{ "analysis_details": { "creation_time": "2017-12-11 17:42 (UTC+1)", "execution_successful": true, "number_of_processes": 18, "reputation_enabled": true, "termination_reason": "timeout", "type": "analysis_details", "version": 2, "vm_analysis_duration_time": "00:02:23" }, "artifacts": { "files": [ { "filename": "STD_OUTPUT_HANDLE", "hashes": [], "norm_filename": "std_output_handle", "operations": [ "access", "write", "read" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\Desktop\\2999BA~1.WSF", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\desktop\\2999ba~1.wsf", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\84526935.scr", "hashes": [ { "md5_hash": "f549977bce0051085abbe8d7728be589", "sha1_hash": "33e0317a4da4cc10737f5ff54f010315a3b71867", "sha256_hash": "21610f6f3397058086f90d9e0f74ba524aeb69d788efca24f344327460532a58", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\84526935.scr", "operations": [ "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "STD_INPUT_HANDLE", "hashes": [], "norm_filename": "std_input_handle", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "STD_ERROR_HANDLE", "hashes": [], "norm_filename": "std_error_handle", "operations": [ "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Temp\\84526935.scr", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\temp\\84526935.scr", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F2D7.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "ab28e0b612bc4ddf226676cd532c962d", "sha1_hash": "b59526005703af82972679d96fc346768b4bfae8", "sha256_hash": "60e9853af737363ea6439bee3a65a6683c9afdf1a87425e2e03c4b247e16534f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f2d7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F2D8.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "ab28e0b612bc4ddf226676cd532c962d", "sha1_hash": "b59526005703af82972679d96fc346768b4bfae8", "sha256_hash": "60e9853af737363ea6439bee3a65a6683c9afdf1a87425e2e03c4b247e16534f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f2d8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F2E8.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "fd530f884ded068a1e9bd0ac2a1e36d8", "sha1_hash": "4ccc4866976f7ec567851d7c90015a60fd7ccf2a", "sha256_hash": "db674604dc1fe9df020558e69b3038c738c697231903aa596700ac18070ffe85", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f2e8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F2F9.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "df400c07cdf87dea697f5313673f45da", "sha1_hash": "78a9aa849ec7e4dc62c0a1f49454d93c45aabfca", "sha256_hash": "da0800d82ed1c8d9d3a55ac2db30f1f9e27fdace3eb20f90926fcfbadc5a26f8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f2f9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F2FA.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "4721c4ad3b7ab96da65f5567ea559b3c", "sha1_hash": "54af4a938d39230c512a88002c59cb74f0bc0d07", "sha256_hash": "4240d971d7c5c08a44a34da39e4e65e50322fa79dfcc7c1904395409116280b7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f2fa.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F2FB.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "a8a2dadf629bfbc4b37e71549b0305f3", "sha1_hash": "a277c6508628e442c5d51332f94b533596097639", "sha256_hash": "39e93984d5cd1d066156fd8694cede26f9c1cf87a1bcd93412a4adea1d435933", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f2fb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F2FC.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "a8a2dadf629bfbc4b37e71549b0305f3", "sha1_hash": "a277c6508628e442c5d51332f94b533596097639", "sha256_hash": "39e93984d5cd1d066156fd8694cede26f9c1cf87a1bcd93412a4adea1d435933", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f2fc.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F32C.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "cf7f81d4b988308d3cd856a6b41bbc56", "sha1_hash": "7027b22c141ed485279594918c8593af5e251aba", "sha256_hash": "b05fdcc590001a2ba4dc7ac6c86157b0f33767ca499f98e60d711e86c4351a7a", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f32c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F33C.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "37b7354ecaa8543098eb12c981ad4402", "sha1_hash": "4d7147388a576aeb70d0f8afb28cfc8461aca2af", "sha256_hash": "4509324384f471a0043d8adb1b060297bbf35c6ced8275ed4c667bc78e21bb2c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f33c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F33D.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "37b7354ecaa8543098eb12c981ad4402", "sha1_hash": "4d7147388a576aeb70d0f8afb28cfc8461aca2af", "sha256_hash": "4509324384f471a0043d8adb1b060297bbf35c6ced8275ed4c667bc78e21bb2c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f33d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F33E.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "37b7354ecaa8543098eb12c981ad4402", "sha1_hash": "4d7147388a576aeb70d0f8afb28cfc8461aca2af", "sha256_hash": "4509324384f471a0043d8adb1b060297bbf35c6ced8275ed4c667bc78e21bb2c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f33e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F33F.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "37b7354ecaa8543098eb12c981ad4402", "sha1_hash": "4d7147388a576aeb70d0f8afb28cfc8461aca2af", "sha256_hash": "4509324384f471a0043d8adb1b060297bbf35c6ced8275ed4c667bc78e21bb2c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f33f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F350.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "6563b28cb7911859a2569c553f469639", "sha1_hash": "11ccbfeeeb88c1587a72cd8875ed8600a511aeec", "sha256_hash": "9c91d18494f82e9c8ec624330f428cfb6866396caff0b7ff09ed31f91be429f8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f350.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F351.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "6563b28cb7911859a2569c553f469639", "sha1_hash": "11ccbfeeeb88c1587a72cd8875ed8600a511aeec", "sha256_hash": "9c91d18494f82e9c8ec624330f428cfb6866396caff0b7ff09ed31f91be429f8", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f351.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F381.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "103e0b8fd12bb07ef8961566a7765a55", "sha1_hash": "f84633d25ea9b41c542644c0a381cb8457721ca2", "sha256_hash": "b249383eaadc3cac29adbbd2b933929ed5d6054e781c28770961aecbc70d7974", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f381.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F382.