Memory analysis

I am practicing on my skills to analyze memory dump. I want to confirm whether what I analyze so far

1) under pstree, I find that AdobeRAM and reader_s is immediately spawned out when explorer.exe is started. This points to a suspicious activity.
2) explorer.exe is in the folder Windows\Explorer.exe shouldn't it reside in system32 ?
3) vmtoolsd has a parent process that is explorer, from what I know explorer shouldn't start vmtoolsd
4) I find ad_driver which reside in …

analysis computerforensics explorer find folder memory memory analysis skills under windows