Invtero.net

inVtero.net: Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques

Download as .zip Download as .tar.gz View on GitHub

inVtero.net

Expanding on process detection into microarchitecture independent hypervisor introspection. The aim of inVtero.net is to provide some very high performance, high assurance interfaces to work with physical memory dumps. Isolation and extraction of process memory, including recursive introspection of VM/hypervisors that may be running.

quickdumps

Quickdumps is a demo of the inVtero.net API. A small tool to rapidly extract everything it can see into a sensible directory hierarchy.

References

See CanSecWest presentation on page table detection or DC22. I added a lost of the VM introspection stuff lately for Ruxcon.

Upcoming

Cryptographically secure integrity verification of known memory pages to greatly reduce the proportion of possibly malicious resident code.

Authors and Contributors

You can try to contact @ShaneK2 or feel free to make a bug/feature request.

Support or Contact

Eventually some documentation will be setup documentation

                                                                                                                                                                                                                                                                                                    
C:\temp>dir Free*.v*
Volume in drive C is OS
Volume Serial Number is B430-E111

Directory of C:\temp

11/01/2015 11:29 AM 8,388,608,000 FreeBSD 64-bit-Snapshot1.vmem
11/01/2015 11:29 AM 1,680,905 FreeBSD 64-bit-Snapshot1.vmsn
2 File(s) 8,390,288,905 bytes
0 Dir(s) 1,580,528,070,656 bytes free