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "103e0b8fd12bb07ef8961566a7765a55", "sha1_hash": "f84633d25ea9b41c542644c0a381cb8457721ca2", "sha256_hash": "b249383eaadc3cac29adbbd2b933929ed5d6054e781c28770961aecbc70d7974", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f382.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F383.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "103e0b8fd12bb07ef8961566a7765a55", "sha1_hash": "f84633d25ea9b41c542644c0a381cb8457721ca2", "sha256_hash": "b249383eaadc3cac29adbbd2b933929ed5d6054e781c28770961aecbc70d7974", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f383.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F384.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "103e0b8fd12bb07ef8961566a7765a55", "sha1_hash": "f84633d25ea9b41c542644c0a381cb8457721ca2", "sha256_hash": "b249383eaadc3cac29adbbd2b933929ed5d6054e781c28770961aecbc70d7974", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f384.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F385.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "103e0b8fd12bb07ef8961566a7765a55", "sha1_hash": "f84633d25ea9b41c542644c0a381cb8457721ca2", "sha256_hash": "b249383eaadc3cac29adbbd2b933929ed5d6054e781c28770961aecbc70d7974", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f385.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F396.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "375354fe68646f0128f6ab29e48869bd", "sha1_hash": "041bcbffc817e9e86000ae0c3c77281280719268", "sha256_hash": "5d393fd606d3ae2b4153699180cef6ad3c3f5aebe6cf05c43c109f7634949670", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f396.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F397.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "375354fe68646f0128f6ab29e48869bd", "sha1_hash": "041bcbffc817e9e86000ae0c3c77281280719268", "sha256_hash": "5d393fd606d3ae2b4153699180cef6ad3c3f5aebe6cf05c43c109f7634949670", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f397.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F398.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "375354fe68646f0128f6ab29e48869bd", "sha1_hash": "041bcbffc817e9e86000ae0c3c77281280719268", "sha256_hash": "5d393fd606d3ae2b4153699180cef6ad3c3f5aebe6cf05c43c109f7634949670", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f398.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F399.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "375354fe68646f0128f6ab29e48869bd", "sha1_hash": "041bcbffc817e9e86000ae0c3c77281280719268", "sha256_hash": "5d393fd606d3ae2b4153699180cef6ad3c3f5aebe6cf05c43c109f7634949670", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f399.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F39A.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "375354fe68646f0128f6ab29e48869bd", "sha1_hash": "041bcbffc817e9e86000ae0c3c77281280719268", "sha256_hash": "5d393fd606d3ae2b4153699180cef6ad3c3f5aebe6cf05c43c109f7634949670", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f39a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F3D9.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "9914902ffd73d3d52944d5f02c990052", "sha1_hash": "f1ba32861024ce89f2616150c71bd25a0be1097a", "sha256_hash": "438e2d2f7eed159de5d7d589ba5188e73b43c5f47aa6d561169346ae1e3d1c05", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f3d9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F3DA.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "9914902ffd73d3d52944d5f02c990052", "sha1_hash": "f1ba32861024ce89f2616150c71bd25a0be1097a", "sha256_hash": "438e2d2f7eed159de5d7d589ba5188e73b43c5f47aa6d561169346ae1e3d1c05", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f3da.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F3EB.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "2841502da02a6dc1929c6b679d2d952b", "sha1_hash": "e9542f012dcc2786e80130fd539129b7f7d6d553", "sha256_hash": "7faae97a81dfe6e3a19ab568d3c36e4b68df217f4c7f21ea4bc13c1e33b8e92c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f3eb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F3EC.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "2841502da02a6dc1929c6b679d2d952b", "sha1_hash": "e9542f012dcc2786e80130fd539129b7f7d6d553", "sha256_hash": "7faae97a81dfe6e3a19ab568d3c36e4b68df217f4c7f21ea4bc13c1e33b8e92c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f3ec.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F3ED.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "2841502da02a6dc1929c6b679d2d952b", "sha1_hash": "e9542f012dcc2786e80130fd539129b7f7d6d553", "sha256_hash": "7faae97a81dfe6e3a19ab568d3c36e4b68df217f4c7f21ea4bc13c1e33b8e92c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f3ed.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F3FD.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "14f8d6416125ae53432caacf7f85edcf", "sha1_hash": "cb0dc4b48c5703356951c02485ad6fcea8f6bc96", "sha256_hash": "22924b1e57cb5405ae74e97b9d7b20c90b31c6111067035a1072de62688e230e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f3fd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F41E.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "aa75d8a30aacd8184640a5bc63dd8add", "sha1_hash": "158000124dbae9ab0a834a306a1f2e52ead8cedd", "sha256_hash": "c20f0cc73e42057066194ead502dee19fe7b65238890cc6ea3eca658d96ea018", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f41e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F42E.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "684c21c6a46af124447bdb10f9c4de69", "sha1_hash": "ebeb1642dad077201aab5cd2566c8f34b0a3b604", "sha256_hash": "a7c626455caeb41a1a6db61c703e08eb645ad45d2d84587ed95e25a1dccf756d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f42e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F42F.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "684c21c6a46af124447bdb10f9c4de69", "sha1_hash": "ebeb1642dad077201aab5cd2566c8f34b0a3b604", "sha256_hash": "a7c626455caeb41a1a6db61c703e08eb645ad45d2d84587ed95e25a1dccf756d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f42f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F430.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "684c21c6a46af124447bdb10f9c4de69", "sha1_hash": "ebeb1642dad077201aab5cd2566c8f34b0a3b604", "sha256_hash": "a7c626455caeb41a1a6db61c703e08eb645ad45d2d84587ed95e25a1dccf756d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f430.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F441.