Volatility 3 Framework 1.0.1

PID	Process	Start VPN	End VPN	Tag	Protection	CommitCharge	PrivateMemory	File output	Hexdump	Disasm

1556	explorer.exe	0x3130000	0x3130fff	VadS	PAGE_EXECUTE_READWRITE	1	1	Disabled	
00 00 00 00 00 00 00 00	........
00 00 00 00 00 00 00 00	........
00 00 13 03 00 00 00 00	........
00 00 00 00 00 00 00 00	........
10 00 13 03 00 00 00 00	........
00 00 00 00 00 00 00 00	........
20 00 13 03 00 00 00 00	........
00 00 00 00 00 00 00 00	........	
0x3130000:	add	byte ptr [eax], al
0x3130002:	add	byte ptr [eax], al
0x3130004:	add	byte ptr [eax], al
0x3130006:	add	byte ptr [eax], al
0x3130008:	add	byte ptr [eax], al
0x313000a:	add	byte ptr [eax], al
0x313000c:	add	byte ptr [eax], al
0x313000e:	add	byte ptr [eax], al
0x3130010:	add	byte ptr [eax], al
0x3130012:	adc	eax, dword ptr [ebx]
0x3130014:	add	byte ptr [eax], al
0x3130016:	add	byte ptr [eax], al
0x3130018:	add	byte ptr [eax], al
0x313001a:	add	byte ptr [eax], al
0x313001c:	add	byte ptr [eax], al
0x313001e:	add	byte ptr [eax], al
0x3130020:	adc	byte ptr [eax], al
0x3130022:	adc	eax, dword ptr [ebx]
0x3130024:	add	byte ptr [eax], al
0x3130026:	add	byte ptr [eax], al
0x3130028:	add	byte ptr [eax], al
0x313002a:	add	byte ptr [eax], al
0x313002c:	add	byte ptr [eax], al
0x313002e:	add	byte ptr [eax], al
0x3130030:	and	byte ptr [eax], al
0x3130032:	adc	eax, dword ptr [ebx]
0x3130034:	add	byte ptr [eax], al
0x3130036:	add	byte ptr [eax], al
0x3130038:	add	byte ptr [eax], al
0x313003a:	add	byte ptr [eax], al
0x313003c:	add	byte ptr [eax], al
0x313003e:	add	byte ptr [eax], al
2460	SearchFilterHo	0x730000	0x76ffff	VadS	PAGE_EXECUTE_READWRITE	1	1	Disabled	
c5 2f 31 e7 87 c4 00 01	./1.....
ee ff ee ff 00 00 00 00	........
a8 00 73 00 a8 00 73 00	..s...s.
00 00 73 00 00 00 73 00	..s...s.
40 00 00 00 88 05 73 00	@.....s.
00 00 77 00 3f 00 00 00	..w.?...
01 00 00 00 00 00 00 00	........
f0 0f 73 00 f0 0f 73 00	..s...s.	
0x730000:	lds	ebp, ptr [edi]
0x730002:	xor	edi, esp
0x730004:	xchg	esp, eax
0x730006:	add	byte ptr [ecx], al
0x730008:	out	dx, al
2856	explorer.exe	0x16e0000	0x16e0fff	VadS	PAGE_EXECUTE_READWRITE	1	1	Disabled	
00 00 00 00 00 00 00 00	........
00 00 00 00 00 00 00 00	........
00 00 6e 01 00 00 00 00	..n.....
00 00 00 00 00 00 00 00	........
10 00 6e 01 00 00 00 00	..n.....
00 00 00 00 00 00 00 00	........
20 00 6e 01 00 00 00 00	..n.....
00 00 00 00 00 00 00 00	........	