C:\temp>x:quickdumps.exe "FreeBSD 64-bit-Snapshot1.vmsn" fbsdwin
Process CR3 [00000000065C8000] File Offset [00000000065C8000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process CR3 [0000000006B51000] File Offset [0000000006B51000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process CR3 [0000000006CC9000] File Offset [0000000006CC9000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process CR3 [0000000006CFA000] File Offset [0000000006CFA000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process CR3 [0000000006D66000] File Offset [0000000006D66000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process CR3 [0000000006D6D000] File Offset [0000000006D6D000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process CR3 [0000000006DA4000] File Offset [0000000006DA4000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process CR3 [0000000006DA5000] File Offset [0000000006DA5000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process CR3 [0000000006DBB000] File Offset [0000000006DBB000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process CR3 [0000000006DBF000] File Offset [0000000006DBF000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process CR3 [0000000006DEC000] File Offset [0000000006DEC000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process CR3 [0000000055099000] File Offset [0000000055099000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process CR3 [0000000055103000] File Offset [0000000055103000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process CR3 [000000005523B000] File Offset [000000005523B000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process CR3 [0000000055286000] File Offset [0000000055286000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process CR3 [0000000055293000] File Offset [0000000055293000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process CR3 [00000000552BE000] File Offset [00000000552BE000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process CR3 [00000000552D7000] File Offset [00000000552D7000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process CR3 [0000000055305000] File Offset [0000000055305000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process CR3 [000000005548C000] File Offset [000000005548C000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process CR3 [0000000086E0B000] File Offset [0000000086E0B000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process CR3 [00000000001AB000] File Offset [0000000090BAB000] Diff [0000000090A00000] Type [Windows] VMCS []
Process CR3 [0000000002382000] File Offset [0000000099582000] Diff [0000000097200000] Type [Windows] VMCS []
Process CR3 [00000000029D7000] File Offset [000000009B1D7000] Diff [0000000098800000] Type [Windows] VMCS []
Process CR3 [0000000003A1E000] File Offset [000000009C61E000] Diff [0000000098C00000] Type [Windows] VMCS []
Process CR3 [0000000004828000] File Offset [000000009E228000] Diff [0000000099A00000] Type [Windows] VMCS []
Process CR3 [000000000498B000] File Offset [000000009E38B000] Diff [0000000099A00000] Type [Windows] VMCS []
Process CR3 [000000007DCC6000] File Offset [00000000CF2C6000] Diff [0000000051600000] Type [Windows] VMCS []
Process CR3 [0000000037300000] File Offset [00000000EE900000] Diff [00000000B7600000] Type [Windows] VMCS []
Process CR3 [0000000034CE8000] File Offset [00000000F0EE8000] Diff [00000000BC200000] Type [Windows] VMCS []
Process CR3 [0000000033A82000] File Offset [00000000F2082000] Diff [00000000BE600000] Type [Windows] VMCS []
Process CR3 [000000003297E000] File Offset [00000000F337E000] Diff [00000000C0A00000] Type [Windows] VMCS []
Process CR3 [0000000030CAC000] File Offset [00000000F4EAC000] Diff [00000000C4200000] Type [Windows] VMCS []
Process CR3 [0000000030DA7000] File Offset [00000000F4FA7000] Diff [00000000C4200000] Type [Windows] VMCS []
Process CR3 [000000002E8E3000] File Offset [00000000F72E3000] Diff [00000000C8A00000] Type [Windows] VMCS []
Process CR3 [000000002E4EA000] File Offset [00000000F76EA000] Diff [00000000C9200000] Type [Windows] VMCS []
Process CR3 [000000002E263000] File Offset [00000000F7863000] Diff [00000000C9600000] Type [Windows] VMCS []
Process CR3 [000000002D292000] File Offset [00000000F8892000] Diff [00000000CB600000] Type [Windows] VMCS []
Process CR3 [000000002CC8A000] File Offset [00000000F8E8A000] Diff [00000000CC200000] Type [Windows] VMCS []
Process CR3 [000000002CB0D000] File Offset [00000000F910D000] Diff [00000000CC600000] Type [Windows] VMCS []
Process CR3 [000000002C2C3000] File Offset [00000000F9AC3000] Diff [00000000CD800000] Type [Windows] VMCS []
Process CR3 [00000000294E8000] File Offset [00000000FD8E8000] Diff [00000000D4400000] Type [Windows] VMCS []
Process CR3 [00000000254C6000] File Offset [00000001092C6000] Diff [00000000E3E00000] Type [Windows] VMCS []▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
Process CR3 [0000000020975000] File Offset [000000010DF75000] Diff [00000000ED600000] Type [Windows] VMCS []▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
Process CR3 [000000001E4D2000] File Offset [00000001102D2000] Diff [00000000F1E00000] Type [Windows] VMCS []▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
Process CR3 [000000001E583000] File Offset [0000000110383000] Diff [00000000F1E00000] Type [Windows] VMCS []
Process CR3 [000000001CB5B000] File Offset [0000000111F5B000] Diff [00000000F5400000] Type [Windows] VMCS []
Process CR3 [0000000018700000] File Offset [0000000116300000] Diff [00000000FDC00000] Type [Windows] VMCS []▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
Process CR3 [00000000174CC000] File Offset [00000001174CC000] Diff [0000000100000000] Type [Windows] VMCS []
Process CR3 [0000000015FB9000] File Offset [0000000118BB9000] Diff [0000000102C00000] Type [Windows] VMCS []▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
Process CR3 [00000000156B0000] File Offset [00000001192B0000] Diff [0000000103C00000] Type [Windows] VMCS []
Process CR3 [000000001525B000] File Offset [000000011965B000] Diff [0000000104400000] Type [Windows] VMCS []
Process CR3 [0000000015119000] File Offset [0000000119919000] Diff [0000000104800000] Type [Windows] VMCS []
Process CR3 [000000001511F000] File Offset [000000011991F000] Diff [0000000104800000] Type [Windows] VMCS []
Process CR3 [00000000130DF000] File Offset [000000011BADF000] Diff [0000000108A00000] Type [Windows] VMCS []
Process CR3 [0000000011F49000] File Offset [000000011CD49000] Diff [000000010AE00000] Type [Windows] VMCS []
Process CR3 [0000000010836000] File Offset [000000011E236000] Diff [000000010DA00000] Type [Windows] VMCS []
Process CR3 [00000000108BB000] File Offset [000000011E2BB000] Diff [000000010DA00000] Type [Windows] VMCS []
Process CR3 [000000000E90D000] File Offset [000000012010D000] Diff [0000000111800000] Type [Windows] VMCS []▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
Process CR3 [000000000E484000] File Offset [0000000120484000] Diff [0000000112000000] Type [Windows] VMCS []
Process CR3 [000000000DFFC000] File Offset [0000000120BFC000] Diff [0000000112C00000] Type [Windows] VMCS []
Process CR3 [000000000CEF0000] File Offset [0000000121AF0000] Diff [0000000114C00000] Type [Windows] VMCS []
Process CR3 [0000000008915000] File Offset [0000000126115000] Diff [000000011D800000] Type [Windows] VMCS []▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
Process CR3 [0000000008583000] File Offset [0000000126583000] Diff [000000011E000000] Type [Windows] VMCS []
Process CR3 [0000000007660000] File Offset [0000000127260000] Diff [000000011FC00000] Type [Windows] VMCS []
Process CR3 [00000000075BD000] File Offset [00000001275BD000] Diff [0000000120000000] Type [Windows] VMCS []
Process CR3 [0000000007023000] File Offset [0000000127823000] Diff [0000000120800000] Type [Windows] VMCS []
Process CR3 [0000000006688000] File Offset [0000000128288000] Diff [0000000121C00000] Type [Windows] VMCS []▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
Process CR3 [000000000671D000] File Offset [000000012831D000] Diff [0000000121C00000] Type [Windows] VMCS []
Process CR3 [000000016A0BB000] File Offset [000000012A0BB000] Diff [FFFFFFFFC0000000] Type [FreeBSD] VMCS []
Process CR3 [000000016AE8C000] File Offset [000000012AE8C000] Diff [FFFFFFFFC0000000] Type [FreeBSD] VMCS []
Process CR3 [00000001CC4E1000] File Offset [000000018C4E1000] Diff [FFFFFFFFC0000000] Type [FreeBSD] VMCS []▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
Process CR3 [0000657461747000] File Offset [00000001B5ABE000] Diff [FFFF9A8D54377000] Type [Windows] VMCS []▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
73 candidate process page tables. Time so far: 00:00:10.1489964, second pass starting. rate: 788.191 MB/s▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
Hypervisor: VMCS revision field: VMWARE_NESTED [00000001] abort indicator: NO_ABORT [00000000]
Hypervisor: Windows CR3 found [00000000001AB000)] byte-swapped: [00B01A0000000000] @ PAGE/File Offset = [000000006CCC6000]
[14][000000005536B01E]
Hypervisor: VMCS revision field: VMWARE_NESTED [00000001] abort indicator: NO_ABORT [00000000]
Hypervisor: Windows CR3 found [000000000E484000)] byte-swapped: [0040480E00000000] @ PAGE/File Offset = [000000006CCC7000]
