mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-08-21 05:52:22 +02:00
94 lines
2.4 KiB
JSON
94 lines
2.4 KiB
JSON
{
|
|
"WINDOWS10_GENERIC": [
|
|
{
|
|
"CommitCharge": 1,
|
|
"End VPN": 2147381247,
|
|
"File": null,
|
|
"File output": "Disabled",
|
|
"Offset": 18446607800399740208,
|
|
"PID": 4,
|
|
"Parent": 0,
|
|
"PrivateMemory": 1,
|
|
"Process": "System",
|
|
"Protection": "PAGE_READONLY",
|
|
"Start VPN": 2147377152,
|
|
"Tag": "VadS",
|
|
"__children": []
|
|
},
|
|
{
|
|
"CommitCharge": 1,
|
|
"End VPN": 2147356671,
|
|
"File": null,
|
|
"File output": "Disabled",
|
|
"Offset": 18446607800399739968,
|
|
"PID": 4,
|
|
"Parent": 18446607800399740208,
|
|
"PrivateMemory": 1,
|
|
"Process": "System",
|
|
"Protection": "PAGE_READONLY",
|
|
"Start VPN": 2147352576,
|
|
"Tag": "VadS",
|
|
"__children": []
|
|
},
|
|
{
|
|
"CommitCharge": 9,
|
|
"End VPN": 2004303871,
|
|
"File": "\\Windows\\SysWOW64\\ntdll.dll",
|
|
"File output": "Disabled",
|
|
"Offset": 18446607800410763840,
|
|
"PID": 4,
|
|
"Parent": 18446607800399739968,
|
|
"PrivateMemory": 0,
|
|
"Process": "System",
|
|
"Protection": "PAGE_EXECUTE_WRITECOPY",
|
|
"Start VPN": 2002583552,
|
|
"Tag": "Vad ",
|
|
"__children": []
|
|
},
|
|
{
|
|
"CommitCharge": 9,
|
|
"End VPN": 140703785033727,
|
|
"File": "\\Windows\\System32\\vertdll.dll",
|
|
"File output": "Disabled",
|
|
"Offset": 18446607800410768000,
|
|
"PID": 4,
|
|
"Parent": 18446607800399740208,
|
|
"PrivateMemory": 0,
|
|
"Process": "System",
|
|
"Protection": "PAGE_EXECUTE_WRITECOPY",
|
|
"Start VPN": 140703784828928,
|
|
"Tag": "Vad ",
|
|
"__children": []
|
|
},
|
|
{
|
|
"CommitCharge": 0,
|
|
"End VPN": 2873390796799,
|
|
"File": null,
|
|
"File output": "Disabled",
|
|
"Offset": 18446607800474375600,
|
|
"PID": 4,
|
|
"Parent": 18446607800410768000,
|
|
"PrivateMemory": 0,
|
|
"Process": "System",
|
|
"Protection": "PAGE_READWRITE",
|
|
"Start VPN": 2873390792704,
|
|
"Tag": "Vad ",
|
|
"__children": []
|
|
},
|
|
{
|
|
"CommitCharge": 16,
|
|
"End VPN": 140703787155455,
|
|
"File": "\\Windows\\System32\\ntdll.dll",
|
|
"File output": "Disabled",
|
|
"Offset": 18446607800410767520,
|
|
"PID": 4,
|
|
"Parent": 18446607800410768000,
|
|
"PrivateMemory": 0,
|
|
"Process": "System",
|
|
"Protection": "PAGE_EXECUTE_WRITECOPY",
|
|
"Start VPN": 140703785091072,
|
|
"Tag": "Vad ",
|
|
"__children": []
|
|
}
|
|
]
|
|
} |