NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x73662000
process_handle:
0xffffffff
|
1
|
0 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
2556
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x01ee0000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
|
1
|
0 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
276447235
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00508644
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
276447235
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00508644
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
2556
region_size:
700002304
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x03470000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
|
1
|
0 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
276447235
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00508644
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
276447235
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00508644
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x759569d5
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x75956426
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x75959c4f
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x73251195
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x72471177
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x73251159
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x7246647a
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x72445cb4
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x7246a712
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2556
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
39999996
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00000000
process_handle:
0xffffffff
|
|
3221225496 |
0
|