[14][000000005536B01E]
1 candidate VMCS pages. Time to process: 00:00:31.1710751▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
Data scanned: 8,388,608,000.00Second pass done. rate: 513.271 MB/s
grouping and joining all memory
Scanning for group correlations
MemberProces: Group 1 Type [Windows] GroupCorrelation [100.000 %] PID [1AB000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [2382000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [29D7000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [3A1E000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [4828000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [498B000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [6688000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [671D000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [7023000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [75BD000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [7660000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [8583000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [8915000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [CEF0000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [DFFC000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [E484000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [E90D000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [10836000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [108BB000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [11F49000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [130DF000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [15119000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [1511F000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [1525B000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [156B0000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [15FB9000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [174CC000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [18700000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [1CB5B000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [1E4D2000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [1E583000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [20975000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [254C6000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [294E8000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [2C2C3000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [2CB0D000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [2CC8A000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [2D292000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [2E263000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [2E4EA000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [2E8E3000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [30CAC000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [30DA7000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [3297E000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [33A82000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [34CE8000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [37300000]
MemberProces: Group 1 Type [Windows] GroupCorrelation [90.909 %] PID [7DCC6000]
Finished Group 1 collected size 48 next group
Scanning for group correlations
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [65C8000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [6B51000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [6CC9000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [6CFA000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [6D66000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [6D6D000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [6DA4000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [6DA5000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [6DBB000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [6DBF000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [6DEC000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [55099000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [55103000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [5523B000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [55286000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [55293000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [552BE000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [552D7000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [55305000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [5548C000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [86E0B000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [16A0BB000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [16AE8C000]
MemberProces: Group 2 Type [FreeBSD] GroupCorrelation [100.000 %] PID [1CC4E1000]
Finished Group 2 collected size 24 next group
Scanning for group correlations
MemberProces: Group 3 Type [Windows] GroupCorrelation [69.323 %] PID [657461747000]
Finished Group 3 collected size 1 next group
Done All process groups.
Saving checkpoint... freebsd 64-bit-snapshot1.vmem.inVtero.net
assessing 73 address space combinations
PT analysis of Process CR3 [00000000001AB000] File Offset [0000000090BAB000] Diff [0000000090A00000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
0 of 48 Virtualized Process PT Entries [1090] Type [Windows] PID [5536B01E:1AB000]
1 VMCS dominated process address spaces and were decoded successfully.
PT analysis of Process CR3 [0000000002382000] File Offset [0000000099582000] Diff [0000000097200000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
1 of 48 Virtualized Process PT Entries [1200] Type [Windows] PID [5536B01E:2382000]
2 VMCS dominated process address spaces and were decoded successfully.
PT analysis of Process CR3 [00000000029D7000] File Offset [000000009B1D7000] Diff [0000000098800000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
2 of 48 Virtualized Process PT Entries [593] Type [Windows] PID [5536B01E:29D7000]
3 VMCS dominated process address spaces and were decoded successfully.
PT analysis of Process CR3 [0000000003A1E000] File Offset [000000009C61E000] Diff [0000000098C00000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
3 of 48 Virtualized Process PT Entries [3377] Type [Windows] PID [5536B01E:3A1E000]
4 VMCS dominated process address spaces and were decoded successfully.
PT analysis of Process CR3 [0000000004828000] File Offset [000000009E228000] Diff [0000000099A00000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
4 of 48 Virtualized Process PT Entries [2165] Type [Windows] PID [5536B01E:4828000]
5 VMCS dominated process address spaces and were decoded successfully.
PT analysis of Process CR3 [000000000498B000] File Offset [000000009E38B000] Diff [0000000099A00000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
5 of 48 Virtualized Process PT Entries [1971] Type [Windows] PID [5536B01E:498B000]
6 VMCS dominated process address spaces and were decoded successfully.
PT analysis of Process CR3 [0000000006688000] File Offset [0000000128288000] Diff [0000000121C00000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
6 of 48 Virtualized Process PT Entries [1263] Type [Windows] PID [5536B01E:6688000]
7 VMCS dominated process address spaces and were decoded successfully.
PT analysis of Process CR3 [000000000671D000] File Offset [000000012831D000] Diff [0000000121C00000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
7 of 48 Virtualized Process PT Entries [1647] Type [Windows] PID [5536B01E:671D000]
8 VMCS dominated process address spaces and were decoded successfully.
PT analysis of Process CR3 [0000000007023000] File Offset [0000000127823000] Diff [0000000120800000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
8 of 48 Virtualized Process PT Entries [2053] Type [Windows] PID [5536B01E:7023000]
9 VMCS dominated process address spaces and were decoded successfully.
PT analysis of Process CR3 [00000000075BD000] File Offset [00000001275BD000] Diff [0000000120000000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
9 of 48 Virtualized Process PT Entries [1799] Type [Windows] PID [5536B01E:75BD000]
10 VMCS dominated process address spaces and were decoded successfully.
PT analysis of Process CR3 [0000000007660000] File Offset [0000000127260000] Diff [000000011FC00000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
10 of 48 Virtualized Process PT Entries [3328] Type [Windows] PID [5536B01E:7660000]
11 VMCS dominated process address spaces and were decoded successfully.
PT analysis of Process CR3 [0000000008583000] File Offset [0000000126583000] Diff [000000011E000000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
11 of 48 Virtualized Process PT Entries [4101] Type [Windows] PID [5536B01E:8583000]
12 VMCS dominated process address spaces and were decoded successfully.
PT analysis of Process CR3 [0000000008915000] File Offset [0000000126115000] Diff [000000011D800000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
12 of 48 Virtualized Process PT Entries [2006] Type [Windows] PID [5536B01E:8915000]
13 VMCS dominated process address spaces and were decoded successfully.
