NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2540
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x73921000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2540
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x73261000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2592
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x73921000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2592
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x72e11000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2672
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x73921000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2672
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x73261000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2724
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x73921000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2724
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x72e11000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2768
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x73921000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2768
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x73261000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fef4ee3000
process_handle:
0xffffffffffffffff
1
0
0
NtAllocateVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
region_size:
786432
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x0000000001f80000
allocation_type:
8192
(MEM_RESERVE)
process_handle:
0xffffffffffffffff
1
0
0
NtAllocateVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
region_size:
8192
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x0000000001fc0000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffffffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fef41da000
process_handle:
0xffffffffffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fef3af5000
process_handle:
0xffffffffffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fef3b41000
process_handle:
0xffffffffffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fef41db000
process_handle:
0xffffffffffffffff
1
0
0
NtAllocateVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
region_size:
1638400
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x0000000002040000
allocation_type:
8192
(MEM_RESERVE)
process_handle:
0xffffffffffffffff
1
0
0
NtAllocateVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
region_size:
8192
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x0000000002150000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffffffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fef3b42000
process_handle:
0xffffffffffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fef3b42000
process_handle:
0xffffffffffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fef3b42000
process_handle:
0xffffffffffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fef3b42000
process_handle:
0xffffffffffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fef3b42000
process_handle:
0xffffffffffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fef3b42000
process_handle:
0xffffffffffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fef3b42000
process_handle:
0xffffffffffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fef3b42000
process_handle:
0xffffffffffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fef3b42000
process_handle:
0xffffffffffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fef3b42000
process_handle:
0xffffffffffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fef3b42000
process_handle:
0xffffffffffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fef3b44000
process_handle:
0xffffffffffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fef3b44000
process_handle:
0xffffffffffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fef3b44000
process_handle:
0xffffffffffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fef3b44000
process_handle:
0xffffffffffffffff
1
0
0
NtAllocateVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
region_size:
655360
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fffff10000
allocation_type:
1056768
(MEM_RESERVE|MEM_TOP_DOWN)
process_handle:
0xffffffffffffffff
1
0
0
NtAllocateVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fffff10000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffffffffffff
1
0
0
NtAllocateVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fffff10000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffffffffffff
1
0
0
NtAllocateVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fffff20000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffffffffffff
1
0
0
NtAllocateVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
region_size:
65536
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fffff00000
allocation_type:
1056768
(MEM_RESERVE|MEM_TOP_DOWN)
process_handle:
0xffffffffffffffff
1
0
0
NtAllocateVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fffff00000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffffffffffff
1
0
0
NtAllocateVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fe943aa000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffffffffffff
1
0
0
NtAllocateVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fe9445c000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffffffffffff
1
0
0
NtAllocateVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fe94486000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffffffffffff
1
0
0
NtAllocateVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fe94460000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffffffffffff
1
0
0
NtAllocateVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fe943bc000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffffffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fef2486000
process_handle:
0xffffffffffffffff
1
0
0
NtProtectVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fefeffd000
process_handle:
0xffffffffffffffff
1
0
0
NtAllocateVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fe944d0000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffffffffffff
1
0
0
NtAllocateVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fe944d1000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffffffffffff
1
0
0
NtAllocateVirtualMemory
Aug. 31, 2023, 7:49 a.m.
process_identifier:
2812
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x000007fe943cb000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffffffffffff
1
0
0