0x16e0000:	add	byte ptr [eax], al
0x16e0002:	add	byte ptr [eax], al
0x16e0004:	add	byte ptr [eax], al
0x16e0006:	add	byte ptr [eax], al
0x16e0008:	add	byte ptr [eax], al
0x16e000a:	add	byte ptr [eax], al
0x16e000c:	add	byte ptr [eax], al
0x16e000e:	add	byte ptr [eax], al
0x16e0010:	add	byte ptr [eax], al
0x16e0012:	outsb	dx, byte ptr [esi]
0x16e0013:	add	dword ptr [eax], eax
0x16e0015:	add	byte ptr [eax], al
0x16e0017:	add	byte ptr [eax], al
0x16e0019:	add	byte ptr [eax], al
0x16e001b:	add	byte ptr [eax], al
0x16e001d:	add	byte ptr [eax], al
0x16e001f:	add	byte ptr [eax], dl
0x16e0021:	add	byte ptr [esi + 1], ch
0x16e0024:	add	byte ptr [eax], al
0x16e0026:	add	byte ptr [eax], al
0x16e0028:	add	byte ptr [eax], al
0x16e002a:	add	byte ptr [eax], al
0x16e002c:	add	byte ptr [eax], al
0x16e002e:	add	byte ptr [eax], al
0x16e0030:	and	byte ptr [eax], al
0x16e0032:	outsb	dx, byte ptr [esi]
0x16e0033:	add	dword ptr [eax], eax
0x16e0035:	add	byte ptr [eax], al
0x16e0037:	add	byte ptr [eax], al
0x16e0039:	add	byte ptr [eax], al
0x16e003b:	add	byte ptr [eax], al
0x16e003d:	add	byte ptr [eax], al
2856	explorer.exe	0x38d0000	0x38d1fff	VadS	PAGE_EXECUTE_READWRITE	2	1	Disabled	
b0 00 eb 70 b0 01 eb 6c	...p...l
b0 02 eb 68 b0 03 eb 64	...h...d
b0 04 eb 60 b0 05 eb 5c	...`...\
b0 06 eb 58 b0 07 eb 54	...X...T
b0 08 eb 50 b0 09 eb 4c	...P...L
b0 0a eb 48 b0 0b eb 44	...H...D
b0 0c eb 40 b0 0d eb 3c	...@...<
b0 0e eb 38 b0 0f eb 34	...8...4	
0x38d0000:	mov	al, 0
0x38d0002:	jmp	0x38d0074
0x38d0004:	mov	al, 1
0x38d0006:	jmp	0x38d0074
0x38d0008:	mov	al, 2
0x38d000a:	jmp	0x38d0074
0x38d000c:	mov	al, 3
0x38d000e:	jmp	0x38d0074
0x38d0010:	mov	al, 4
0x38d0012:	jmp	0x38d0074
0x38d0014:	mov	al, 5
0x38d0016:	jmp	0x38d0074
0x38d0018:	mov	al, 6
0x38d001a:	jmp	0x38d0074
0x38d001c:	mov	al, 7
0x38d001e:	jmp	0x38d0074
0x38d0020:	mov	al, 8
0x38d0022:	jmp	0x38d0074
0x38d0024:	mov	al, 9
0x38d0026:	jmp	0x38d0074
0x38d0028:	mov	al, 0xa
0x38d002a:	jmp	0x38d0074
0x38d002c:	mov	al, 0xb
0x38d002e:	jmp	0x38d0074
0x38d0030:	mov	al, 0xc
0x38d0032:	jmp	0x38d0074
0x38d0034:	mov	al, 0xd
0x38d0036:	jmp	0x38d0074
0x38d0038:	mov	al, 0xe
0x38d003a:	jmp	0x38d0074
0x38d003c:	mov	al, 0xf
0x38d003e:	jmp	0x38d0074
3324	iexplore.exe	0x1fd0000	0x1fd1fff	VadS	PAGE_EXECUTE_READWRITE	2	1	Disabled	
b0 00 eb 70 b0 01 eb 6c	...p...l
b0 02 eb 68 b0 03 eb 64	...h...d
b0 04 eb 60 b0 05 eb 5c	...`...\
b0 06 eb 58 b0 07 eb 54	...X...T
b0 08 eb 50 b0 09 eb 4c	...P...L
b0 0a eb 48 b0 0b eb 44	...H...D
b0 0c eb 40 b0 0d eb 3c	...@...<
b0 0e eb 38 b0 0f eb 34	...8...4	
0x1fd0000:	mov	al, 0
0x1fd0002:	jmp	0x1fd0074
0x1fd0004:	mov	al, 1
0x1fd0006:	jmp	0x1fd0074
0x1fd0008:	mov	al, 2
0x1fd000a:	jmp	0x1fd0074
0x1fd000c:	mov	al, 3
0x1fd000e:	jmp	0x1fd0074
0x1fd0010:	mov	al, 4
0x1fd0012:	jmp	0x1fd0074
0x1fd0014:	mov	al, 5
0x1fd0016:	jmp	0x1fd0074
0x1fd0018:	mov	al, 6
0x1fd001a:	jmp	0x1fd0074
0x1fd001c:	mov	al, 7
0x1fd001e:	jmp	0x1fd0074
0x1fd0020:	mov	al, 8
0x1fd0022:	jmp	0x1fd0074
0x1fd0024:	mov	al, 9
0x1fd0026:	jmp	0x1fd0074
0x1fd0028:	mov	al, 0xa
0x1fd002a:	jmp	0x1fd0074
0x1fd002c:	mov	al, 0xb
0x1fd002e:	jmp	0x1fd0074
0x1fd0030:	mov	al, 0xc
0x1fd0032:	jmp	0x1fd0074
0x1fd0034:	mov	al, 0xd
0x1fd0036:	jmp	0x1fd0074
0x1fd0038:	mov	al, 0xe
0x1fd003a:	jmp	0x1fd0074
0x1fd003c:	mov	al, 0xf
0x1fd003e:	jmp	0x1fd0074
3324	iexplore.exe	0x3030000	0x3030fff	VadS	PAGE_EXECUTE_READWRITE	1	1	Disabled	
00 00 00 00 00 00 00 00	........