PT analysis of Process CR3 [000000000CEF0000] File Offset [0000000121AF0000] Diff [0000000114C00000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
13 of 48 Virtualized Process PT Entries [13309] Type [Windows] PID [5536B01E:CEF0000]
14 VMCS dominated process address spaces and were decoded successfully.
PT analysis of Process CR3 [000000000DFFC000] File Offset [0000000120BFC000] Diff [0000000112C00000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
14 of 48 Virtualized Process PT Entries [20815] Type [Windows] PID [5536B01E:DFFC000]
15 VMCS dominated process address spaces and were decoded successfully.
PT analysis of Process CR3 [000000000E484000] File Offset [0000000120484000] Diff [0000000112000000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
15 of 48 Virtualized Process PT Entries [4864] Type [Windows] PID [5536B01E:E484000]
16 VMCS dominated process address spaces and were decoded successfully.
PT analysis of Process CR3 [000000000E90D000] File Offset [000000012010D000] Diff [0000000111800000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
16 of 48 Virtualized Process PT Entries [4898] Type [Windows] PID [5536B01E:E90D000]
17 VMCS dominated process address spaces and were decoded successfully.
PT analysis of Process CR3 [0000000010836000] File Offset [000000011E236000] Diff [000000010DA00000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
17 of 48 Virtualized Process PT Entries [13864] Type [Windows] PID [5536B01E:10836000]
18 VMCS dominated process address spaces and were decoded successfully.▒
PT analysis of Process CR3 [00000000108BB000] File Offset [000000011E2BB000] Diff [000000010DA00000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
18 of 48 Virtualized Process PT Entries [5499] Type [Windows] PID [5536B01E:108BB000]
19 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒
PT analysis of Process CR3 [0000000011F49000] File Offset [000000011CD49000] Diff [000000010AE00000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
19 of 48 Virtualized Process PT Entries [2560] Type [Windows] PID [5536B01E:11F49000]
20 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [00000000130DF000] File Offset [000000011BADF000] Diff [0000000108A00000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
20 of 48 Virtualized Process PT Entries [4795] Type [Windows] PID [5536B01E:130DF000]
21 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [0000000015119000] File Offset [0000000119919000] Diff [0000000104800000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
21 of 48 Virtualized Process PT Entries [2869] Type [Windows] PID [5536B01E:15119000]
22 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [000000001511F000] File Offset [000000011991F000] Diff [0000000104800000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
22 of 48 Virtualized Process PT Entries [3765] Type [Windows] PID [5536B01E:1511F000]
23 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [000000001525B000] File Offset [000000011965B000] Diff [0000000104400000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
23 of 48 Virtualized Process PT Entries [2301] Type [Windows] PID [5536B01E:1525B000]
24 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [00000000156B0000] File Offset [00000001192B0000] Diff [0000000103C00000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
24 of 48 Virtualized Process PT Entries [2695] Type [Windows] PID [5536B01E:156B0000]
25 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [0000000015FB9000] File Offset [0000000118BB9000] Diff [0000000102C00000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
25 of 48 Virtualized Process PT Entries [1586] Type [Windows] PID [5536B01E:15FB9000]
26 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [00000000174CC000] File Offset [00000001174CC000] Diff [0000000100000000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
26 of 48 Virtualized Process PT Entries [20324] Type [Windows] PID [5536B01E:174CC000]
27 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [0000000018700000] File Offset [0000000116300000] Diff [00000000FDC00000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
27 of 48 Virtualized Process PT Entries [3684] Type [Windows] PID [5536B01E:18700000]
28 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [000000001CB5B000] File Offset [0000000111F5B000] Diff [00000000F5400000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
28 of 48 Virtualized Process PT Entries [8262] Type [Windows] PID [5536B01E:1CB5B000]
29 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [000000001E4D2000] File Offset [00000001102D2000] Diff [00000000F1E00000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
29 of 48 Virtualized Process PT Entries [1447] Type [Windows] PID [5536B01E:1E4D2000]
30 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [000000001E583000] File Offset [0000000110383000] Diff [00000000F1E00000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
30 of 48 Virtualized Process PT Entries [12688] Type [Windows] PID [5536B01E:1E583000]
31 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [0000000020975000] File Offset [000000010DF75000] Diff [00000000ED600000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
31 of 48 Virtualized Process PT Entries [3799] Type [Windows] PID [5536B01E:20975000]
32 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [00000000254C6000] File Offset [00000001092C6000] Diff [00000000E3E00000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
32 of 48 Virtualized Process PT Entries [28181] Type [Windows] PID [5536B01E:254C6000]
33 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [00000000294E8000] File Offset [00000000FD8E8000] Diff [00000000D4400000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
33 of 48 Virtualized Process PT Entries [1797] Type [Windows] PID [5536B01E:294E8000]
34 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [000000002C2C3000] File Offset [00000000F9AC3000] Diff [00000000CD800000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
34 of 48 Virtualized Process PT Entries [1009] Type [Windows] PID [5536B01E:2C2C3000]
35 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [000000002CB0D000] File Offset [00000000F910D000] Diff [00000000CC600000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
35 of 48 Virtualized Process PT Entries [1275] Type [Windows] PID [5536B01E:2CB0D000]
36 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [000000002CC8A000] File Offset [00000000F8E8A000] Diff [00000000CC200000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
36 of 48 Virtualized Process PT Entries [1170] Type [Windows] PID [5536B01E:2CC8A000]
37 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [000000002D292000] File Offset [00000000F8892000] Diff [00000000CB600000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
37 of 48 Virtualized Process PT Entries [3212] Type [Windows] PID [5536B01E:2D292000]
38 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [000000002E263000] File Offset [00000000F7863000] Diff [00000000C9600000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
38 of 48 Virtualized Process PT Entries [10069] Type [Windows] PID [5536B01E:2E263000]
39 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [000000002E4EA000] File Offset [00000000F76EA000] Diff [00000000C9200000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
39 of 48 Virtualized Process PT Entries [5815] Type [Windows] PID [5536B01E:2E4EA000]
40 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [000000002E8E3000] File Offset [00000000F72E3000] Diff [00000000C8A00000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
40 of 48 Virtualized Process PT Entries [1921] Type [Windows] PID [5536B01E:2E8E3000]
41 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [0000000030CAC000] File Offset [00000000F4EAC000] Diff [00000000C4200000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
41 of 48 Virtualized Process PT Entries [1665] Type [Windows] PID [5536B01E:30CAC000]
42 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [0000000030DA7000] File Offset [00000000F4FA7000] Diff [00000000C4200000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
42 of 48 Virtualized Process PT Entries [1049] Type [Windows] PID [5536B01E:30DA7000]
43 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [000000003297E000] File Offset [00000000F337E000] Diff [00000000C0A00000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
43 of 48 Virtualized Process PT Entries [5919] Type [Windows] PID [5536B01E:3297E000]
44 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [0000000033A82000] File Offset [00000000F2082000] Diff [00000000BE600000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
44 of 48 Virtualized Process PT Entries [3355] Type [Windows] PID [5536B01E:33A82000]
45 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [0000000034CE8000] File Offset [00000000F0EE8000] Diff [00000000BC200000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
45 of 48 Virtualized Process PT Entries [3010] Type [Windows] PID [5536B01E:34CE8000]
46 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [0000000037300000] File Offset [00000000EE900000] Diff [00000000B7600000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
46 of 48 Virtualized Process PT Entries [11095] Type [Windows] PID [5536B01E:37300000]
