mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-17 20:35:40 +02:00
376 lines
26 KiB
JSON
376 lines
26 KiB
JSON
{
|
|
"WINDOWS10_GENERIC": {
|
|
"Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\winlogon.exe",
|
|
"Cmd": null,
|
|
"CreateTime": "2025-03-06T17:49:34+00:00",
|
|
"ExitTime": null,
|
|
"Handles": null,
|
|
"ImageFileName": "winlogon.exe",
|
|
"Offset(V)": 145201769754752,
|
|
"PID": 3616,
|
|
"PPID": 3568,
|
|
"Path": null,
|
|
"SessionId": 2,
|
|
"Threads": 3,
|
|
"Wow64": false,
|
|
"__children": [
|
|
{
|
|
"Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\userinit.exe",
|
|
"Cmd": null,
|
|
"CreateTime": "2025-03-06T17:50:15+00:00",
|
|
"ExitTime": "2025-03-06T17:50:32+00:00",
|
|
"Handles": null,
|
|
"ImageFileName": "userinit.exe",
|
|
"Offset(V)": 145201786712256,
|
|
"PID": 4832,
|
|
"PPID": 3616,
|
|
"Path": null,
|
|
"SessionId": 2,
|
|
"Threads": 0,
|
|
"Wow64": false,
|
|
"__children": [
|
|
{
|
|
"Audit": "\\Device\\HarddiskVolume4\\Windows\\explorer.exe",
|
|
"Cmd": "C:\\Windows\\Explorer.EXE",
|
|
"CreateTime": "2025-03-06T17:50:17+00:00",
|
|
"ExitTime": null,
|
|
"Handles": null,
|
|
"ImageFileName": "explorer.exe",
|
|
"Offset(V)": 145201787191488,
|
|
"PID": 4912,
|
|
"PPID": 4832,
|
|
"Path": "C:\\Windows\\Explorer.EXE",
|
|
"SessionId": 2,
|
|
"Threads": 57,
|
|
"Wow64": false,
|
|
"__children": [
|
|
{
|
|
"Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\SecurityHealthSystray.exe",
|
|
"Cmd": "\"C:\\Windows\\System32\\SecurityHealthSystray.exe\" ",
|
|
"CreateTime": "2025-03-06T17:51:05+00:00",
|
|
"ExitTime": null,
|
|
"Handles": null,
|
|
"ImageFileName": "SecurityHealth",
|
|
"Offset(V)": 145201826054336,
|
|
"PID": 1860,
|
|
"PPID": 4912,
|
|
"Path": "C:\\Windows\\System32\\SecurityHealthSystray.exe",
|
|
"SessionId": 2,
|
|
"Threads": 2,
|
|
"Wow64": false,
|
|
"__children": []
|
|
},
|
|
{
|
|
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window --win-session-start",
|
|
"CreateTime": "2025-03-06T17:51:05+00:00",
|
|
"ExitTime": null,
|
|
"Handles": null,
|
|
"ImageFileName": "msedge.exe",
|
|
"Offset(V)": 145201826906304,
|
|
"PID": 3952,
|
|
"PPID": 4912,
|
|
"Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"SessionId": 2,
|
|
"Threads": 61,
|
|
"Wow64": false,
|
|
"__children": [
|
|
{
|
|
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --time-ticks-at-unix-epoch=-1741283277737123 --launch-time-ticks=556708795 --always-read-main-dll --field-trial-handle=3928,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=3996 /prefetch:1",
|
|
"CreateTime": "2025-03-06T17:57:14+00:00",
|
|
"ExitTime": null,
|
|
"Handles": null,
|
|
"ImageFileName": "msedge.exe",
|
|
"Offset(V)": 145201787768960,
|
|
"PID": 5348,
|
|
"PPID": 3952,
|
|
"Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"SessionId": 2,
|
|
"Threads": 19,
|
|
"Wow64": false,
|
|
"__children": []
|
|
},
|
|
{
|
|
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --string-annotations --always-read-main-dll --field-trial-handle=6740,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:8",
|
|
"CreateTime": "2025-03-06T17:57:52+00:00",
|
|
"ExitTime": null,
|
|
"Handles": null,
|
|
"ImageFileName": "msedge.exe",
|
|
"Offset(V)": 145201832050880,
|
|
"PID": 3876,
|
|
"PPID": 3952,
|
|
"Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"SessionId": 2,
|
|
"Threads": 8,
|
|
"Wow64": false,
|
|
"__children": []
|
|
},
|
|
{
|
|
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --string-annotations --always-read-main-dll --field-trial-handle=7016,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:8",
|
|
"CreateTime": "2025-03-06T17:57:59+00:00",
|
|
"ExitTime": null,
|
|
"Handles": null,
|
|
"ImageFileName": "msedge.exe",
|
|
"Offset(V)": 145201827619008,
|
|
"PID": 5604,
|
|
"PPID": 3952,
|
|
"Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"SessionId": 2,
|
|
"Threads": 14,
|
|
"Wow64": false,
|
|
"__children": []
|
|
},
|
|
{
|
|
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --string-annotations --always-read-main-dll --field-trial-handle=5520,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8",
|
|
"CreateTime": "2025-03-06T17:57:16+00:00",
|
|
"ExitTime": null,
|
|
"Handles": null,
|
|
"ImageFileName": "msedge.exe",
|
|
"Offset(V)": 145201827774656,
|
|
"PID": 1000,
|
|
"PPID": 3952,
|
|
"Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"SessionId": 2,
|
|
"Threads": 9,
|
|
"Wow64": false,
|
|
"__children": []
|
|
},
|
|
{
|
|
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --time-ticks-at-unix-epoch=-1741283277737123 --launch-time-ticks=596993509 --always-read-main-dll --field-trial-handle=6904,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:1",
|
|
"CreateTime": "2025-03-06T17:57:54+00:00",
|
|
"ExitTime": null,
|
|
"Handles": null,
|
|
"ImageFileName": "msedge.exe",
|
|
"Offset(V)": 145201839592000,
|
|
"PID": 7080,
|
|
"PPID": 3952,
|
|
"Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"SessionId": 2,
|
|
"Threads": 15,
|
|
"Wow64": false,
|
|
"__children": []
|
|
},
|
|
{
|
|
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --time-ticks-at-unix-epoch=-1741283277737123 --launch-time-ticks=625057436 --always-read-main-dll --field-trial-handle=5592,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1",
|
|
"CreateTime": "2025-03-06T17:58:23+00:00",
|
|
"ExitTime": null,
|
|
"Handles": null,
|
|
"ImageFileName": "msedge.exe",
|
|
"Offset(V)": 145201828201216,
|
|
"PID": 5132,
|
|
"PPID": 3952,
|
|
"Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"SessionId": 2,
|
|
"Threads": 17,
|
|
"Wow64": false,
|
|
"__children": []
|
|
},
|
|
{
|
|
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --string-annotations --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --time-ticks-at-unix-epoch=-1741283277737123 --launch-time-ticks=625148972 --always-read-main-dll --field-trial-handle=7112,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1",
|
|
"CreateTime": "2025-03-06T17:58:23+00:00",
|
|
"ExitTime": null,
|
|
"Handles": null,
|
|
"ImageFileName": "msedge.exe",
|
|
"Offset(V)": 145201839919232,
|
|
"PID": 5388,
|
|
"PPID": 3952,
|
|
"Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"SessionId": 2,
|
|
"Threads": 15,
|
|
"Wow64": false,
|
|
"__children": []
|
|
},
|
|
{
|
|
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2180,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3",
|
|
"CreateTime": "2025-03-06T17:51:14+00:00",
|
|
"ExitTime": null,
|
|
"Handles": null,
|
|
"ImageFileName": "msedge.exe",
|
|
"Offset(V)": 145201835704512,
|
|
"PID": 6448,
|
|
"PPID": 3952,
|
|
"Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"SessionId": 2,
|
|
"Threads": 16,
|
|
"Wow64": false,
|
|
"__children": []
|
|
},
|
|
{
|
|
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"Cmd": null,
|
|
"CreateTime": "2025-03-06T17:51:16+00:00",
|
|
"ExitTime": null,
|
|
"Handles": null,
|
|
"ImageFileName": "msedge.exe",
|
|
"Offset(V)": 145201668321408,
|
|
"PID": 6672,
|
|
"PPID": 3952,
|
|
"Path": null,
|
|
"SessionId": 2,
|
|
"Threads": 9,
|
|
"Wow64": false,
|
|
"__children": []
|
|
},
|
|
{
|
|
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=price_comparison_service.mojom.DataProcessor --lang=en-US --service-sandbox-type=entity_extraction --string-annotations --always-read-main-dll --field-trial-handle=6188,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8",
|
|
"CreateTime": "2025-03-06T17:58:44+00:00",
|
|
"ExitTime": null,
|
|
"Handles": null,
|
|
"ImageFileName": "msedge.exe",
|
|
"Offset(V)": 145201830273728,
|
|
"PID": 6064,
|
|
"PPID": 3952,
|
|
"Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"SessionId": 2,