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "18ccd98a45f94ad63b8f2751d5c64f47", "sha1_hash": "39cce3420bf79b006df70fad5bd4bd25a4ed2354", "sha256_hash": "2a020923b05677c27a82d2e6b8a3e4385827616724b78702394d76b0a03a3841", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f441.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F442.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "18ccd98a45f94ad63b8f2751d5c64f47", "sha1_hash": "39cce3420bf79b006df70fad5bd4bd25a4ed2354", "sha256_hash": "2a020923b05677c27a82d2e6b8a3e4385827616724b78702394d76b0a03a3841", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f442.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F472.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "0fe5a713f286f220c91a08b30542ae0f", "sha1_hash": "452bdea5a923e770304174c86876749ad68736e5", "sha256_hash": "8123adf3394eb1db518c72de323441ab548b3ab30b9d3844102c1723c94d2f83", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f472.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F473.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "0fe5a713f286f220c91a08b30542ae0f", "sha1_hash": "452bdea5a923e770304174c86876749ad68736e5", "sha256_hash": "8123adf3394eb1db518c72de323441ab548b3ab30b9d3844102c1723c94d2f83", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f473.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F474.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "0fe5a713f286f220c91a08b30542ae0f", "sha1_hash": "452bdea5a923e770304174c86876749ad68736e5", "sha256_hash": "8123adf3394eb1db518c72de323441ab548b3ab30b9d3844102c1723c94d2f83", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f474.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F475.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "0fe5a713f286f220c91a08b30542ae0f", "sha1_hash": "452bdea5a923e770304174c86876749ad68736e5", "sha256_hash": "8123adf3394eb1db518c72de323441ab548b3ab30b9d3844102c1723c94d2f83", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f475.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F485.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "e102f4f45076f59380e7c6d844d55c39", "sha1_hash": "3ac8c45455eaec9ee64251ecece9f70481af4b21", "sha256_hash": "7822a8a931d8d38d67968a64e969ab18e9369a8d0b3fadbfd0018add463b0dd9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f485.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F486.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "e102f4f45076f59380e7c6d844d55c39", "sha1_hash": "3ac8c45455eaec9ee64251ecece9f70481af4b21", "sha256_hash": "7822a8a931d8d38d67968a64e969ab18e9369a8d0b3fadbfd0018add463b0dd9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f486.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F487.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "e102f4f45076f59380e7c6d844d55c39", "sha1_hash": "3ac8c45455eaec9ee64251ecece9f70481af4b21", "sha256_hash": "7822a8a931d8d38d67968a64e969ab18e9369a8d0b3fadbfd0018add463b0dd9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f487.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F488.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "e102f4f45076f59380e7c6d844d55c39", "sha1_hash": "3ac8c45455eaec9ee64251ecece9f70481af4b21", "sha256_hash": "7822a8a931d8d38d67968a64e969ab18e9369a8d0b3fadbfd0018add463b0dd9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f488.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F499.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "9884e4f00c2714eeebf230e5b40e9480", "sha1_hash": "be8269c4c4929b4f35d057725d122d17805716b9", "sha256_hash": "f42fda1c199b447e1d1e4008eb7897c4ca4ecf3a2f7fdea829b9c35e6e044458", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f499.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F4B9.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "b9fbcebb04b9f7e4d3f07b023a0229fd", "sha1_hash": "f2173b4759317545d5f81a88982aa637099de5b6", "sha256_hash": "359c38c6582afda6a9913c1f4870e5e35e47a1f8d6959dea71abb2b94b094476", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4b9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F4BA.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "b9fbcebb04b9f7e4d3f07b023a0229fd", "sha1_hash": "f2173b4759317545d5f81a88982aa637099de5b6", "sha256_hash": "359c38c6582afda6a9913c1f4870e5e35e47a1f8d6959dea71abb2b94b094476", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4ba.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F4BB.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "b9fbcebb04b9f7e4d3f07b023a0229fd", "sha1_hash": "f2173b4759317545d5f81a88982aa637099de5b6", "sha256_hash": "359c38c6582afda6a9913c1f4870e5e35e47a1f8d6959dea71abb2b94b094476", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4bb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F4CC.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "b3574d66d7c98d6f82168937555180f2", "sha1_hash": "c7e08e3a085493db3cb9df920890015bda11cc50", "sha256_hash": "8544a403db6bc12357c9d122731239fb5101b1949bdfe09ffe6dbfeebcc73919", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4cc.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F4CD.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "b3574d66d7c98d6f82168937555180f2", "sha1_hash": "c7e08e3a085493db3cb9df920890015bda11cc50", "sha256_hash": "8544a403db6bc12357c9d122731239fb5101b1949bdfe09ffe6dbfeebcc73919", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4cd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F4CE.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "b3574d66d7c98d6f82168937555180f2", "sha1_hash": "c7e08e3a085493db3cb9df920890015bda11cc50", "sha256_hash": "8544a403db6bc12357c9d122731239fb5101b1949bdfe09ffe6dbfeebcc73919", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4ce.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F4CF.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "b3574d66d7c98d6f82168937555180f2", "sha1_hash": "c7e08e3a085493db3cb9df920890015bda11cc50", "sha256_hash": "8544a403db6bc12357c9d122731239fb5101b1949bdfe09ffe6dbfeebcc73919", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4cf.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F4DF.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "426861378070228083370ab1716f5d34", "sha1_hash": "6bdb6c1b524e52bc373739e7022ee164a7b63086", "sha256_hash": "c371441da18d02cf86e7de5a784754e94b67f74f69012029901896b081d114d2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4df.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F4E0.