| Time & API |
Arguments |
Status |
Return |
Repeated |
1620976825.95902
NtOpenProcess
|
desired_access:
0x00001010
()
process_identifier:
536
process_handle:
0x000000000000014c
|
success
|
0 |
0
|
1620976825.95902
ReadProcessMemory
|
buffer:
ÿÿÿÿÿÿÿÿ ¹ÿ @&Èw
base_address:
0x000007fffffd9000
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.97402
ReadProcessMemory
|
buffer:
X 0%1 à@9 @%1 ð@9 @&1 A9
base_address:
0x0000000077c82640
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.97402
ReadProcessMemory
|
buffer:
&1 P&Èw 0&1 `&Èw ¹ÿ P¹ÿ À : < ¤#1 Ì#1
base_address:
0x0000000000312530
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.97402
ReadProcessMemory
|
buffer:
l s a s s . e x e
base_address:
0x00000000003123cc
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.97402
ReadProcessMemory
|
buffer:
MZ ÿÿ ¸ @ ð
base_address:
0x00000000ffb90000
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.97402
ReadProcessMemory
|
buffer:
PE d UÁ[J ð "
base_address:
0x00000000ffb900f0
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.97402
ReadProcessMemory
|
buffer:
PE d UÁ[J ð " ( R P ¹ÿ À ÜQ @ À j k lj @ ä ° Ô `6 8 è l @ X
base_address:
0x00000000ffb900f0
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.97402
ReadProcessMemory
|
buffer:
)1 0%1 °)1 @%1 0+1 p&Èw µw : < $1 øSÆw
base_address:
0x0000000000312620
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.97402
ReadProcessMemory
|
buffer:
n t d l l . d l l
base_address:
0x0000000077c653f8
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.97402
ReadProcessMemory
|
buffer:
MZ ÿÿ ¸ @ à
base_address:
0x0000000077b50000
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.97402
ReadProcessMemory
|
buffer:
PE d ùÈçL ð "
base_address:
0x0000000077b500e0
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.97402
ReadProcessMemory
|
buffer:
PE d ùÈçL ð " D
µw êU @ pb |ñ Ø` à $/ * `C à 8
base_address:
0x0000000077b500e0
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.99002
ReadProcessMemory
|
buffer:
+1 &1 +1 0&1 81 0+1 £w ^¤w ð @ B P)1 x)1
base_address:
0x00000000003129a0
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.99002
ReadProcessMemory
|
buffer:
k e r n e l 3 2 . d l l
base_address:
0x0000000000312978
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.99002
ReadProcessMemory
|
buffer:
MZ ÿÿ ¸ @ è
base_address:
0x0000000077a30000
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.99002
ReadProcessMemory
|
buffer:
PE d ÇçL ð "
base_address:
0x0000000077a300e8
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.99002
ReadProcessMemory
|
buffer:
PE d ÇçL ð " ¬ ^ £w ð Cz @ <
@« Ü ô ` ( À p ¸z \º 8 à À
base_address:
0x0000000077a300e8
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.99002
ReadProcessMemory
|
buffer:
ð71 )1 81 °)1 À)1 @&1 Åýþ à0Åýþ ° D F À*1 è*1
base_address:
0x0000000000312b10
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.99002
ReadProcessMemory
|
buffer:
K E R N E L B A S E . d l l
base_address:
0x0000000000312ae8
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.99002
ReadProcessMemory
|
buffer:
MZ ÿÿ ¸ @ ð
base_address:
0x000007fefdc50000
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.99002
ReadProcessMemory
|
buffer:
PE d ÇçL ð "
base_address:
0x000007fefdc500f0
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.99002
ReadProcessMemory
|
buffer:
PE d ÇçL ð " Ú à0 Åýþ ° @ ج QN ¤S ( 0 @b 8 \ 8 è Ø
base_address:
0x000007fefdc500f0
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.99002
ReadProcessMemory
|
buffer:
:1 +1 0:1 +1 @:1 À)1 Þþþ %Þþþ ð < > 71 È71
base_address:
0x00000000003137f0
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.99002
ReadProcessMemory
|
buffer:
m s v c r t . d l l
base_address:
0x00000000003137c8
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.99002
ReadProcessMemory
|
buffer:
MZ ÿÿ ¸ @ è