|
|
"Threads": 9,
|
|
"Wow64": false,
|
|
"__children": []
|
|
},
|
|
{
|
|
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"Cmd": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2472,i,15721868202469256575,6833569417170289141,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2",
|
|
"CreateTime": "2025-03-06T17:51:14+00:00",
|
|
"ExitTime": null,
|
|
"Handles": null,
|
|
"ImageFileName": "msedge.exe",
|
|
"Offset(V)": 145201834049728,
|
|
"PID": 6456,
|
|
"PPID": 3952,
|
|
"Path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"SessionId": 2,
|
|
"Threads": 15,
|
|
"Wow64": false,
|
|
"__children": []
|
|
},
|
|
{
|
|
"Audit": "\\Device\\HarddiskVolume4\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
|
|
"Cmd": null,
|
|
"CreateTime": "2025-03-06T17:51:11+00:00",
|
|
"ExitTime": null,
|
|
"Handles": null,
|
|
"ImageFileName": "msedge.exe",
|
|
"Offset(V)": 145201786340096,
|
|
"PID": 6204,
|
|
"PPID": 3952,
|
|
"Path": null,
|
|
"SessionId": 2,
|
|
"Threads": 8,
|
|
"Wow64": false,
|
|
"__children": []
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"Audit": "\\Device\\HarddiskVolume4\\Users\\generic-user\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
|
|
"Cmd": "\"C:\\Users\\generic-user\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /background",
|
|
"CreateTime": "2025-03-06T17:51:11+00:00",
|
|
"ExitTime": null,
|
|
"Handles": null,
|
|
"ImageFileName": "OneDrive.exe",
|
|
"Offset(V)": 145201834340544,
|
|
"PID": 6160,
|
|
"PPID": 4912,
|
|
"Path": "C:\\Users\\generic-user\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
|
|
"SessionId": 2,
|
|
"Threads": 22,
|
|
"Wow64": true,
|
|
"__children": []
|
|
},
|
|
{
|
|
"Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\cmd.exe",
|
|
"Cmd": "\"C:\\Windows\\system32\\cmd.exe\" ",
|
|
"CreateTime": "2025-03-06T17:51:44+00:00",
|
|
"ExitTime": null,
|
|
"Handles": null,
|
|
"ImageFileName": "cmd.exe",
|
|
"Offset(V)": 145201834332288,
|
|
"PID": 784,
|
|
"PPID": 4912,
|
|
"Path": "C:\\Windows\\system32\\cmd.exe",
|
|
"SessionId": 2,
|
|
"Threads": 1,
|
|
"Wow64": false,
|
|
"__children": [
|
|
{
|
|
"Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\conhost.exe",
|
|
"Cmd": null,
|
|
"CreateTime": "2025-03-06T17:51:49+00:00",
|
|
"ExitTime": null,
|
|
"Handles": null,
|
|
"ImageFileName": "conhost.exe",
|
|
"Offset(V)": 145201834446976,
|
|
"PID": 3896,
|
|
"PPID": 784,
|
|
"Path": null,
|
|
"SessionId": 2,
|
|
"Threads": 3,
|
|
"Wow64": false,
|
|
"__children": []
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\notepad.exe",
|
|
"Cmd": "\"C:\\Windows\\system32\\notepad.exe\" ",
|
|
"CreateTime": "2025-03-06T17:52:33+00:00",
|
|
"ExitTime": null,
|
|
"Handles": null,
|
|
"ImageFileName": "notepad.exe",
|
|
"Offset(V)": 145201839497344,
|
|
"PID": 2968,
|
|
"PPID": 4912,
|
|
"Path": "C:\\Windows\\system32\\notepad.exe",
|
|
"SessionId": 2,
|
|
"Threads": 4,
|
|
"Wow64": false,
|
|
"__children": []
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\fontdrvhost.exe",
|
|
"Cmd": null,
|
|
"CreateTime": "2025-03-06T17:49:42+00:00",
|
|
"ExitTime": null,
|
|
"Handles": null,
|
|
"ImageFileName": "fontdrvhost.ex",
|
|
"Offset(V)": 145201770697088,
|
|
"PID": 3812,
|
|
"PPID": 3616,
|
|
"Path": null,
|
|
"SessionId": 2,
|
|
"Threads": 5,
|
|
"Wow64": false,
|
|
"__children": []
|
|
},
|
|
{
|
|
"Audit": "\\Device\\HarddiskVolume4\\Windows\\System32\\dwm.exe",
|
|
"Cmd": "\"dwm.exe\"",
|
|
"CreateTime": "2025-03-06T17:49:42+00:00",
|
|
"ExitTime": null,
|
|
"Handles": null,
|
|
"ImageFileName": "dwm.exe",
|
|
"Offset(V)": 145201770352768,
|
|
"PID": 3860,
|
|
"PPID": 3616,
|
|
"Path": "C:\\Windows\\system32\\dwm.exe",
|
|
"SessionId": 2,
|
|
"Threads": 16,
|
|
"Wow64": false,
|
|
"__children": []
|
|
}
|
|
]
|
|
}
|
|
}
|