NtAllocateVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
region_size:
1376256
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00630000
allocation_type:
8192
(MEM_RESERVE)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00740000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x72741000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x72742000
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
region_size:
786432
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x01f60000
allocation_type:
8192
(MEM_RESERVE)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x01fe0000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x005d2000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x005ec000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00730000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00731000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x005da000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x0060b000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00607000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
544768
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00152000
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00732000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00733000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00734000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00735000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00736000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00605000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00737000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
region_size:
8192
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00738000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00150000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00150000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00150000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00150000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00150000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
April 10, 2021, 8:44 a.m.
process_identifier:
2216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x001d8000
process_handle:
0xffffffff
1
0
0