NtAllocateVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
region_size:
2031616
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00750000
allocation_type:
8192
(MEM_RESERVE)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00900000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x6fc91000
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x0052a000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
8192
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x6fc92000
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00522000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00532000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00533000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x0056b000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00567000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x0053c000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x008e0000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x008e1000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x008e2000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x008e3000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x008e4000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
region_size:
12288
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x008e5000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtAllocateVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x0053a000
allocation_type:
4096
(MEM_COMMIT)
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f62000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f62000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00eb0000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00eb0000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00eb0000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00eb2000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0
NtProtectVirtualMemory
March 17, 2021, 10:11 a.m.
process_identifier:
2952
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
base_address:
0x00f51000
process_handle:
0xffffffff
1
0
0