Michael; Your initial reaction was correct; it's a phantom. a look at the output from timeliner shows that msdtc.exe started well after explorer.exe. The matching PID was just a weird accident: ... 2014-02-17 11:38:17 UTC+0000 [PROCESS] dwm.exe 5360 1080 2014-02-17 11:38:18 UTC+0000 [PROCESS] explorer.exe 5400 5332 2014-02-17 11:38:20 UTC+0000 [PROCESS] iPlatformHost. 5552 2360 ... 2014-02-17 11:39:06 UTC+0000 [PROCESS] dllhost.exe 4992 692 2014-02-17 11:39:08 UTC+0000 [PROCESS] msdtc.exe 5332 692 2014-02-17 11:39:13 UTC+0000 [PROCESS] BTHSAmpPalServ 6276 692 2014-02-17 11:39:17 UTC+0000 [PROCESS] BTHSSecurityMg 6488 692 So the moral becomes (as it always is...) beware shiny objects... Thank You! -=[ Steve ]=- From: Michael Ligh <michael.ligh(a)mnin.org> To: shorejsi2(a)mmm.com Cc: vol-users(a)volatilityfoundation.org Date: 03/01/2014 09:49 AM Subject: Re: [Vol-users] Chasing evil or my tail? Looks pretty strange to me. Is that the only explorer.exe running or is there another one? Even if its parent is or isn't present, it shouldn't be a grandchild of services.exe--that is also odd. Based on the way pstree works, there's a small change userinit.exe could have been pid 5332 and then the pids cycled around until msdtc.exe eventually got pid 5332 also. That would produce an effect like you're seeing, but the chance of userinit.exe getting pid 5332 when it starts so early in the boot sequence is rather low. -------------------------------------------------- Michael Ligh (@iMHLv2) GPG: http://mnin.org/gpg.pubkey.txt Blog: http://volatility-labs.blogspot.com Training: http://memoryanalysis.net On Feb 28, 2014, at 9:33 AM, shorejsi2(a)mmm.com wrote: noticed this in the 'pstree' output (abbreviated): would normally expect userinit.exe to start explorer and then exit, leaving it with no visible parent. [attachment "signature.asc" deleted by Steve Horejsi/US-Corp02/3M/US]