00 00 00 00 00 00 00 00	........
00 00 03 03 00 00 00 00	........
00 00 00 00 00 00 00 00	........
10 00 03 03 00 00 00 00	........
00 00 00 00 00 00 00 00	........
20 00 03 03 00 00 00 00	........
00 00 00 00 00 00 00 00	........	
0x3030000:	add	byte ptr [eax], al
0x3030002:	add	byte ptr [eax], al
0x3030004:	add	byte ptr [eax], al
0x3030006:	add	byte ptr [eax], al
0x3030008:	add	byte ptr [eax], al
0x303000a:	add	byte ptr [eax], al
0x303000c:	add	byte ptr [eax], al
0x303000e:	add	byte ptr [eax], al
0x3030010:	add	byte ptr [eax], al
0x3030012:	add	eax, dword ptr [ebx]
0x3030014:	add	byte ptr [eax], al
0x3030016:	add	byte ptr [eax], al
0x3030018:	add	byte ptr [eax], al
0x303001a:	add	byte ptr [eax], al
0x303001c:	add	byte ptr [eax], al
0x303001e:	add	byte ptr [eax], al
0x3030020:	adc	byte ptr [eax], al
0x3030022:	add	eax, dword ptr [ebx]
0x3030024:	add	byte ptr [eax], al
0x3030026:	add	byte ptr [eax], al
0x3030028:	add	byte ptr [eax], al
0x303002a:	add	byte ptr [eax], al
0x303002c:	add	byte ptr [eax], al
0x303002e:	add	byte ptr [eax], al
0x3030030:	and	byte ptr [eax], al
0x3030032:	add	eax, dword ptr [ebx]
0x3030034:	add	byte ptr [eax], al
0x3030036:	add	byte ptr [eax], al
0x3030038:	add	byte ptr [eax], al
0x303003a:	add	byte ptr [eax], al
0x303003c:	add	byte ptr [eax], al
0x303003e:	add	byte ptr [eax], al
3324	iexplore.exe	0x5fff0000	0x5fffffff	VadS	PAGE_EXECUTE_READWRITE	16	1	Disabled	
64 74 72 52 00 00 00 00	dtrR....
00 02 ff 5f 00 00 00 00	..._....
00 00 00 00 00 00 00 00	........
00 00 00 00 00 00 00 00	........
00 00 00 00 00 00 00 00	........
00 00 00 00 00 00 00 00	........
00 00 00 00 00 00 00 00	........
00 00 00 00 00 00 00 00	........	
