NtProtectVirtualMemory
|
process_identifier:
2004
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
98304
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x0040b000
process_handle:
0xffffffff
|
1
|
0 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2004
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
53248
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00664000
process_handle:
0xffffffff
|
1
|
0 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2004
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
28672
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x0066a000
process_handle:
0xffffffff
|
1
|
0 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
2004
region_size:
100003840
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x02140000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0xffffffff
|
1
|
0 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2004
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
40960
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00670000
process_handle:
0xffffffff
|
1
|
0 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2004
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
16384
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00676000
process_handle:
0xffffffff
|
1
|
0 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2004
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
49152
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00679000
process_handle:
0xffffffff
|
1
|
0 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2004
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
20480
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00680000
process_handle:
0xffffffff
|
1
|
0 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2004
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
221184
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00684000
process_handle:
0xffffffff
|
1
|
0 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2004
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
184320
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x0068d000
process_handle:
0xffffffff
|
1
|
0 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2004
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
430080
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x005ca000
process_handle:
0xffffffff
|
1
|
0 |
0
|
NtAllocateVirtualMemory
|
process_identifier:
2004
region_size:
454656
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x006f0000
allocation_type:
12288
(MEM_COMMIT|MEM_RESERVE)
process_handle:
0xffffffff
|
1
|
0 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2004
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
196608
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x006b9000
process_handle:
0xffffffff
|
1
|
0 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2004
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
167936
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x006c0000
process_handle:
0xffffffff
|
1
|
0 |
0
|
NtProtectVirtualMemory
|
process_identifier:
2004
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
430080
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x005ca000
process_handle:
0xffffffff
|
1
|
0 |
0
|