Volatility 3 Framework 2.27.0

PID	Process	Start VPN	End VPN	Tag	Protection	CommitCharge	PrivateMemory	File output	Notes	Hexdump	Disasm

2976	MsMpEng.exe	0x1759b2d0000	0x1759b3dcfff	VadS	PAGE_EXECUTE_READWRITE	269	1	Disabled	N/A	
56 57 53 55 41 54 41 55 48 83 ec 28 48 8b e9 48 VWSUATAUH..(H..H
8d b1 88 38 00 00 ff e2 48 83 c4 28 41 5d 41 5c ...8....H..(A]A\
5d 5b 5f 5e c3 00 00 00 00 00 00 00 00 00 00 00 ][_^............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................	
0x1759b2d0000:	push	rsi
0x1759b2d0001:	push	rdi
0x1759b2d0002:	push	rbx
0x1759b2d0003:	push	rbp
0x1759b2d0004:	push	r12
0x1759b2d0006:	push	r13
0x1759b2d0008:	sub	rsp, 0x28
0x1759b2d000c:	mov	rbp, rcx
0x1759b2d000f:	lea	rsi, [rcx + 0x3888]
0x1759b2d0016:	jmp	rdx
0x1759b2d0018:	add	rsp, 0x28
0x1759b2d001c:	pop	r13
0x1759b2d001e:	pop	r12
0x1759b2d0020:	pop	rbp
0x1759b2d0021:	pop	rbx
0x1759b2d0022:	pop	rdi
0x1759b2d0023:	pop	rsi
0x1759b2d0024:	ret	
0x1759b2d0025:	add	byte ptr [rax], al
0x1759b2d0027:	add	byte ptr [rax], al
0x1759b2d0029:	add	byte ptr [rax], al
0x1759b2d002b:	add	byte ptr [rax], al
0x1759b2d002d:	add	byte ptr [rax], al
0x1759b2d002f:	add	byte ptr [rax], al
0x1759b2d0031:	add	byte ptr [rax], al
0x1759b2d0033:	add	byte ptr [rax], al
0x1759b2d0035:	add	byte ptr [rax], al
0x1759b2d0037:	add	byte ptr [rax], al
0x1759b2d0039:	add	byte ptr [rax], al
0x1759b2d003b:	add	byte ptr [rax], al
0x1759b2d003d:	add	byte ptr [rax], al
2976	MsMpEng.exe	0x1759a9f0000	0x1759abeffff	VadS	PAGE_EXECUTE_READWRITE	512	1	Disabled	N/A	
20 00 00 00 e0 ff 1f 00 0c 00 00 00 01 00 07 00  ...............
00 42 00 30 00 70 00 60 00 50 00 c0 00 d0 00 00 .B.0.p.`.P......
0c 00 4e 00 0c 00 01 05 48 8b 55 28 48 8b 8d c0 ..N.....H.U(H...
00 00 00 48 8d 54 0a 10 48 89 d7 b9 08 00 1a 00 ...H.T..H.......	
0x1759a9f0000:	and	byte ptr [rax], al
0x1759a9f0002:	add	byte ptr [rax], al
0x1759a9f0004:	loopne	0x1759a9f0005
2976	MsMpEng.exe	0x1759a8f0000	0x1759a9effff	VadS	PAGE_EXECUTE_READWRITE	256	1	Disabled	N/A	
20 00 00 00 e0 ff 0f 00 0c 00 00 00 01 00 07 00  ...............
00 42 00 30 00 70 00 60 00 50 00 c0 00 d0 00 00 .B.0.p.`.P......
08 00 42 00 00 00 00 05 48 8b 45 20 48 89 c2 48 ..B.....H.E H..H
8b 45 18 48 8b 00 48 89 02 48 8b 45 20 81 00 b8 .E.H..H..H.E ...	