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "426861378070228083370ab1716f5d34", "sha1_hash": "6bdb6c1b524e52bc373739e7022ee164a7b63086", "sha256_hash": "c371441da18d02cf86e7de5a784754e94b67f74f69012029901896b081d114d2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4e0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F4F1.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "8c63a5d8e82e6edd83997890130d40c7", "sha1_hash": "cb22abc76e59b8fd55b756731f2942b02a50d765", "sha256_hash": "854926af3596aa48c171f2877729389f90de5d6add7a00334444d67683c510d6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4f1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F4F2.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "8c63a5d8e82e6edd83997890130d40c7", "sha1_hash": "cb22abc76e59b8fd55b756731f2942b02a50d765", "sha256_hash": "854926af3596aa48c171f2877729389f90de5d6add7a00334444d67683c510d6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4f2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F4F3.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "8c63a5d8e82e6edd83997890130d40c7", "sha1_hash": "cb22abc76e59b8fd55b756731f2942b02a50d765", "sha256_hash": "854926af3596aa48c171f2877729389f90de5d6add7a00334444d67683c510d6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4f3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F4F4.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "8c63a5d8e82e6edd83997890130d40c7", "sha1_hash": "cb22abc76e59b8fd55b756731f2942b02a50d765", "sha256_hash": "854926af3596aa48c171f2877729389f90de5d6add7a00334444d67683c510d6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4f4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F4F5.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "8c63a5d8e82e6edd83997890130d40c7", "sha1_hash": "cb22abc76e59b8fd55b756731f2942b02a50d765", "sha256_hash": "854926af3596aa48c171f2877729389f90de5d6add7a00334444d67683c510d6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4f5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F506.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "c753a995dd61c55c0ce9d9d0c996ed8a", "sha1_hash": "3ddcbdc4fe23523efffc6cd03757955809caa83f", "sha256_hash": "d0750b1dbe19dff3d69c999b47a93a5cf6b79c4e776579d6372394b6c22b4226", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f506.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F507.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "c753a995dd61c55c0ce9d9d0c996ed8a", "sha1_hash": "3ddcbdc4fe23523efffc6cd03757955809caa83f", "sha256_hash": "d0750b1dbe19dff3d69c999b47a93a5cf6b79c4e776579d6372394b6c22b4226", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f507.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F508.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "c753a995dd61c55c0ce9d9d0c996ed8a", "sha1_hash": "3ddcbdc4fe23523efffc6cd03757955809caa83f", "sha256_hash": "d0750b1dbe19dff3d69c999b47a93a5cf6b79c4e776579d6372394b6c22b4226", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f508.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F509.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "c753a995dd61c55c0ce9d9d0c996ed8a", "sha1_hash": "3ddcbdc4fe23523efffc6cd03757955809caa83f", "sha256_hash": "d0750b1dbe19dff3d69c999b47a93a5cf6b79c4e776579d6372394b6c22b4226", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f509.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F50A.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "c753a995dd61c55c0ce9d9d0c996ed8a", "sha1_hash": "3ddcbdc4fe23523efffc6cd03757955809caa83f", "sha256_hash": "d0750b1dbe19dff3d69c999b47a93a5cf6b79c4e776579d6372394b6c22b4226", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f50a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F51A.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "a3894421dceb69d0f1ad369951902696", "sha1_hash": "ec9e7a1edd0c96c7522983fc4d03bfe30a7446a5", "sha256_hash": "16d20f692fc19048728ae91e65e8c6e1e260af1e71617b19192047fd64ea981e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f51a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F51B.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "a3894421dceb69d0f1ad369951902696", "sha1_hash": "ec9e7a1edd0c96c7522983fc4d03bfe30a7446a5", "sha256_hash": "16d20f692fc19048728ae91e65e8c6e1e260af1e71617b19192047fd64ea981e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f51b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F51C.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "a3894421dceb69d0f1ad369951902696", "sha1_hash": "ec9e7a1edd0c96c7522983fc4d03bfe30a7446a5", "sha256_hash": "16d20f692fc19048728ae91e65e8c6e1e260af1e71617b19192047fd64ea981e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f51c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F53D.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "7d1c896adc01c20ba38921c393cf3bf5", "sha1_hash": "0a6d1315f79a81a81ff0baebe5a096255566bab0", "sha256_hash": "4655b8389012aa3c527d58ae9ca214ca5ed4cdfbf378bcd6fe1a04b3b53e85ca", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f53d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F53E.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "7d1c896adc01c20ba38921c393cf3bf5", "sha1_hash": "0a6d1315f79a81a81ff0baebe5a096255566bab0", "sha256_hash": "4655b8389012aa3c527d58ae9ca214ca5ed4cdfbf378bcd6fe1a04b3b53e85ca", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f53e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F53F.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "7d1c896adc01c20ba38921c393cf3bf5", "sha1_hash": "0a6d1315f79a81a81ff0baebe5a096255566bab0", "sha256_hash": "4655b8389012aa3c527d58ae9ca214ca5ed4cdfbf378bcd6fe1a04b3b53e85ca", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f53f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F540.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "7d1c896adc01c20ba38921c393cf3bf5", "sha1_hash": "0a6d1315f79a81a81ff0baebe5a096255566bab0", "sha256_hash": "4655b8389012aa3c527d58ae9ca214ca5ed4cdfbf378bcd6fe1a04b3b53e85ca", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f540.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F541.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "7d1c896adc01c20ba38921c393cf3bf5", "sha1_hash": "0a6d1315f79a81a81ff0baebe5a096255566bab0", "sha256_hash": "4655b8389012aa3c527d58ae9ca214ca5ed4cdfbf378bcd6fe1a04b3b53e85ca", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f541.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F551.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "4a0b19c62039f27899009aabbdf4770d", "sha1_hash": "f7cd0536d3e7f06fa69d9d2445911a3048a59c29", "sha256_hash": "7567e47e4a26c271f09bf78392cd1a89f48c9803f8393306761911ebb53f032c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f551.