ManagementAgen	0xbb8cf500	10	95	0	False	2018-08-30 05:14:48.000000 UTC	N/A	Disabled
2084	652	mfevtps.exe	0xbb9a8570	5	158	0	False	2018-08-30 05:14:49.000000 UTC	N/A	Disabled
1792	652	VsTskMgr.exe	0xbba79530	23	384	0	True	2018-08-30 05:14:47.000000 UTC	N/A	Disabled
1816	652	mfemms.exe	0xbbb14820	10	217	0	False	2018-08-30 05:14:47.000000 UTC	N/A	Disabled
1892	652	sysmon64.exe	0xbbb9a770	11	343	0	False	2018-08-30 05:14:47.000000 UTC	N/A	Disabled
1772	652	masvc.exe	0xbbdeb650	8	383	0	False	2018-08-30 05:14:47.000000 UTC	N/A	Disabled
5284	6444	explorer.exe	0xbc034060	19	686	5	False	2018-09-04 21:52:10.000000 UTC	N/A	Disabled
1572	652	HipMgmt.exe	0xbc4056c0	14	251	0	True	2018-08-30 05:14:46.000000 UTC	N/A	Disabled
1548	652	svchost.exe	0xbc7e9700	11	220	0	False	2018-08-30 05:14:46.000000 UTC	N/A	Disabled
5056	1332	rundll32.exe	0xbca6cb00	0	-	0	False	2018-08-31 20:23:08.000000 UTC	2018-08-31 20:23:29.000000 UTC	Disabled
1360	652	armsvc.exe	0xbcab08a0	4	72	0	True	2018-08-30 05:14:46.000000 UTC	N/A	Disabled
1384	652	OfficeClickToR	0xbcae0b00	20	641	0	False	2018-08-30 05:14:46.000000 UTC	N/A	Disabled
1464	652	svchost.exe	0xbcb6d600	10	150	0	False	2018-08-30 05:14:46.000000 UTC	N/A	Disabled
1496	652	FireSvc.exe	0xbcb90b00	19	418	0	False	2018-08-30 05:14:46.000000 UTC	N/A	Disabled
1208	652	spoolsv.exe	0xbcf17b00	14	356	0	False	2018-08-30 05:14:45.000000 UTC	N/A	Disabled
6740	6908	winlogon.exe	0xbcf4a700	3	123	5	False	2018-09-04 21:51:59.000000 UTC	N/A	Disabled
1236	652	svchost.exe	0xbcf84060	19	323	0	False	2018-08-30 05:14:45.000000 UTC	N/A	Disabled