47 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [000000007DCC6000] File Offset [00000000CF2C6000] Diff [0000000051600000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
47 of 48 Virtualized Process PT Entries [2364] Type [Windows] PID [5536B01E:7DCC6000]
Validated 100% 48 of detected group 1, continuing with next group.
PT analysis of Process CR3 [00000000065C8000] File Offset [00000000065C8000] Diff [0000000000000000] Type [FreeBSD] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
0 of 24 Virtualized Process PT Entries [7813] Type [FreeBSD] PID [5536B01E:65C8000]
48 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [0000000006B51000] File Offset [0000000006B51000] Diff [0000000000000000] Type [FreeBSD] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
1 of 24 Virtualized Process PT Entries [274081] Type [FreeBSD] PID [5536B01E:6B51000]
49 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [0000000006CC9000] File Offset [0000000006CC9000] Diff [0000000000000000] Type [FreeBSD] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
2 of 24 Virtualized Process PT Entries [1591449] Type [FreeBSD] PID [5536B01E:6CC9000]
50 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [0000000006CFA000] File Offset [0000000006CFA000] Diff [0000000000000000] Type [FreeBSD] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
3 of 24 Virtualized Process PT Entries [5365] Type [FreeBSD] PID [5536B01E:6CFA000]
51 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [0000000006D66000] File Offset [0000000006D66000] Diff [0000000000000000] Type [FreeBSD] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
4 of 24 Virtualized Process PT Entries [74883] Type [FreeBSD] PID [5536B01E:6D66000]
52 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [0000000006D6D000] File Offset [0000000006D6D000] Diff [0000000000000000] Type [FreeBSD] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
5 of 24 Virtualized Process PT Entries [7063] Type [FreeBSD] PID [5536B01E:6D6D000]
53 VMCS dominated process address spaces and were decoded successfully.▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒▒
PT analysis of Process CR3 [0000000006DA4000] File Offset [0000000006DA4000] Diff [0000000000000000] Type [FreeBSD] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
BAD EPTP/DirectoryTable Base 000000005536B01E, try a different candidate or this dump may lack a hypervisor. Attempting PT walk W/O SLAT
canceling evaluation of bad EPTP for this group/Address Space (2)
PT analysis of Process CR3 [0000657461747000] File Offset [00000001B5ABE000] Diff [FFFF9A8D54377000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
0 of 1 Virtualized Process PT Entries [318366] Type [Windows] PID [5536B01E:657461747000]
Validated 100% 1 of detected group 3, continuing with next group.
PT analysis of Process CR3 [00000000001AB000] File Offset [0000000090BAB000] Diff [0000000090A00000] Type [Windows] VMCS []
Process 00000000001AB000 Physical walk w/o SLAT yielded 167995 entries, bare metal group is 1
PT analysis of Process CR3 [0000000002382000] File Offset [0000000099582000] Diff [0000000097200000] Type [Windows] VMCS []
Decoding failed for 0000000002382000
Process 0000000002382000 Physical walk w/o SLAT yielded 0 entries, bare metal group is 1
PT analysis of Process CR3 [00000000029D7000] File Offset [000000009B1D7000] Diff [0000000098800000] Type [Windows] VMCS []
Process 00000000029D7000 Physical walk w/o SLAT yielded 14894 entries, bare metal group is 1
PT analysis of Process CR3 [0000000003A1E000] File Offset [000000009C61E000] Diff [0000000098C00000] Type [Windows] VMCS []
Process 0000000003A1E000 Physical walk w/o SLAT yielded 186101 entries, bare metal group is 1
PT analysis of Process CR3 [0000000004828000] File Offset [000000009E228000] Diff [0000000099A00000] Type [Windows] VMCS []
Process 0000000004828000 Physical walk w/o SLAT yielded 1027 entries, bare metal group is 1
PT analysis of Process CR3 [000000000498B000] File Offset [000000009E38B000] Diff [0000000099A00000] Type [Windows] VMCS []
Process 000000000498B000 Physical walk w/o SLAT yielded 2115639 entries, bare metal group is 1
PT analysis of Process CR3 [00000000065C8000] File Offset [00000000065C8000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process 00000000065C8000 Physical walk w/o SLAT yielded 122 entries, bare metal group is 2
PT analysis of Process CR3 [0000000006688000] File Offset [0000000128288000] Diff [0000000121C00000] Type [Windows] VMCS []
Process 0000000006688000 Physical walk w/o SLAT yielded 1026 entries, bare metal group is 1
PT analysis of Process CR3 [000000000671D000] File Offset [000000012831D000] Diff [0000000121C00000] Type [Windows] VMCS []
Process 000000000671D000 Physical walk w/o SLAT yielded 523 entries, bare metal group is 1
PT analysis of Process CR3 [0000000006B51000] File Offset [0000000006B51000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process 0000000006B51000 Physical walk w/o SLAT yielded 375 entries, bare metal group is 2
PT analysis of Process CR3 [0000000006CC9000] File Offset [0000000006CC9000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process 0000000006CC9000 Physical walk w/o SLAT yielded 418 entries, bare metal group is 2
PT analysis of Process CR3 [0000000006CFA000] File Offset [0000000006CFA000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process 0000000006CFA000 Physical walk w/o SLAT yielded 950 entries, bare metal group is 2
PT analysis of Process CR3 [0000000006D66000] File Offset [0000000006D66000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process 0000000006D66000 Physical walk w/o SLAT yielded 174 entries, bare metal group is 2
PT analysis of Process CR3 [0000000006D6D000] File Offset [0000000006D6D000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process 0000000006D6D000 Physical walk w/o SLAT yielded 363 entries, bare metal group is 2
PT analysis of Process CR3 [0000000006DA4000] File Offset [0000000006DA4000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process 0000000006DA4000 Physical walk w/o SLAT yielded 435 entries, bare metal group is 2
PT analysis of Process CR3 [0000000006DA5000] File Offset [0000000006DA5000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process 0000000006DA5000 Physical walk w/o SLAT yielded 367 entries, bare metal group is 2
PT analysis of Process CR3 [0000000006DBB000] File Offset [0000000006DBB000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process 0000000006DBB000 Physical walk w/o SLAT yielded 332 entries, bare metal group is 2
PT analysis of Process CR3 [0000000006DBF000] File Offset [0000000006DBF000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process 0000000006DBF000 Physical walk w/o SLAT yielded 739 entries, bare metal group is 2
PT analysis of Process CR3 [0000000006DEC000] File Offset [0000000006DEC000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process 0000000006DEC000 Physical walk w/o SLAT yielded 767 entries, bare metal group is 2
PT analysis of Process CR3 [0000000007023000] File Offset [0000000127823000] Diff [0000000120800000] Type [Windows] VMCS []
Process 0000000007023000 Physical walk w/o SLAT yielded 514 entries, bare metal group is 1
PT analysis of Process CR3 [00000000075BD000] File Offset [00000001275BD000] Diff [0000000120000000] Type [Windows] VMCS []
Process 00000000075BD000 Physical walk w/o SLAT yielded 514 entries, bare metal group is 1
PT analysis of Process CR3 [0000000007660000] File Offset [0000000127260000] Diff [000000011FC00000] Type [Windows] VMCS []
Process 0000000007660000 Physical walk w/o SLAT yielded 36922 entries, bare metal group is 1
PT analysis of Process CR3 [0000000008583000] File Offset [0000000126583000] Diff [000000011E000000] Type [Windows] VMCS []
Process 0000000008583000 Physical walk w/o SLAT yielded 218012 entries, bare metal group is 1
PT analysis of Process CR3 [0000000008915000] File Offset [0000000126115000] Diff [000000011D800000] Type [Windows] VMCS []
Process 0000000008915000 Physical walk w/o SLAT yielded 13586 entries, bare metal group is 1
PT analysis of Process CR3 [000000000CEF0000] File Offset [0000000121AF0000] Diff [0000000114C00000] Type [Windows] VMCS []
Process 000000000CEF0000 Physical walk w/o SLAT yielded 38518 entries, bare metal group is 1
PT analysis of Process CR3 [000000000DFFC000] File Offset [0000000120BFC000] Diff [0000000112C00000] Type [Windows] VMCS []
Process 000000000DFFC000 Physical walk w/o SLAT yielded 1026 entries, bare metal group is 1
PT analysis of Process CR3 [000000000E484000] File Offset [0000000120484000] Diff [0000000112000000] Type [Windows] VMCS []
Process 000000000E484000 Physical walk w/o SLAT yielded 1539 entries, bare metal group is 1
PT analysis of Process CR3 [000000000E90D000] File Offset [000000012010D000] Diff [0000000111800000] Type [Windows] VMCS []
Process 000000000E90D000 Physical walk w/o SLAT yielded 1026 entries, bare metal group is 1
PT analysis of Process CR3 [0000000010836000] File Offset [000000011E236000] Diff [000000010DA00000] Type [Windows] VMCS []
Process 0000000010836000 Physical walk w/o SLAT yielded 1741 entries, bare metal group is 1
PT analysis of Process CR3 [00000000108BB000] File Offset [000000011E2BB000] Diff [000000010DA00000] Type [Windows] VMCS []