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F552.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "4a0b19c62039f27899009aabbdf4770d", "sha1_hash": "f7cd0536d3e7f06fa69d9d2445911a3048a59c29", "sha256_hash": "7567e47e4a26c271f09bf78392cd1a89f48c9803f8393306761911ebb53f032c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f552.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F553.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "4a0b19c62039f27899009aabbdf4770d", "sha1_hash": "f7cd0536d3e7f06fa69d9d2445911a3048a59c29", "sha256_hash": "7567e47e4a26c271f09bf78392cd1a89f48c9803f8393306761911ebb53f032c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f553.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F554.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "4a0b19c62039f27899009aabbdf4770d", "sha1_hash": "f7cd0536d3e7f06fa69d9d2445911a3048a59c29", "sha256_hash": "7567e47e4a26c271f09bf78392cd1a89f48c9803f8393306761911ebb53f032c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f554.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F565.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "23b161ac199d8c597729dbdb84b9c077", "sha1_hash": "03ecd7fa3b32daf89555f179195c5c4ea2eea2d9", "sha256_hash": "c7624be02d1c2cb148ab1636771aebeb4cbb4eaa771e63c14b6433a1ee5b33c4", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f565.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F566.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "23b161ac199d8c597729dbdb84b9c077", "sha1_hash": "03ecd7fa3b32daf89555f179195c5c4ea2eea2d9", "sha256_hash": "c7624be02d1c2cb148ab1636771aebeb4cbb4eaa771e63c14b6433a1ee5b33c4", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f566.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F567.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "23b161ac199d8c597729dbdb84b9c077", "sha1_hash": "03ecd7fa3b32daf89555f179195c5c4ea2eea2d9", "sha256_hash": "c7624be02d1c2cb148ab1636771aebeb4cbb4eaa771e63c14b6433a1ee5b33c4", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f567.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F568.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "23b161ac199d8c597729dbdb84b9c077", "sha1_hash": "03ecd7fa3b32daf89555f179195c5c4ea2eea2d9", "sha256_hash": "c7624be02d1c2cb148ab1636771aebeb4cbb4eaa771e63c14b6433a1ee5b33c4", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f568.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F569.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "23b161ac199d8c597729dbdb84b9c077", "sha1_hash": "03ecd7fa3b32daf89555f179195c5c4ea2eea2d9", "sha256_hash": "c7624be02d1c2cb148ab1636771aebeb4cbb4eaa771e63c14b6433a1ee5b33c4", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f569.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F579.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "6c2e843da5e5c4585641c3e39a20d0b5", "sha1_hash": "b0310d8410d972e6653160557a61c3740a392da7", "sha256_hash": "f8f41e0bf9b26685f9f49a646407fda564b61f98fbfc46499113ebfaf04ca409", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f579.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F57A.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "6c2e843da5e5c4585641c3e39a20d0b5", "sha1_hash": "b0310d8410d972e6653160557a61c3740a392da7", "sha256_hash": "f8f41e0bf9b26685f9f49a646407fda564b61f98fbfc46499113ebfaf04ca409", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f57a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F57B.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "6c2e843da5e5c4585641c3e39a20d0b5", "sha1_hash": "b0310d8410d972e6653160557a61c3740a392da7", "sha256_hash": "f8f41e0bf9b26685f9f49a646407fda564b61f98fbfc46499113ebfaf04ca409", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f57b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F57C.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "6c2e843da5e5c4585641c3e39a20d0b5", "sha1_hash": "b0310d8410d972e6653160557a61c3740a392da7", "sha256_hash": "f8f41e0bf9b26685f9f49a646407fda564b61f98fbfc46499113ebfaf04ca409", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f57c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F58D.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "82a4d57805e2c28295c1b84376ec3403", "sha1_hash": "9b8b4271cd9764a98008263488ebde8bf9a0e68b", "sha256_hash": "3de59a36c317e7c0fae4c4aec2d5631570bee33aa9253993883c14fb2da50bcf", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f58d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F58E.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "82a4d57805e2c28295c1b84376ec3403", "sha1_hash": "9b8b4271cd9764a98008263488ebde8bf9a0e68b", "sha256_hash": "3de59a36c317e7c0fae4c4aec2d5631570bee33aa9253993883c14fb2da50bcf", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f58e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F58F.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "82a4d57805e2c28295c1b84376ec3403", "sha1_hash": "9b8b4271cd9764a98008263488ebde8bf9a0e68b", "sha256_hash": "3de59a36c317e7c0fae4c4aec2d5631570bee33aa9253993883c14fb2da50bcf", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f58f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F590.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "82a4d57805e2c28295c1b84376ec3403", "sha1_hash": "9b8b4271cd9764a98008263488ebde8bf9a0e68b", "sha256_hash": "3de59a36c317e7c0fae4c4aec2d5631570bee33aa9253993883c14fb2da50bcf", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f590.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F5A1.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "65bd4174941856c5365044693e566c11", "sha1_hash": "03448f68180ca7416d9353e9c8430b8188253396", "sha256_hash": "f36f82223a4a106163c74c0ad620c3047d3cc2cdc0e232801e223e95381d309c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5a1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F5A2.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "65bd4174941856c5365044693e566c11", "sha1_hash": "03448f68180ca7416d9353e9c8430b8188253396", "sha256_hash": "f36f82223a4a106163c74c0ad620c3047d3cc2cdc0e232801e223e95381d309c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5a2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F5A3.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "65bd4174941856c5365044693e566c11", "sha1_hash": "03448f68180ca7416d9353e9c8430b8188253396", "sha256_hash": "f36f82223a4a106163c74c0ad620c3047d3cc2cdc0e232801e223e95381d309c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5a3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F5B3.