0x1759a8f0000:	and	byte ptr [rax], al
0x1759a8f0002:	add	byte ptr [rax], al
0x1759a8f0004:	loopne	0x1759a8f0005
0x1759a8f0006:	str	word ptr [rax + rax]
0x1759a8f000a:	add	byte ptr [rax], al
0x1759a8f000c:	add	dword ptr [rax], eax
2976	MsMpEng.exe	0x1759abf0000	0x1759acfcfff	VadS	PAGE_EXECUTE_READWRITE	269	1	Disabled	N/A	
56 57 53 55 41 54 41 55 48 83 ec 28 48 8b e9 48 VWSUATAUH..(H..H
8d b1 88 38 00 00 ff e2 48 83 c4 28 41 5d 41 5c ...8....H..(A]A\
5d 5b 5f 5e c3 00 00 00 00 00 00 00 00 00 00 00 ][_^............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................	
0x1759abf0000:	push	rsi
0x1759abf0001:	push	rdi
0x1759abf0002:	push	rbx
0x1759abf0003:	push	rbp
0x1759abf0004:	push	r12
0x1759abf0006:	push	r13
0x1759abf0008:	sub	rsp, 0x28
0x1759abf000c:	mov	rbp, rcx
0x1759abf000f:	lea	rsi, [rcx + 0x3888]
0x1759abf0016:	jmp	rdx
0x1759abf0018:	add	rsp, 0x28
0x1759abf001c:	pop	r13
0x1759abf001e:	pop	r12
0x1759abf0020:	pop	rbp
0x1759abf0021:	pop	rbx
0x1759abf0022:	pop	rdi
0x1759abf0023:	pop	rsi
0x1759abf0024:	ret	
0x1759abf0025:	add	byte ptr [rax], al
0x1759abf0027:	add	byte ptr [rax], al
0x1759abf0029:	add	byte ptr [rax], al
0x1759abf002b:	add	byte ptr [rax], al
0x1759abf002d:	add	byte ptr [rax], al
0x1759abf002f:	add	byte ptr [rax], al
0x1759abf0031:	add	byte ptr [rax], al
0x1759abf0033:	add	byte ptr [rax], al
0x1759abf0035:	add	byte ptr [rax], al
0x1759abf0037:	add	byte ptr [rax], al
0x1759abf0039:	add	byte ptr [rax], al
0x1759abf003b:	add	byte ptr [rax], al
0x1759abf003d:	add	byte ptr [rax], al
2976	MsMpEng.exe	0x1759aec0000	0x1759afccfff	VadS	PAGE_EXECUTE_READWRITE	269	1	Disabled	N/A	
56 57 53 55 41 54 41 55 48 83 ec 28 48 8b e9 48 VWSUATAUH..(H..H
8d b1 88 38 00 00 ff e2 48 83 c4 28 41 5d 41 5c ...8....H..(A]A\
5d 5b 5f 5e c3 00 00 00 00 00 00 00 00 00 00 00 ][_^............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................	