Process 00000000108BB000 Physical walk w/o SLAT yielded 11570 entries, bare metal group is 1
PT analysis of Process CR3 [0000000011F49000] File Offset [000000011CD49000] Diff [000000010AE00000] Type [Windows] VMCS []
Process 0000000011F49000 Physical walk w/o SLAT yielded 1539 entries, bare metal group is 1
PT analysis of Process CR3 [00000000130DF000] File Offset [000000011BADF000] Diff [0000000108A00000] Type [Windows] VMCS []
Process 00000000130DF000 Physical walk w/o SLAT yielded 708603 entries, bare metal group is 1
PT analysis of Process CR3 [0000000015119000] File Offset [0000000119919000] Diff [0000000104800000] Type [Windows] VMCS []
Process 0000000015119000 Physical walk w/o SLAT yielded 38398 entries, bare metal group is 1
PT analysis of Process CR3 [000000001511F000] File Offset [000000011991F000] Diff [0000000104800000] Type [Windows] VMCS []
Process 000000001511F000 Physical walk w/o SLAT yielded 883445 entries, bare metal group is 1
PT analysis of Process CR3 [000000001525B000] File Offset [000000011965B000] Diff [0000000104400000] Type [Windows] VMCS []
Process 000000001525B000 Physical walk w/o SLAT yielded 18064 entries, bare metal group is 1
PT analysis of Process CR3 [00000000156B0000] File Offset [00000001192B0000] Diff [0000000103C00000] Type [Windows] VMCS []
Process 00000000156B0000 Physical walk w/o SLAT yielded 60546 entries, bare metal group is 1
PT analysis of Process CR3 [0000000015FB9000] File Offset [0000000118BB9000] Diff [0000000102C00000] Type [Windows] VMCS []
Process 0000000015FB9000 Physical walk w/o SLAT yielded 112885 entries, bare metal group is 1
PT analysis of Process CR3 [00000000174CC000] File Offset [00000001174CC000] Diff [0000000100000000] Type [Windows] VMCS []
Process 00000000174CC000 Physical walk w/o SLAT yielded 184888 entries, bare metal group is 1
PT analysis of Process CR3 [0000000018700000] File Offset [0000000116300000] Diff [00000000FDC00000] Type [Windows] VMCS []
Process 0000000018700000 Physical walk w/o SLAT yielded 65583 entries, bare metal group is 1
PT analysis of Process CR3 [000000001CB5B000] File Offset [0000000111F5B000] Diff [00000000F5400000] Type [Windows] VMCS []
Process 000000001CB5B000 Physical walk w/o SLAT yielded 2444811 entries, bare metal group is 1
PT analysis of Process CR3 [000000001E4D2000] File Offset [00000001102D2000] Diff [00000000F1E00000] Type [Windows] VMCS []
Process 000000001E4D2000 Physical walk w/o SLAT yielded 1539 entries, bare metal group is 1
PT analysis of Process CR3 [000000001E583000] File Offset [0000000110383000] Diff [00000000F1E00000] Type [Windows] VMCS []
Process 000000001E583000 Physical walk w/o SLAT yielded 36174 entries, bare metal group is 1
PT analysis of Process CR3 [0000000020975000] File Offset [000000010DF75000] Diff [00000000ED600000] Type [Windows] VMCS []
Process 0000000020975000 Physical walk w/o SLAT yielded 9551 entries, bare metal group is 1
PT analysis of Process CR3 [00000000254C6000] File Offset [00000001092C6000] Diff [00000000E3E00000] Type [Windows] VMCS []
Process 00000000254C6000 Physical walk w/o SLAT yielded 228957 entries, bare metal group is 1
PT analysis of Process CR3 [00000000294E8000] File Offset [00000000FD8E8000] Diff [00000000D4400000] Type [Windows] VMCS []
Process 00000000294E8000 Physical walk w/o SLAT yielded 3468699 entries, bare metal group is 1
PT analysis of Process CR3 [000000002C2C3000] File Offset [00000000F9AC3000] Diff [00000000CD800000] Type [Windows] VMCS []
Process 000000002C2C3000 Physical walk w/o SLAT yielded 957019 entries, bare metal group is 1
PT analysis of Process CR3 [000000002CB0D000] File Offset [00000000F910D000] Diff [00000000CC600000] Type [Windows] VMCS []
Process 000000002CB0D000 Physical walk w/o SLAT yielded 24308 entries, bare metal group is 1
PT analysis of Process CR3 [000000002CC8A000] File Offset [00000000F8E8A000] Diff [00000000CC200000] Type [Windows] VMCS []
Process 000000002CC8A000 Physical walk w/o SLAT yielded 209653 entries, bare metal group is 1
PT analysis of Process CR3 [000000002D292000] File Offset [00000000F8892000] Diff [00000000CB600000] Type [Windows] VMCS []
Process 000000002D292000 Physical walk w/o SLAT yielded 55856 entries, bare metal group is 1
PT analysis of Process CR3 [000000002E263000] File Offset [00000000F7863000] Diff [00000000C9600000] Type [Windows] VMCS []
Process 000000002E263000 Physical walk w/o SLAT yielded 1538 entries, bare metal group is 1
PT analysis of Process CR3 [000000002E4EA000] File Offset [00000000F76EA000] Diff [00000000C9200000] Type [Windows] VMCS []
Process 000000002E4EA000 Physical walk w/o SLAT yielded 559924 entries, bare metal group is 1
PT analysis of Process CR3 [000000002E8E3000] File Offset [00000000F72E3000] Diff [00000000C8A00000] Type [Windows] VMCS []
Process 000000002E8E3000 Physical walk w/o SLAT yielded 140699 entries, bare metal group is 1
PT analysis of Process CR3 [0000000030CAC000] File Offset [00000000F4EAC000] Diff [00000000C4200000] Type [Windows] VMCS []
Process 0000000030CAC000 Physical walk w/o SLAT yielded 19487 entries, bare metal group is 1
PT analysis of Process CR3 [0000000030DA7000] File Offset [00000000F4FA7000] Diff [00000000C4200000] Type [Windows] VMCS []
Process 0000000030DA7000 Physical walk w/o SLAT yielded 16898 entries, bare metal group is 1
PT analysis of Process CR3 [000000003297E000] File Offset [00000000F337E000] Diff [00000000C0A00000] Type [Windows] VMCS []
Process 000000003297E000 Physical walk w/o SLAT yielded 1026 entries, bare metal group is 1
PT analysis of Process CR3 [0000000033A82000] File Offset [00000000F2082000] Diff [00000000BE600000] Type [Windows] VMCS []
Process 0000000033A82000 Physical walk w/o SLAT yielded 50403 entries, bare metal group is 1
PT analysis of Process CR3 [0000000034CE8000] File Offset [00000000F0EE8000] Diff [00000000BC200000] Type [Windows] VMCS []
Process 0000000034CE8000 Physical walk w/o SLAT yielded 1026 entries, bare metal group is 1
PT analysis of Process CR3 [0000000037300000] File Offset [00000000EE900000] Diff [00000000B7600000] Type [Windows] VMCS []
Process 0000000037300000 Physical walk w/o SLAT yielded 246242 entries, bare metal group is 1
PT analysis of Process CR3 [0000000055099000] File Offset [0000000055099000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process 0000000055099000 Physical walk w/o SLAT yielded 196739 entries, bare metal group is 2
PT analysis of Process CR3 [0000000055103000] File Offset [0000000055103000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process 0000000055103000 Physical walk w/o SLAT yielded 588 entries, bare metal group is 2
PT analysis of Process CR3 [000000005523B000] File Offset [000000005523B000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process 000000005523B000 Physical walk w/o SLAT yielded 1836 entries, bare metal group is 2
PT analysis of Process CR3 [0000000055286000] File Offset [0000000055286000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process 0000000055286000 Physical walk w/o SLAT yielded 844 entries, bare metal group is 2
PT analysis of Process CR3 [0000000055293000] File Offset [0000000055293000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process 0000000055293000 Physical walk w/o SLAT yielded 401 entries, bare metal group is 2
PT analysis of Process CR3 [00000000552BE000] File Offset [00000000552BE000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process 00000000552BE000 Physical walk w/o SLAT yielded 844 entries, bare metal group is 2
PT analysis of Process CR3 [00000000552D7000] File Offset [00000000552D7000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process 00000000552D7000 Physical walk w/o SLAT yielded 845 entries, bare metal group is 2
PT analysis of Process CR3 [0000000055305000] File Offset [0000000055305000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process 0000000055305000 Physical walk w/o SLAT yielded 402 entries, bare metal group is 2
PT analysis of Process CR3 [000000005548C000] File Offset [000000005548C000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process 000000005548C000 Physical walk w/o SLAT yielded 862 entries, bare metal group is 2
PT analysis of Process CR3 [000000007DCC6000] File Offset [00000000CF2C6000] Diff [0000000051600000] Type [Windows] VMCS []
Process 000000007DCC6000 Physical walk w/o SLAT yielded 2050 entries, bare metal group is 1
PT analysis of Process CR3 [0000000086E0B000] File Offset [0000000086E0B000] Diff [0000000000000000] Type [FreeBSD] VMCS []
Process 0000000086E0B000 Physical walk w/o SLAT yielded 846 entries, bare metal group is 2
PT analysis of Process CR3 [000000016A0BB000] File Offset [000000012A0BB000] Diff [FFFFFFFFC0000000] Type [FreeBSD] VMCS []
Process 000000016A0BB000 Physical walk w/o SLAT yielded 647 entries, bare metal group is 2
PT analysis of Process CR3 [000000016AE8C000] File Offset [000000012AE8C000] Diff [FFFFFFFFC0000000] Type [FreeBSD] VMCS []
Process 000000016AE8C000 Physical walk w/o SLAT yielded 846 entries, bare metal group is 2
PT analysis of Process CR3 [00000001CC4E1000] File Offset [000000018C4E1000] Diff [FFFFFFFFC0000000] Type [FreeBSD] VMCS []
Process 00000001CC4E1000 Physical walk w/o SLAT yielded 1386 entries, bare metal group is 2

