Find all pages with injected code
Usage
python vol.py -f
Tested Operating Systems Windows 10x64 14393 Windows 10x64 15063 Windows 10x64 16299 Windows 10x64 17134 Windows 10x64 17763 Windows 10x64 18362 Windows 10x64 19041
Output Example
Analysing PID: 2096 - Calculator.exe
Getting user address space pages PID: 2096 - Calculator.exe
Getting user address space pages with execute protection PID: 2096 - Calculator.exe
Getting VADs PID: 2096 - Calculator.exe
Calculating hashs of mapped file pages in memory PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\rpcrt4.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\Windows.UI.Xaml.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\ole32.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\WinTypes.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\dxgi.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\shlwapi.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\msctf.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\user32.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\uxtheme.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\bcrypt.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\Windows.UI.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\SHCore.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\Windows.UI.Xaml.Resources.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\KernelBase.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\dwmapi.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\d2d1.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\msasn1.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\OneCoreUAPCommonProxyStub.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\rometadata.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\TextInputFramework.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\msvcp_win.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\imm32.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\rmclient.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\msvcp140_app.dll PID: 2096 - Calculator.exe Warning - Disk file C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\msvcp140_app.dll not found
Calculating disk hashs at C:\Windows\System32\dcomp.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\cryptbase.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\msvcrt.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\Windows.Globalization.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\WinMetadata\Windows.UI.Xaml.winmd PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\CoreUIComponents.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\directmanipulation.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\BCP47Langs.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\Windows.Graphics.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\DWrite.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\Windows.UI.Xaml.Maps.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\bcryptprimitives.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\kernel.appcore.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\gdi32.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\ucrtbase.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\CoreMessaging.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\ntdll.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\advapi32.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\Windows.Storage.ApplicationData.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\vm3dum64_10.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\version.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\cfgmgr32.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\twinapi.appcore.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\sechost.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\Windows.ApplicationModel.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\Windows.UI.Immersive.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\vccorlib140_app.dll PID: 2096 - Calculator.exe Warning - Disk file C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\vccorlib140_app.dll not found
Calculating disk hashs at C:\Windows\System32\Windows.UI.Xaml.Phone.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\vcruntime140_1_app.dll PID: 2096 - Calculator.exe Warning - Disk file C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\vcruntime140_1_app.dll not found
Calculating disk hashs at C:\Windows\System32\combase.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\concrt140_app.dll PID: 2096 - Calculator.exe Warning - Disk file C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\concrt140_app.dll not found
Calculating disk hashs at C:\Windows\System32\powrprof.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\Windows.UI.Core.TextInput.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1705.21204.0_x64__8wekyb3d8bbwe\Calculator.exe PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\DataExchange.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\iertutil.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\windows.storage.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\gdi32full.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\oleaut32.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\shell32.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\Windows.UI.Xaml.InkControls.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\apphelp.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\threadpoolwinrt.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\crypt32.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\vcruntime140_app.dll PID: 2096 - Calculator.exe Warning - Disk file C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\vcruntime140_app.dll not found
Calculating disk hashs at C:\Windows\System32\win32u.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\actxprxy.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\profapi.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\kernel32.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\winmm.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\vm3dum64_loader.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\winmmbase.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\MrmCoreR.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\logoncli.dll PID: 2096 - Calculator.exe
Calculating disk hashs at C:\Windows\System32\d3d11.dll PID: 2096 - Calculator.exe
Getting unmapped file pages PID: 2096 - Calculator.exe Analysing PID: 2096 - Calculator.exe Found suspicious mapped file page(s) at 0x7ff91f6b1000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6b2000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6b3000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6b4000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6b5000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6b6000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6b7000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6b8000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6b9000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6ba000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6bb000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6bf000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6c0000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6c1000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6c2000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6c3000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6c4000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6c5000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6c6000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6c7000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6c8000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6c9000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6d3000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6d5000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6d6000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6dd000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6df000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6e6000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6e7000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6e9000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6ea000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6eb000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6f0000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6f1000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6f2000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f6f6000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f701000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff91f702000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\msvcp140_app.dll Found suspicious mapped file page(s) at 0x7ff9239b1000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\vccorlib140_app.dll Found suspicious mapped file page(s) at 0x7ff9239b4000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\vccorlib140_app.dll Found suspicious mapped file page(s) at 0x7ff9239b5000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\vccorlib140_app.dll Found suspicious mapped file page(s) at 0x7ff9239b6000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\vccorlib140_app.dll Found suspicious mapped file page(s) at 0x7ff9239bd000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\vccorlib140_app.dll Found suspicious mapped file page(s) at 0x7ff9239be000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\vccorlib140_app.dll Found suspicious mapped file page(s) at 0x7ff9239c4000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\vccorlib140_app.dll Found suspicious mapped file page(s) at 0x7ff9239c7000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\vccorlib140_app.dll Found suspicious mapped file page(s) at 0x7ff9239c8000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\vccorlib140_app.dll Found suspicious mapped file page(s) at 0x7ff9239c9000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\vccorlib140_app.dll Found suspicious mapped file page(s) at 0x7ff9239cb000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\vccorlib140_app.dll Found suspicious mapped file page(s) at 0x7ff9239cc000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\vccorlib140_app.dll Found suspicious mapped file page(s) at 0x7ff9239cd000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\vccorlib140_app.dll Found suspicious mapped file page(s) at 0x7ff9239ce000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\vccorlib140_app.dll Found suspicious mapped file page(s) at 0x7ff9239d3000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\vccorlib140_app.dll Found suspicious mapped file page(s) at 0x7ff9239d4000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\vccorlib140_app.dll Found suspicious mapped file page(s) at 0x7ff9239d5000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\vccorlib140_app.dll Found suspicious mapped file page(s) at 0x7ff9239d6000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\vccorlib140_app.dll Found suspicious mapped file page(s) at 0x7ff9239d7000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\vccorlib140_app.dll Found suspicious mapped file page(s) at 0x7ff925003000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\vcruntime140_1_app.dll Found suspicious mapped file page(s) at 0x7ff925004000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\vcruntime140_1_app.dll Found suspicious mapped file page(s) at 0x7ff91f4e1000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f4e7000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f4e8000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f4e9000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f4eb000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f4ec000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f4ed000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f4f0000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f4f1000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f4f2000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f4f3000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f4f4000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f4f5000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f4f6000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f4f7000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f4f8000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f4f9000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f4fa000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f4fb000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f4fc000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f4fd000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f4fe000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f4ff000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f500000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f501000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f505000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f506000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f507000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f508000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff91f509000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\concrt140_app.dll Found suspicious mapped file page(s) at 0x7ff924f71000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\vcruntime140_app.dll Found suspicious mapped file page(s) at 0x7ff924f72000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\vcruntime140_app.dll Found suspicious mapped file page(s) at 0x7ff924f76000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x648wekyb3d8bbwe\vcruntime140_app.dll Found suspicious mapped file page(s) at 0x7ff924f7e000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\vcruntime140_app.dll Found suspicious mapped file page(s) at 0x7ff924f7f000 Path:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.29231.0_x64__8wekyb3d8bbwe\vcruntime140_app.dll