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "909c4777c9d2ceee9731b841043461e7", "sha1_hash": "836254f5cbc625d36dcdc47b8574c639efe502ee", "sha256_hash": "5642676307f1b769c607971b10c0cfa559892ae103fe09d5ea636dd2e7d9d01f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5b3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F5B4.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "909c4777c9d2ceee9731b841043461e7", "sha1_hash": "836254f5cbc625d36dcdc47b8574c639efe502ee", "sha256_hash": "5642676307f1b769c607971b10c0cfa559892ae103fe09d5ea636dd2e7d9d01f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5b4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F5B5.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "909c4777c9d2ceee9731b841043461e7", "sha1_hash": "836254f5cbc625d36dcdc47b8574c639efe502ee", "sha256_hash": "5642676307f1b769c607971b10c0cfa559892ae103fe09d5ea636dd2e7d9d01f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5b5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F5C6.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "dac45c31e753c98cdfbb9a51edfb4ed1", "sha1_hash": "bb0f1154d13a8eb32ab2ea618c6b387761bdf2c7", "sha256_hash": "fa5f036fda7fcdfeb8aa05db8ff3ac6b531c448f81eb24a4f57df9709054c5ec", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5c6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F5C7.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "dac45c31e753c98cdfbb9a51edfb4ed1", "sha1_hash": "bb0f1154d13a8eb32ab2ea618c6b387761bdf2c7", "sha256_hash": "fa5f036fda7fcdfeb8aa05db8ff3ac6b531c448f81eb24a4f57df9709054c5ec", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5c7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F5C8.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "dac45c31e753c98cdfbb9a51edfb4ed1", "sha1_hash": "bb0f1154d13a8eb32ab2ea618c6b387761bdf2c7", "sha256_hash": "fa5f036fda7fcdfeb8aa05db8ff3ac6b531c448f81eb24a4f57df9709054c5ec", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5c8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F5D9.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "5d9e27165b41816cfcc8873e8e932017", "sha1_hash": "86df95f8233d001921091452a721280960ed9701", "sha256_hash": "55da333db9d4c95cad23543590530407e1b8613be331be9544ed0a5a74fe8f47", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5d9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F5E9.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "39651cbfc4ba04e334dfc22acb4677aa", "sha1_hash": "f9a26317f4b5230acf410efc869e5cedf678243b", "sha256_hash": "8585ea0f33414259b66ecaf5f8704a786967be092f4f9f6cbe3dc837f3833374", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5e9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F5EA.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "39651cbfc4ba04e334dfc22acb4677aa", "sha1_hash": "f9a26317f4b5230acf410efc869e5cedf678243b", "sha256_hash": "8585ea0f33414259b66ecaf5f8704a786967be092f4f9f6cbe3dc837f3833374", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5ea.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F5FB.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "1eb125acfc4ea168b8f1b26d23e6e14a", "sha1_hash": "802479d5223500d2bcb0d688a12919792c1b7234", "sha256_hash": "7044172508df63cd40967a61aa41ae2c93b5beddaeebfbacbe8320bab5369b4f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5fb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F5FC.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "1eb125acfc4ea168b8f1b26d23e6e14a", "sha1_hash": "802479d5223500d2bcb0d688a12919792c1b7234", "sha256_hash": "7044172508df63cd40967a61aa41ae2c93b5beddaeebfbacbe8320bab5369b4f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5fc.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F5FD.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "1eb125acfc4ea168b8f1b26d23e6e14a", "sha1_hash": "802479d5223500d2bcb0d688a12919792c1b7234", "sha256_hash": "7044172508df63cd40967a61aa41ae2c93b5beddaeebfbacbe8320bab5369b4f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5fd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F60D.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "d679411f3fa692e6b752155b21d207de", "sha1_hash": "0337b72b2c72bf5c45e9302038d87fe81e026adf", "sha256_hash": "4fb1ecfa8639a9267c67cbe35f87dc80958c06ea9e061b31449169aff6d63faf", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f60d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F60E.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "d679411f3fa692e6b752155b21d207de", "sha1_hash": "0337b72b2c72bf5c45e9302038d87fe81e026adf", "sha256_hash": "4fb1ecfa8639a9267c67cbe35f87dc80958c06ea9e061b31449169aff6d63faf", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f60e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F60F.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "d679411f3fa692e6b752155b21d207de", "sha1_hash": "0337b72b2c72bf5c45e9302038d87fe81e026adf", "sha256_hash": "4fb1ecfa8639a9267c67cbe35f87dc80958c06ea9e061b31449169aff6d63faf", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f60f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F610.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "d679411f3fa692e6b752155b21d207de", "sha1_hash": "0337b72b2c72bf5c45e9302038d87fe81e026adf", "sha256_hash": "4fb1ecfa8639a9267c67cbe35f87dc80958c06ea9e061b31449169aff6d63faf", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f610.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F621.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "c434ddec0db61048762ff94721be7089", "sha1_hash": "e005a7ef6a8de613bccde48b1ee2a79dc6bb84c5", "sha256_hash": "db4e0f1ad6ecb6b825a9c9ba0687efc9038523a0584ab67902c20e2656612ef1", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f621.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F622.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "c434ddec0db61048762ff94721be7089", "sha1_hash": "e005a7ef6a8de613bccde48b1ee2a79dc6bb84c5", "sha256_hash": "db4e0f1ad6ecb6b825a9c9ba0687efc9038523a0584ab67902c20e2656612ef1", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f622.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F623.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "c434ddec0db61048762ff94721be7089", "sha1_hash": "e005a7ef6a8de613bccde48b1ee2a79dc6bb84c5", "sha256_hash": "db4e0f1ad6ecb6b825a9c9ba0687efc9038523a0584ab67902c20e2656612ef1", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f623.