Final analysis completed, address spaces extracted. 00:01:01.0357676 rate: 393.212 MB/s

Address spaces resolved. Dump method starting.

[1] Contains 96 entries EPTP/Kernels shared Process CR3 [00000000001AB000] File Offset [0000000090BAB000] Diff [0000000090A00000] Type [Windows] VMCS []
[2] Contains 24 entries EPTP/Kernels shared Process CR3 [00000000065C8000] File Offset [00000000065C8000] Diff [0000000000000000] Type [FreeBSD] VMCS []
[3] Contains 1 entries EPTP/Kernels shared Process CR3 [0000657461747000] File Offset [00000001B5ABE000] Diff [FFFF9A8D54377000] Type [Windows] VMCS [EPTP = [Address:000000005536B01E, Type:WriteBack, WalkLen:3, Valid:True, Valid2:True, ValidEntry:False, LargePDP:False, LargePDE:False]]
Select an address space: 2
Loading address space entries based on Process CR3 [00000000065C8000] File Offset [00000000065C8000] Diff [0000000000000000] Type [FreeBSD] VMCS []
0 Hypervisor:0 Process:65C8000 entries 122 type FreeBSD group 0
1 Hypervisor:0 Process:6B51000 entries 375 type FreeBSD group 0
2 Hypervisor:0 Process:6CC9000 entries 418 type FreeBSD group 0
3 Hypervisor:0 Process:6CFA000 entries 950 type FreeBSD group 0
4 Hypervisor:0 Process:6D66000 entries 174 type FreeBSD group 0
5 Hypervisor:0 Process:6D6D000 entries 363 type FreeBSD group 0
6 Hypervisor:0 Process:6DA4000 entries 435 type FreeBSD group 0
7 Hypervisor:0 Process:6DA5000 entries 367 type FreeBSD group 0
8 Hypervisor:0 Process:6DBB000 entries 332 type FreeBSD group 0
9 Hypervisor:0 Process:6DBF000 entries 739 type FreeBSD group 0
10 Hypervisor:0 Process:6DEC000 entries 767 type FreeBSD group 0
11 Hypervisor:0 Process:55099000 entries 196739 type FreeBSD group 0
12 Hypervisor:0 Process:55103000 entries 588 type FreeBSD group 0
13 Hypervisor:0 Process:5523B000 entries 1836 type FreeBSD group 0
14 Hypervisor:0 Process:55286000 entries 844 type FreeBSD group 0
15 Hypervisor:0 Process:55293000 entries 401 type FreeBSD group 0
16 Hypervisor:0 Process:552BE000 entries 844 type FreeBSD group 0
17 Hypervisor:0 Process:552D7000 entries 845 type FreeBSD group 0
18 Hypervisor:0 Process:55305000 entries 402 type FreeBSD group 0
19 Hypervisor:0 Process:5548C000 entries 862 type FreeBSD group 0
20 Hypervisor:0 Process:86E0B000 entries 846 type FreeBSD group 0
21 Hypervisor:0 Process:16A0BB000 entries 647 type FreeBSD group 0
22 Hypervisor:0 Process:16AE8C000 entries 846 type FreeBSD group 0
23 Hypervisor:0 Process:1CC4E1000 entries 1386 type FreeBSD group 0
Select a process to dump: 11
Dumping details for process 11 Process CR3 [0000000055099000] File Offset [0000000055099000] Diff [0000000000000000] Type [FreeBSD] VMCS []