base_address:
0x000007fefede0000
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.99002
ReadProcessMemory
|
buffer:
PE d ¾ß[J ð "
base_address:
0x000007fefede00e8
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.99002
ReadProcessMemory
|
buffer:
PE d ¾ß[J ð " , % Þþþ ð 2F
@ Ô³ ñj D¯ Ì Ð ð p \ à ¼ ¸ 8 à È
base_address:
0x000007fefede00e8
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.99002
ReadProcessMemory
|
buffer:
0?1 ð71 @?1 81 P?1 81 ðýþ Píôýþ Ð < > þ Ð91 ø91
base_address:
0x0000000000313a20
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.99002
ReadProcessMemory
|
buffer:
R P C R T 4 . d l l
base_address:
0x00000000003139f8
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.99002
ReadProcessMemory
|
buffer:
MZ ÿÿ ¸ @ ð
base_address:
0x000007fefdf00000
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.99002
ReadProcessMemory
|
buffer:
PE d nÉçL ð "
base_address:
0x000007fefdf000f0
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976825.99002
ReadProcessMemory
|
buffer:
PE d nÉçL ð " Pí ðýþ Ð O÷ @ ®E ¦ Ì p P< HV °
8 8 Ü 0 Ð À
base_address:
0x000007fefdf000f0
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976826.00602
ReadProcessMemory
|
buffer:
3 :1 3 0:1 3 @:1 ýþ ýþ ° > @ þ à>1 ?1
base_address:
0x0000000000313f30
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976826.00602
ReadProcessMemory
|
buffer:
S s p i S r v . d l l
base_address:
0x0000000000313f08
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976826.00602
ReadProcessMemory
|
buffer:
MZ ÿÿ ¸ @ ð
base_address:
0x000007fefd8d0000
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976826.00602
ReadProcessMemory
|
buffer:
PE d ðÉçL ð "
base_address:
0x000007fefd8d00f0
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976826.00602
ReadProcessMemory
|
buffer:
PE d ðÉçL ð " L ýþ ° . @ ÈY p 8Z ´ ´ / 8 è 4 0 H
base_address:
0x000007fefd8d00f0
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976826.00602
ReadProcessMemory
|
buffer:
ð3 0?1 3 @?1 À3 ¾3 sýþ äHsýþ p < > ÿ °3 Ø3
base_address:
0x0000000000339900
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976826.00602
ReadProcessMemory
|
buffer:
l s a s r v . d l l
base_address:
0x00000000003398d8
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976826.00602
ReadProcessMemory
|
buffer:
MZ ÿÿ ¸ @ è
base_address:
0x000007fefd730000
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976826.02102
ReadProcessMemory
|
buffer:
PE d )ÇçL ð "
base_address:
0x000007fefd7300e8
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976826.02102
ReadProcessMemory
|
buffer:
PE d )ÇçL ð " Z Ö äH sýþ p TÍ @ @
¯ _ T ð ¸O 0 ± @ à øg 8 à Ü p @ ÜD À
base_address:
0x000007fefd7300e8
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976826.02102
ReadProcessMemory
|
buffer:
Ð3 3 à3 3 ð3 P?1 >ÿþ è`>ÿþ ð > @ `3 3
base_address:
0x00000000003399f0
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976826.02102
ReadProcessMemory
|
buffer:
s e c h o s t . d l l
base_address:
0x0000000000339888
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976826.02102
ReadProcessMemory
|
buffer:
MZ ÿÿ ¸ @ è
base_address:
0x000007feff3e0000
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976826.02102
ReadProcessMemory
|
buffer:
PE d ^à[J ð "
base_address:
0x000007feff3e00e8
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976826.02102
ReadProcessMemory
|
buffer:
PE d ^à[J ð " > è` >ÿþ ð :´ @ À Ë r @ Ð À h à ¤ p ¸ p h r @
base_address:
0x000007feff3e00e8
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976826.02102
ReadProcessMemory
|
buffer:
à3 ð3 ð3 3 3 3 ýþ Xýþ P > @ þ 3 ¨3
base_address:
0x00000000003396d0
process_handle:
0x000000000000014c
|
success
|
1 |
0
|
1620976826.02102
ReadProcessMemory
|
buffer:
S s p i C l i . d l l
base_address:
0x00000000003396a8
process_handle:
0x000000000000014c
|
success
|
1 |
0
|