0x5fff0000:	je	0x5fff0075
0x5fff0003:	push	edx
0x5fff0004:	add	byte ptr [eax], al
0x5fff0006:	add	byte ptr [eax], al
0x5fff0008:	add	byte ptr [edx], al
0x5fff000a:	lcall	[edi]
0x5fff000d:	add	byte ptr [eax], al
0x5fff000f:	add	byte ptr [eax], al
0x5fff0011:	add	byte ptr [eax], al
0x5fff0013:	add	byte ptr [eax], al
0x5fff0015:	add	byte ptr [eax], al
0x5fff0017:	add	byte ptr [eax], al
0x5fff0019:	add	byte ptr [eax], al
0x5fff001b:	add	byte ptr [eax], al
0x5fff001d:	add	byte ptr [eax], al
0x5fff001f:	add	byte ptr [eax], al
0x5fff0021:	add	byte ptr [eax], al
0x5fff0023:	add	byte ptr [eax], al
0x5fff0025:	add	byte ptr [eax], al
0x5fff0027:	add	byte ptr [eax], al
0x5fff0029:	add	byte ptr [eax], al
0x5fff002b:	add	byte ptr [eax], al
0x5fff002d:	add	byte ptr [eax], al
0x5fff002f:	add	byte ptr [eax], al
0x5fff0031:	add	byte ptr [eax], al
0x5fff0033:	add	byte ptr [eax], al
0x5fff0035:	add	byte ptr [eax], al
0x5fff0037:	add	byte ptr [eax], al
0x5fff0039:	add	byte ptr [eax], al
0x5fff003b:	add	byte ptr [eax], al
0x5fff003d:	add	byte ptr [eax], al
3344	iexplore.exe	0x25c0000	0x25c1fff	VadS	PAGE_EXECUTE_READWRITE	2	1	Disabled	
b0 00 eb 70 b0 01 eb 6c	...p...l
b0 02 eb 68 b0 03 eb 64	...h...d
b0 04 eb 60 b0 05 eb 5c	...`...\
b0 06 eb 58 b0 07 eb 54	...X...T
b0 08 eb 50 b0 09 eb 4c	...P...L
b0 0a eb 48 b0 0b eb 44	...H...D
b0 0c eb 40 b0 0d eb 3c	...@...<
b0 0e eb 38 b0 0f eb 34	...8...4	
0x25c0000:	mov	al, 0
0x25c0002:	jmp	0x25c0074
0x25c0004:	mov	al, 1
0x25c0006:	jmp	0x25c0074
0x25c0008:	mov	al, 2
0x25c000a:	jmp	0x25c0074
0x25c000c:	mov	al, 3
0x25c000e:	jmp	0x25c0074
0x25c0010:	mov	al, 4
0x25c0012:	jmp	0x25c0074
0x25c0014:	mov	al, 5
0x25c0016:	jmp	0x25c0074
0x25c0018:	mov	al, 6
0x25c001a:	jmp	0x25c0074
0x25c001c:	mov	al, 7
0x25c001e:	jmp	0x25c0074
0x25c0020:	mov	al, 8
0x25c0022:	jmp	0x25c0074
0x25c0024:	mov	al, 9
0x25c0026:	jmp	0x25c0074
0x25c0028:	mov	al, 0xa
0x25c002a:	jmp	0x25c0074
0x25c002c:	mov	al, 0xb
0x25c002e:	jmp	0x25c0074
0x25c0030:	mov	al, 0xc
0x25c0032:	jmp	0x25c0074
0x25c0034:	mov	al, 0xd
0x25c0036:	jmp	0x25c0074
0x25c0038:	mov	al, 0xe
0x25c003a:	jmp	0x25c0074
0x25c003c:	mov	al, 0xf
0x25c003e:	jmp	0x25c0074
3344	iexplore.exe	0x5fff0000	0x5fffffff	VadS	PAGE_EXECUTE_READWRITE	16	1	Disabled	
64 74 72 52 00 00 00 00	dtrR....
20 03 ff 5f 00 00 00 00	..._....
00 00 00 00 00 00 00 00	........
00 00 00 00 00 00 00 00	........
00 00 00 00 00 00 00 00	........
00 00 00 00 00 00 00 00	........
00 00 00 00 00 00 00 00	........
00 00 00 00 00 00 00 00	........	
0x5fff0000:	je	0x5fff0075
0x5fff0003:	push	edx
0x5fff0004:	add	byte ptr [eax], al
0x5fff0006:	add	byte ptr [eax], al
0x5fff0008:	and	byte ptr [ebx], al
0x5fff000a:	lcall	[edi]
0x5fff000d:	add	byte ptr [eax], al
0x5fff000f:	add	byte ptr [eax], al
0x5fff0011:	add	byte ptr [eax], al
0x5fff0013:	add	byte ptr [eax], al
0x5fff0015:	add	byte ptr [eax], al
0x5fff0017:	add	byte ptr [eax], al
0x5fff0019:	add	byte ptr [eax], al
0x5fff001b:	add	byte ptr [eax], al
0x5fff001d:	add	byte ptr [eax], al
0x5fff001f:	add	byte ptr [eax], al
0x5fff0021:	add	byte ptr [eax], al
0x5fff0023:	add	byte ptr [eax], al
0x5fff0025:	add	byte ptr [eax], al
0x5fff0027:	add	byte ptr [eax], al
0x5fff0029:	add	byte ptr [eax], al
0x5fff002b:	add	byte ptr [eax], al
0x5fff002d:	add	byte ptr [eax], al
0x5fff002f:	add	byte ptr [eax], al
0x5fff0031:	add	byte ptr [eax], al
0x5fff0033:	add	byte ptr [eax], al
0x5fff0035:	add	byte ptr [eax], al
0x5fff0037:	add	byte ptr [eax], al
0x5fff0039:	add	byte ptr [eax], al
0x5fff003b:	add	byte ptr [eax], al
0x5fff003d:	add	byte ptr [eax], al
2700	powershell.exe	0x1100000	0x113ffff	VadS	PAGE_EXECUTE_READWRITE	1	1	Disabled	
f2 44 93 9f 1e 46 00 01	.D...F..