Listing ranges for Process CR3 [0000000055099000] File Offset [0000000055099000] Diff [0000000000000000] Type [FreeBSD] VMCS [], 196229 entries scanned.
0 Virtual: Addr: 0000000000000000, PML4E 000, DirectoryPointerOffset:000, DirectoryOffset:000, TableOffset: 000, Offset: 0000 Physical: Addr:000000022009F067 PFN:00000022009F AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
1 Virtual: Addr: 00007F8000000000, PML4E 0FF, DirectoryPointerOffset:000, DirectoryOffset:000, TableOffset: 000, Offset: 0000 Physical: Addr:00000001E9498067 PFN:0000001E9498 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
select a range to dump (enter for all, minus '-' go up a level):1
0 Virtual: Addr: 00007FFFC0000000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:000, TableOffset: 000, Offset: 0000 Physical: Addr:000000022055E067 PFN:00000022055E AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
select a range to dump (enter for all, minus '-' go up a level):0
0 Virtual: Addr: 00007FFFDDA00000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0ED, TableOffset: 000, Offset: 0000 Physical: Addr:000000022035F067 PFN:00000022035F AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
1 Virtual: Addr: 00007FFFDDC00000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0EE, TableOffset: 000, Offset: 0000 Physical: Addr:000000016A813067 PFN:00000016A813 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
2 Virtual: Addr: 00007FFFDDE00000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0EF, TableOffset: 000, Offset: 0000 Physical: Addr:000000016AE65067 PFN:00000016AE65 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
3 Virtual: Addr: 00007FFFDE000000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0F0, TableOffset: 000, Offset: 0000 Physical: Addr:000000016A0F1067 PFN:00000016A0F1 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
4 Virtual: Addr: 00007FFFDE200000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0F1, TableOffset: 000, Offset: 0000 Physical: Addr:000000016AF1A067 PFN:00000016AF1A AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
5 Virtual: Addr: 00007FFFDE400000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0F2, TableOffset: 000, Offset: 0000 Physical: Addr:000000022033E067 PFN:00000022033E AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
6 Virtual: Addr: 00007FFFDE600000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0F3, TableOffset: 000, Offset: 0000 Physical: Addr:000000022067F067 PFN:00000022067F AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
7 Virtual: Addr: 00007FFFDE800000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0F4, TableOffset: 000, Offset: 0000 Physical: Addr:000000016A2FC067 PFN:00000016A2FC AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
8 Virtual: Addr: 00007FFFDEA00000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0F5, TableOffset: 000, Offset: 0000 Physical: Addr:0000000220639067 PFN:000000220639 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
9 Virtual: Addr: 00007FFFDEC00000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0F6, TableOffset: 000, Offset: 0000 Physical: Addr:00000002206FE067 PFN:0000002206FE AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
10 Virtual: Addr: 00007FFFDEE00000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0F7, TableOffset: 000, Offset: 0000 Physical: Addr:00000001CC519067 PFN:0000001CC519 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
11 Virtual: Addr: 00007FFFDF000000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0F8, TableOffset: 000, Offset: 0000 Physical: Addr:00000001CCC0E067 PFN:0000001CCC0E AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
12 Virtual: Addr: 00007FFFDF200000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0F9, TableOffset: 000, Offset: 0000 Physical: Addr:0000000220078067 PFN:000000220078 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
13 Virtual: Addr: 00007FFFDF400000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0FA, TableOffset: 000, Offset: 0000 Physical: Addr:00000001E950A067 PFN:0000001E950A AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
14 Virtual: Addr: 00007FFFDF600000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0FB, TableOffset: 000, Offset: 0000 Physical: Addr:0000000220705067 PFN:000000220705 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
15 Virtual: Addr: 00007FFFDF800000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0FC, TableOffset: 000, Offset: 0000 Physical: Addr:00000001CC2A3067 PFN:0000001CC2A3 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
16 Virtual: Addr: 00007FFFDFA00000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0FD, TableOffset: 000, Offset: 0000 Physical: Addr:0000000055953067 PFN:000000055953 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
17 Virtual: Addr: 00007FFFDFC00000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0FE, TableOffset: 000, Offset: 0000 Physical: Addr:00000001CCA0F067 PFN:0000001CCA0F AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
18 Virtual: Addr: 00007FFFDFE00000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0FF, TableOffset: 000, Offset: 0000 Physical: Addr:000000016A0E2067 PFN:00000016A0E2 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
19 Virtual: Addr: 00007FFFFFE00000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:1FF, TableOffset: 000, Offset: 0000 Physical: Addr:00000001CC6F0067 PFN:0000001CC6F0 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
select a range to dump (enter for all, minus '-' go up a level):10
0 Virtual: Addr: 00007FFFDEFF5000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0F7, TableOffset: 1F5, Offset: 0000 Physical: Addr:8000000027658467 PFN:000000027658 AO:467 WS:0000 NX:+ W:- UN:+ COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
select a range to dump (enter for all, minus '-' go up a level):0
Writing out data into the same folder as the input
All done, last written file freebsd 64-bit-snapshot1.vmem.7FFFDEFF5000.bin of 1 so far. KeepGoing? ((y)es (n)o) y
Listing ranges for Process CR3 [0000000055099000] File Offset [0000000055099000] Diff [0000000000000000] Type [FreeBSD] VMCS [], 0 entries scanned.
select a range to dump (enter for all, minus '-' go up a level):-
0 Virtual: Addr: 00007FFFDEFF5000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0F7, TableOffset: 1F5, Offset: 0000 Physical: Addr:8000000027658467 PFN:000000027658 AO:467 WS:0000 NX:+ W:- UN:+ COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
select a range to dump (enter for all, minus '-' go up a level):-
0 Virtual: Addr: 00007FFFDDA00000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0ED, TableOffset: 000, Offset: 0000 Physical: Addr:000000022035F067 PFN:00000022035F AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
1 Virtual: Addr: 00007FFFDDC00000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0EE, TableOffset: 000, Offset: 0000 Physical: Addr:000000016A813067 PFN:00000016A813 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
2 Virtual: Addr: 00007FFFDDE00000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0EF, TableOffset: 000, Offset: 0000 Physical: Addr:000000016AE65067 PFN:00000016AE65 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
3 Virtual: Addr: 00007FFFDE000000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0F0, TableOffset: 000, Offset: 0000 Physical: Addr:000000016A0F1067 PFN:00000016A0F1 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
4 Virtual: Addr: 00007FFFDE200000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0F1, TableOffset: 000, Offset: 0000 Physical: Addr:000000016AF1A067 PFN:00000016AF1A AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
5 Virtual: Addr: 00007FFFDE400000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0F2, TableOffset: 000, Offset: 0000 Physical: Addr:000000022033E067 PFN:00000022033E AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
6 Virtual: Addr: 00007FFFDE600000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0F3, TableOffset: 000, Offset: 0000 Physical: Addr:000000022067F067 PFN:00000022067F AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
7 Virtual: Addr: 00007FFFDE800000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0F4, TableOffset: 000, Offset: 0000 Physical: Addr:000000016A2FC067 PFN:00000016A2FC AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
8 Virtual: Addr: 00007FFFDEA00000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0F5, TableOffset: 000, Offset: 0000 Physical: Addr:0000000220639067 PFN:000000220639 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
9 Virtual: Addr: 00007FFFDEC00000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0F6, TableOffset: 000, Offset: 0000 Physical: Addr:00000002206FE067 PFN:0000002206FE AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
10 Virtual: Addr: 00007FFFDEE00000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0F7, TableOffset: 000, Offset: 0000 Physical: Addr:00000001CC519067 PFN:0000001CC519 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
11 Virtual: Addr: 00007FFFDF000000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0F8, TableOffset: 000, Offset: 0000 Physical: Addr:00000001CCC0E067 PFN:0000001CCC0E AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
12 Virtual: Addr: 00007FFFDF200000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0F9, TableOffset: 000, Offset: 0000 Physical: Addr:0000000220078067 PFN:000000220078 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
13 Virtual: Addr: 00007FFFDF400000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0FA, TableOffset: 000, Offset: 0000 Physical: Addr:00000001E950A067 PFN:0000001E950A AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
14 Virtual: Addr: 00007FFFDF600000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0FB, TableOffset: 000, Offset: 0000 Physical: Addr:0000000220705067 PFN:000000220705 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
15 Virtual: Addr: 00007FFFDF800000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0FC, TableOffset: 000, Offset: 0000 Physical: Addr:00000001CC2A3067 PFN:0000001CC2A3 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
16 Virtual: Addr: 00007FFFDFA00000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0FD, TableOffset: 000, Offset: 0000 Physical: Addr:0000000055953067 PFN:000000055953 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
17 Virtual: Addr: 00007FFFDFC00000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0FE, TableOffset: 000, Offset: 0000 Physical: Addr:00000001CCA0F067 PFN:0000001CCA0F AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
18 Virtual: Addr: 00007FFFDFE00000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0FF, TableOffset: 000, Offset: 0000 Physical: Addr:000000016A0E2067 PFN:00000016A0E2 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
19 Virtual: Addr: 00007FFFFFE00000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:1FF, TableOffset: 000, Offset: 0000 Physical: Addr:00000001CC6F0067 PFN:0000001CC6F0 AO:067 WS:0000 NX:- W:- UN:- COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
select a range to dump (enter for all, minus '-' go up a level):0
0 Virtual: Addr: 00007FFFDDBEA000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0ED, TableOffset: 1EA, Offset: 0000 Physical: Addr:8000000091AC5467 PFN:000000091AC5 AO:467 WS:0000 NX:+ W:- UN:+ COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
1 Virtual: Addr: 00007FFFDDBEB000, PML4E 0FF, DirectoryPointerOffset:1FF, DirectoryOffset:0ED, TableOffset: 1EB, Offset: 0000 Physical: Addr:8000000046115467 PFN:000000046115 AO:467 WS:0000 NX:+ W:- UN:+ COW:- G:- LP:- D:+ A:+ CD:- WT:- S/O+ D1:+ V:+
select a range to dump (enter for all, minus '-' go up a level):
Writing out data into the same folder as the input
All done, last written file freebsd 64-bit-snapshot1.vmem.7FFFDDBEB000.bin of 3 so far. KeepGoing? ((y)es (n)o) nFailed list 0;