| Time & API |
Arguments |
Status |
Return |
Repeated |
1620841572.784875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
1703936
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
8192
(MEM_RESERVE)
base_address:
0x00630000
|
success
|
0 |
0
|
1620841572.784875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x00790000
|
success
|
0 |
0
|
1620841573.659875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
851968
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
8192
(MEM_RESERVE)
base_address:
0x00630000
|
success
|
0 |
0
|
1620841573.659875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x006c0000
|
success
|
0 |
0
|
1620841573.690875
NtProtectVirtualMemory
|
process_identifier:
2900
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
base_address:
0x73b91000
|
success
|
0 |
0
|
1620841573.799875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
393216
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
8192
(MEM_RESERVE)
base_address:
0x00630000
|
success
|
0 |
0
|
1620841573.799875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x00650000
|
success
|
0 |
0
|
1620841573.815875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x0044a000
|
success
|
0 |
0
|
1620841573.815875
NtProtectVirtualMemory
|
process_identifier:
2900
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
8192
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
base_address:
0x73b92000
|
success
|
0 |
0
|
1620841573.815875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x00442000
|
success
|
0 |
0
|
1620841574.049875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x00552000
|
success
|
0 |
0
|
1620841574.159875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x00575000
|
success
|
0 |
0
|
1620841574.159875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x0057b000
|
success
|
0 |
0
|
1620841574.159875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x00577000
|
success
|
0 |
0
|
1620841574.315875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x00553000
|
success
|
0 |
0
|
1620841574.377875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x0055c000
|
success
|
0 |
0
|
1620841574.487875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x00700000
|
success
|
0 |
0
|
1620841574.877875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x00554000
|
success
|
0 |
0
|
1620841575.065875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x00555000
|
success
|
0 |
0
|
1620841575.065875
NtProtectVirtualMemory
|
process_identifier:
2900
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
base_address:
0x00e50000
|
success
|
0 |
0
|
1620841575.065875
NtProtectVirtualMemory
|
process_identifier:
2900
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
base_address:
0x00e50000
|
success
|
0 |
0
|
1620841575.065875
NtProtectVirtualMemory
|
process_identifier:
2900
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
base_address:
0x00e50000
|
success
|
0 |
0
|
1620841575.065875
NtProtectVirtualMemory
|
process_identifier:
2900
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
base_address:
0x00e50000
|
success
|
0 |
0
|
1620841575.065875
NtProtectVirtualMemory
|
process_identifier:
2900
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
base_address:
0x00e50000
|
success
|
0 |
0
|
1620841575.065875
NtProtectVirtualMemory
|
process_identifier:
2900
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
base_address:
0x00e50000
|
success
|
0 |
0
|
1620841575.065875
NtProtectVirtualMemory
|
process_identifier:
2900
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
base_address:
0x00e50000
|
success
|
0 |
0
|
1620841575.065875
NtProtectVirtualMemory
|
process_identifier:
2900
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
base_address:
0x00e50000
|
success
|
0 |
0
|
1620841575.065875
NtProtectVirtualMemory
|
process_identifier:
2900
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
base_address:
0x00e50000
|
success
|
0 |
0
|
1620841575.065875
NtProtectVirtualMemory
|
process_identifier:
2900
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
base_address:
0x00e50000
|
success
|
0 |
0
|
1620841575.065875
NtProtectVirtualMemory
|
process_identifier:
2900
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
base_address:
0x00e50000
|
success
|
0 |
0
|
1620841575.065875
NtProtectVirtualMemory
|
process_identifier:
2900
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
base_address:
0x00e50000
|
success
|
0 |
0
|
1620841575.065875
NtProtectVirtualMemory
|
process_identifier:
2900
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
base_address:
0x00e50000
|
success
|
0 |
0
|
1620841575.065875
NtProtectVirtualMemory
|
process_identifier:
2900
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
base_address:
0x00e50000
|
success
|
0 |
0
|
1620841575.065875
NtProtectVirtualMemory
|
process_identifier:
2900
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
base_address:
0x00e50000
|
success
|
0 |
0
|
1620841575.065875
NtProtectVirtualMemory
|
process_identifier:
2900
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
base_address:
0x00e50000
|
success
|
0 |
0
|
1620841575.065875
NtProtectVirtualMemory
|
process_identifier:
2900
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
base_address:
0x00e50000
|
success
|
0 |
0
|
1620841575.065875
NtProtectVirtualMemory
|
process_identifier:
2900
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
0
length:
4096
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
base_address:
0x00e50000
|
success
|
0 |
0
|
1620841575.065875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x00701000
|
success
|
0 |
0
|
1620841575.143875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x00702000
|
success
|
0 |
0
|
1620841575.721875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x00556000
|
success
|
0 |
0
|
1620841575.721875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
8192
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x00557000
|
success
|
0 |
0
|
1620841575.909875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x00559000
|
success
|
0 |
0
|
1620841575.909875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x00740000
|
success
|
0 |
0
|
1620841576.002875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x00703000
|
success
|
0 |
0
|
1620841576.002875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x00741000
|
success
|
0 |
0
|
1620841576.049875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x00704000
|
success
|
0 |
0
|
1620841576.112875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x00705000
|
success
|
0 |
0
|
1620841576.112875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x00742000
|
success
|
0 |
0
|
1620841576.127875
NtAllocateVirtualMemory
|
process_identifier:
2900
region_size:
4096
stack_dep_bypass:
0
stack_pivoted:
0
heap_dep_bypass:
1
protection:
64
(PAGE_EXECUTE_READWRITE)
process_handle:
0xffffffff
allocation_type:
4096
(MEM_COMMIT)
base_address:
0x00566000
|
success
|
0 |
0
|