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F634.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "44e8b72140c5937b35d5e11930f7894d", "sha1_hash": "8d49dc7f490f9440bc696f6541d77fb475fc823a", "sha256_hash": "940ce76f327c39d19a5736ec21801f09c0f1b02f65fb91fad20dade63ac1916f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f634.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F635.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "44e8b72140c5937b35d5e11930f7894d", "sha1_hash": "8d49dc7f490f9440bc696f6541d77fb475fc823a", "sha256_hash": "940ce76f327c39d19a5736ec21801f09c0f1b02f65fb91fad20dade63ac1916f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f635.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F636.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "44e8b72140c5937b35d5e11930f7894d", "sha1_hash": "8d49dc7f490f9440bc696f6541d77fb475fc823a", "sha256_hash": "940ce76f327c39d19a5736ec21801f09c0f1b02f65fb91fad20dade63ac1916f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f636.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F637.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "e6cb259c1703ccdd1197a25dd4942506", "sha1_hash": "ddf517ac9febd17ed5f2231aefccc1d03c9b1049", "sha256_hash": "fdaf5dbca4e66c9a3bdcd8d821342467ee34d931352acadcb9eef82d8bc73298", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f637.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F647.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "e6cb259c1703ccdd1197a25dd4942506", "sha1_hash": "ddf517ac9febd17ed5f2231aefccc1d03c9b1049", "sha256_hash": "fdaf5dbca4e66c9a3bdcd8d821342467ee34d931352acadcb9eef82d8bc73298", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f647.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F648.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "e6cb259c1703ccdd1197a25dd4942506", "sha1_hash": "ddf517ac9febd17ed5f2231aefccc1d03c9b1049", "sha256_hash": "fdaf5dbca4e66c9a3bdcd8d821342467ee34d931352acadcb9eef82d8bc73298", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f648.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F649.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "e6cb259c1703ccdd1197a25dd4942506", "sha1_hash": "ddf517ac9febd17ed5f2231aefccc1d03c9b1049", "sha256_hash": "fdaf5dbca4e66c9a3bdcd8d821342467ee34d931352acadcb9eef82d8bc73298", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f649.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F6B8.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "d9ae701f5dd0b628c625a54059cb9744", "sha1_hash": "49aee81e576bd9dbfba4d2ccf670b594bf53a140", "sha256_hash": "6c4b9203660981bcdcec8d86415f9b4cdbee1c4471a1da2a90d0f8b4a6cd6290", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6b8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F6C8.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "c4559a377c8f3401cca201ae5c720ef7", "sha1_hash": "3562ca4504eb475d1b1041998c7dac1318917d40", "sha256_hash": "0cb503a6c00617b3243aade53619796743a68a841325b68bdb34d2248164e300", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6c8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F6C9.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "c4559a377c8f3401cca201ae5c720ef7", "sha1_hash": "3562ca4504eb475d1b1041998c7dac1318917d40", "sha256_hash": "0cb503a6c00617b3243aade53619796743a68a841325b68bdb34d2248164e300", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6c9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F6DA.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "3d47d77bc99f5fe1d95276a04cce1137", "sha1_hash": "ed18709babbec5fdbddf0dd8aabb12bf68fea721", "sha256_hash": "d07a04edff9dc3e382e4852c5af20f3fc0d8aa10e925a89c38c4d555fd4f9f78", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6da.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F6DB.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "3d47d77bc99f5fe1d95276a04cce1137", "sha1_hash": "ed18709babbec5fdbddf0dd8aabb12bf68fea721", "sha256_hash": "d07a04edff9dc3e382e4852c5af20f3fc0d8aa10e925a89c38c4d555fd4f9f78", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6db.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F6DC.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "3d47d77bc99f5fe1d95276a04cce1137", "sha1_hash": "ed18709babbec5fdbddf0dd8aabb12bf68fea721", "sha256_hash": "d07a04edff9dc3e382e4852c5af20f3fc0d8aa10e925a89c38c4d555fd4f9f78", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6dc.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F6ED.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "9eb625764eff9a5f53568df532d096ed", "sha1_hash": "d10090a0b0ad3cf65d7bf341298295b93c75213b", "sha256_hash": "5d14c595d307d37561310fc179766d170422b1cdf39cdca4e25e2d0153f92cb3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6ed.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F6EE.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "9eb625764eff9a5f53568df532d096ed", "sha1_hash": "d10090a0b0ad3cf65d7bf341298295b93c75213b", "sha256_hash": "5d14c595d307d37561310fc179766d170422b1cdf39cdca4e25e2d0153f92cb3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6ee.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F6FE.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "b5efbbd58f1dbb99e7fa14062ac32059", "sha1_hash": "77fa96cf44e3939971ca3b9342b7b6c62c508187", "sha256_hash": "a7233f7c8b8a2957d37230ab75c25294696b7799ef4e5501ca51609331aa6a8e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6fe.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F6FF.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "b5efbbd58f1dbb99e7fa14062ac32059", "sha1_hash": "77fa96cf44e3939971ca3b9342b7b6c62c508187", "sha256_hash": "a7233f7c8b8a2957d37230ab75c25294696b7799ef4e5501ca51609331aa6a8e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6ff.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F700.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "b5efbbd58f1dbb99e7fa14062ac32059", "sha1_hash": "77fa96cf44e3939971ca3b9342b7b6c62c508187", "sha256_hash": "a7233f7c8b8a2957d37230ab75c25294696b7799ef4e5501ca51609331aa6a8e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f700.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F701.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "e26e61abc079fd0947f6a6a8b92eb4a7", "sha1_hash": "7f76ab35199a93d5e2c0e6fdb557f3307278241a", "sha256_hash": "f808fc0bccf2dff452da42c01e07725c2da632190bd91a5f6c6699cc91fdeb3f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f701.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F712.