0x1759aec0000:	push	rsi
0x1759aec0001:	push	rdi
0x1759aec0002:	push	rbx
0x1759aec0003:	push	rbp
0x1759aec0004:	push	r12
0x1759aec0006:	push	r13
0x1759aec0008:	sub	rsp, 0x28
0x1759aec000c:	mov	rbp, rcx
0x1759aec000f:	lea	rsi, [rcx + 0x3888]
0x1759aec0016:	jmp	rdx
0x1759aec0018:	add	rsp, 0x28
0x1759aec001c:	pop	r13
0x1759aec001e:	pop	r12
0x1759aec0020:	pop	rbp
0x1759aec0021:	pop	rbx
0x1759aec0022:	pop	rdi
0x1759aec0023:	pop	rsi
0x1759aec0024:	ret	
0x1759aec0025:	add	byte ptr [rax], al
0x1759aec0027:	add	byte ptr [rax], al
0x1759aec0029:	add	byte ptr [rax], al
0x1759aec002b:	add	byte ptr [rax], al
0x1759aec002d:	add	byte ptr [rax], al
0x1759aec002f:	add	byte ptr [rax], al
0x1759aec0031:	add	byte ptr [rax], al
0x1759aec0033:	add	byte ptr [rax], al
0x1759aec0035:	add	byte ptr [rax], al
0x1759aec0037:	add	byte ptr [rax], al
0x1759aec0039:	add	byte ptr [rax], al
0x1759aec003b:	add	byte ptr [rax], al
0x1759aec003d:	add	byte ptr [rax], al
5192	SearchApp.exe	0x247c1880000	0x247c189ffff	VadS	PAGE_EXECUTE_READWRITE	7	1	Disabled	N/A	
48 89 54 24 10 48 89 4c 24 08 4c 89 44 24 18 4c H.T$.H.L$.L.D$.L
89 4c 24 20 48 8b 41 28 48 8b 48 08 48 8b 51 50 .L$ H.A(H.H.H.QP
48 83 e2 f8 48 8b ca 48 b8 60 00 88 c1 47 02 00 H...H..H.`...G..
00 48 2b c8 48 81 f9 70 0f 00 00 76 09 48 c7 c1 .H+.H..p...v.H..	
0x247c1880000:	mov	qword ptr [rsp + 0x10], rdx
0x247c1880005:	mov	qword ptr [rsp + 8], rcx
0x247c188000a:	mov	qword ptr [rsp + 0x18], r8
0x247c188000f:	mov	qword ptr [rsp + 0x20], r9
0x247c1880014:	mov	rax, qword ptr [rcx + 0x28]
0x247c1880018:	mov	rcx, qword ptr [rax + 8]
0x247c188001c:	mov	rdx, qword ptr [rcx + 0x50]
0x247c1880020:	and	rdx, 0xfffffffffffffff8
0x247c1880024:	mov	rcx, rdx
0x247c1880027:	movabs	rax, 0x247c1880060
0x247c1880031:	sub	rcx, rax
0x247c1880034:	cmp	rcx, 0xf70
0x247c188003b:	jbe	0x247c1880046
5192	SearchApp.exe	0x247d3bf0000	0x247d3c53fff	VadS	PAGE_EXECUTE_READWRITE	2	1	Disabled	N/A	
e9 fb ff fd ef ff ff ff ff cc cc cc cc cc cc cc ................
e9 eb 7f 01 f0 ff ff ff ff cc cc cc cc cc cc cc ................
e9 db 13 fe ef ff ff ff ff cc cc cc cc cc cc cc ................
e9 cb 03 fe ef ff ff ff ff cc cc cc cc cc cc cc ................	
0x247d3bf0000:	jmp	0x247c3bd0000
6752	powershell.exe	0x1fbce920000	0x1fbce92ffff	VadS	PAGE_EXECUTE_READWRITE	8	1	Disabled	N/A	
00 00 00 00 00 00 00 00 75 7c 10 19 10 74 00 01 ........u|...t..
ee ff ee ff 02 00 00 00 20 01 92 ce fb 01 00 00 ........ .......
20 01 92 ce fb 01 00 00 00 00 92 ce fb 01 00 00  ...............
00 00 92 ce fb 01 00 00 0f 00 00 00 00 00 00 00 ................	
0x1fbce920000:	add	byte ptr [rax], al
0x1fbce920002:	add	byte ptr [rax], al
0x1fbce920004:	add	byte ptr [rax], al
0x1fbce920006:	add	byte ptr [rax], al
0x1fbce920008:	jne	0x1fbce920086
0x1fbce92000a:	adc	byte ptr [rcx], bl
0x1fbce92000c:	adc	byte ptr [rax + rax + 1], dh
0x1fbce920010:	out	dx, al
6752	powershell.exe	0x1fbceda0000	0x1fbcedaffff	VadS	PAGE_EXECUTE_READWRITE	2	1	Disabled	N/A	
00 00 00 00 00 00 00 00 17 2d fe cb 5e a0 00 01 .........-..^...
ee ff ee ff 02 00 00 00 20 01 da ce fb 01 00 00 ........ .......