ee ff ee ff 00 00 00 00	........
a8 00 10 01 a8 00 10 01	........
00 00 10 01 00 00 10 01	........
40 00 00 00 88 05 10 01	@.......
00 00 14 01 3f 00 00 00	....?...
01 00 00 00 00 00 00 00	........
f0 0f 10 01 f0 0f 10 01	........	
0x1100000:	inc	esp
0x1100002:	xchg	eax, ebx
0x1100003:	lahf	
0x1100004:	push	ds
0x1100005:	inc	esi
0x1100006:	add	byte ptr [ecx], al
0x1100008:	out	dx, al
2700	powershell.exe	0x1b10000	0x1b4ffff	VadS	PAGE_EXECUTE_READWRITE	4	1	Disabled	
fb e8 fc 8b e3 61 00 01	.....a..
ee ff ee ff 00 00 00 00	........
a8 00 b1 01 a8 00 b1 01	........
00 00 b1 01 00 00 b1 01	........
40 00 00 00 88 05 b1 01	@.......
00 00 b5 01 3c 00 00 00	....<...
01 00 00 00 00 00 00 00	........
f0 3f b1 01 f0 3f b1 01	.?...?..	
0x1b10000:	sti	
0x1b10001:	call	0x63948c02
0x1b10006:	add	byte ptr [ecx], al
0x1b10008:	out	dx, al
2700	powershell.exe	0x7ff50000	0x7ff5ffff	VadS	PAGE_EXECUTE_READWRITE	1	1	Disabled	
00 00 00 00 97 19 00 00	........
00 00 00 00 0e 00 00 00	........
68 00 00 00 00 e9 b2 38	h......8
bc 81 68 01 00 00 00 e9	..h.....
a8 38 bc 81 68 02 00 00	.8..h...
00 e9 9e 38 bc 81 68 03	...8..h.
00 00 00 e9 94 38 bc 81	.....8..
68 04 00 00 00 e9 8a 38	h......8	
0x7ff50000:	add	byte ptr [eax], al
0x7ff50002:	add	byte ptr [eax], al
0x7ff50004:	xchg	eax, edi
0x7ff50005:	sbb	dword ptr [eax], eax
0x7ff50007:	add	byte ptr [eax], al
0x7ff50009:	add	byte ptr [eax], al
0x7ff5000b:	add	byte ptr [esi], cl
0x7ff5000d:	add	byte ptr [eax], al
0x7ff5000f:	add	byte ptr [eax], ch
0x7ff50012:	add	byte ptr [eax], al
0x7ff50014:	add	cl, ch
0x7ff50016:	mov	dl, 0x38
0x7ff50018:	mov	esp, 0x16881
0x7ff5001d:	add	byte ptr [eax], al
0x7ff5001f:	jmp	0x1b138cc
0x7ff50024:	push	2
0x7ff50029:	jmp	0x1b138cc
0x7ff5002e:	push	3
0x7ff50033:	jmp	0x1b138cc
0x7ff50038:	push	4
2700	powershell.exe	0x7ff60000	0x7ffaffff	VadS	PAGE_EXECUTE_READWRITE	1	1	Disabled	
ec ff ff ff 04 00 00 00	........
01 00 00 00 00 00 08 01	........
1c 00 00 00 15 00 0e 00	........
0e 00 00 00 64 09 ab 6a	....d..j
00 10 84 6a 5c 70 86 6a	...j\p.j
2c 30 84 6a 00 00 00 00	,0.j....
00 00 00 00 10 00 f5 7f	........
1a 00 f5 7f 24 00 f5 7f	....$...	
0x7ff60000:	in	al, dx