20 01 da ce fb 01 00 00 00 00 da ce fb 01 00 00  ...............
00 00 da ce fb 01 00 00 0f 00 00 00 00 00 00 00 ................	
0x1fbceda0000:	add	byte ptr [rax], al
0x1fbceda0002:	add	byte ptr [rax], al
0x1fbceda0004:	add	byte ptr [rax], al
0x1fbceda0006:	add	byte ptr [rax], al
6752	powershell.exe	0x1fbcee20000	0x1fbcee2cfff	VadS	PAGE_EXECUTE_READWRITE	1	1	Disabled	N/A	
00 00 00 00 00 00 00 00 90 78 92 ce fb 01 00 00 .........x......
90 78 92 ce fb 01 00 00 00 00 92 ce fb 01 00 00 .x..............
e0 0d e2 ce fb 01 00 00 00 10 e2 ce fb 01 00 00 ................
00 d0 e2 ce fb 01 00 00 01 00 00 00 00 00 00 00 ................	
0x1fbcee20000:	add	byte ptr [rax], al
0x1fbcee20002:	add	byte ptr [rax], al
0x1fbcee20004:	add	byte ptr [rax], al
0x1fbcee20006:	add	byte ptr [rax], al
0x1fbcee20008:	nop	
0x1fbcee20009:	js	0x1fbcee1ff9d
6752	powershell.exe	0x7df49a460000	0x7df49a4fffff	VadS	PAGE_EXECUTE_READWRITE	2	1	Disabled	N/A	
d8 ff ff ff ff ff ff ff 08 00 00 00 00 00 00 00 ................
01 00 00 00 00 00 00 00 00 02 0e 03 38 00 00 00 ............8...
68 01 02 08 45 00 00 00 d8 5d c1 d4 ff 7f 00 00 h...E....]......
00 10 bf d4 ff 7f 00 00 18 85 d8 d4 ff 7f 00 00 ................	
0x7df49a460000:	fdivr	st(7)
6752	powershell.exe	0x7df49a450000	0x7df49a45ffff	VadS	PAGE_EXECUTE_READWRITE	1	1	Disabled	N/A	
00 00 00 00 00 00 00 00 78 0d 00 00 00 00 00 00 ........x.......
45 00 00 00 49 c7 c2 00 00 00 00 48 b8 a0 49 a9 E...I......H..I.
d7 ff 7f 00 00 ff e0 49 c7 c2 01 00 00 00 48 b8 .......I......H.
a0 49 a9 d7 ff 7f 00 00 ff e0 49 c7 c2 02 00 00 .I........I.....	
0x7df49a450000:	add	byte ptr [rax], al
0x7df49a450002:	add	byte ptr [rax], al
0x7df49a450004:	add	byte ptr [rax], al
0x7df49a450006:	add	byte ptr [rax], al
0x7df49a450008:	js	0x7df49a450017
0x7df49a45000a:	add	byte ptr [rax], al
0x7df49a45000c:	add	byte ptr [rax], al
0x7df49a45000e:	add	byte ptr [rax], al
0x7df49a450010:	add	byte ptr [r8], r8b
0x7df49a450013:	add	byte ptr [rcx - 0x39], cl
0x7df49a450016:	ret	0
0x7df49a450019:	add	byte ptr [rax], al
0x7df49a45001b:	movabs	rax, 0x7fffd7a949a0
0x7df49a450025:	jmp	rax
0x7df49a450027:	mov	r10, 1
0x7df49a45002e:	movabs	rax, 0x7fffd7a949a0
0x7df49a450038:	jmp	rax