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "e26e61abc079fd0947f6a6a8b92eb4a7", "sha1_hash": "7f76ab35199a93d5e2c0e6fdb557f3307278241a", "sha256_hash": "f808fc0bccf2dff452da42c01e07725c2da632190bd91a5f6c6699cc91fdeb3f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f712.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F722.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "4d65fe16cac0bcd7260a56a45bcf8f5d", "sha1_hash": "f62d92c1bc87085916fe4e42952634f38083f67b", "sha256_hash": "8e804af1c8c68413dbc3bf40dc1b88ac1a6e5d545d07262995317429e3befeb6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f722.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F723.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "4d65fe16cac0bcd7260a56a45bcf8f5d", "sha1_hash": "f62d92c1bc87085916fe4e42952634f38083f67b", "sha256_hash": "8e804af1c8c68413dbc3bf40dc1b88ac1a6e5d545d07262995317429e3befeb6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f723.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F724.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "4d65fe16cac0bcd7260a56a45bcf8f5d", "sha1_hash": "f62d92c1bc87085916fe4e42952634f38083f67b", "sha256_hash": "8e804af1c8c68413dbc3bf40dc1b88ac1a6e5d545d07262995317429e3befeb6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f724.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F725.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "4d65fe16cac0bcd7260a56a45bcf8f5d", "sha1_hash": "f62d92c1bc87085916fe4e42952634f38083f67b", "sha256_hash": "8e804af1c8c68413dbc3bf40dc1b88ac1a6e5d545d07262995317429e3befeb6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f725.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F736.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "f8afc9c6812316cec7696bb2a37678a3", "sha1_hash": "aaf7be35be5cc96b7b25100d4ab1b49f53752284", "sha256_hash": "90624a7ba75f055bed571c30352161717c67572d7623e8936c9989b930990696", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f736.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F737.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "f8afc9c6812316cec7696bb2a37678a3", "sha1_hash": "aaf7be35be5cc96b7b25100d4ab1b49f53752284", "sha256_hash": "90624a7ba75f055bed571c30352161717c67572d7623e8936c9989b930990696", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f737.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F738.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "f8afc9c6812316cec7696bb2a37678a3", "sha1_hash": "aaf7be35be5cc96b7b25100d4ab1b49f53752284", "sha256_hash": "90624a7ba75f055bed571c30352161717c67572d7623e8936c9989b930990696", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f738.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F749.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "c42ccc8f7fbc68f572190e4e1572d7de", "sha1_hash": "c237aac1bfdd06bbfeb577aaa3edc0d5e763d198", "sha256_hash": "68dc58bf8e170ef3616394c060f41602c6bff4ebd2bdf8225dc24c20832d9068", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f749.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F74A.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "c42ccc8f7fbc68f572190e4e1572d7de", "sha1_hash": "c237aac1bfdd06bbfeb577aaa3edc0d5e763d198", "sha256_hash": "68dc58bf8e170ef3616394c060f41602c6bff4ebd2bdf8225dc24c20832d9068", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f74a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F75A.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "1465f646c10c7a837ad269d7406b7648", "sha1_hash": "2127e787799c9e7d732630fc4dfb1ea4d0617aad", "sha256_hash": "18c80ffadcc8321911f11ad7c61f13d1be11378edcceb69494fe84a366393896", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f75a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F75B.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "1465f646c10c7a837ad269d7406b7648", "sha1_hash": "2127e787799c9e7d732630fc4dfb1ea4d0617aad", "sha256_hash": "18c80ffadcc8321911f11ad7c61f13d1be11378edcceb69494fe84a366393896", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f75b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F75C.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "1465f646c10c7a837ad269d7406b7648", "sha1_hash": "2127e787799c9e7d732630fc4dfb1ea4d0617aad", "sha256_hash": "18c80ffadcc8321911f11ad7c61f13d1be11378edcceb69494fe84a366393896", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f75c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F77D.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "bcce097053a3f275ce63b83cc9003344", "sha1_hash": "940b3f697a8db360b6583033e24b09217e81b226", "sha256_hash": "d7d4ea3fb166395e6967e5f2aeb2a9099cd58fc3c0bd5c4c2b02f9876411c6f4", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f77d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F77E.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "bcce097053a3f275ce63b83cc9003344", "sha1_hash": "940b3f697a8db360b6583033e24b09217e81b226", "sha256_hash": "d7d4ea3fb166395e6967e5f2aeb2a9099cd58fc3c0bd5c4c2b02f9876411c6f4", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f77e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F78E.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "2772d0360800271925bf506615111529", "sha1_hash": "ae6369b1f7b9a6b43c7cdbaf3245e8f1f54fd0e3", "sha256_hash": "159758f584f37f9f1f2b5317516c5a55814a2532cd4014a3f6b580d7d42b8b42", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f78e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F78F.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "2772d0360800271925bf506615111529", "sha1_hash": "ae6369b1f7b9a6b43c7cdbaf3245e8f1f54fd0e3", "sha256_hash": "159758f584f37f9f1f2b5317516c5a55814a2532cd4014a3f6b580d7d42b8b42", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f78f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F790.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "2772d0360800271925bf506615111529", "sha1_hash": "ae6369b1f7b9a6b43c7cdbaf3245e8f1f54fd0e3", "sha256_hash": "159758f584f37f9f1f2b5317516c5a55814a2532cd4014a3f6b580d7d42b8b42", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f790.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F7A1.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "2677f86fc97191cfdcf4df7911e67aaa", "sha1_hash": "96f634f884f15734c7288f84f3b2d75ee84a3b68", "sha256_hash": "5189b0d164dcaf3e4cc07d9401f77ec50cc9fc77957fff4acc1c7aa374a3d584", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f7a1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F7B1.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "f0c25a3aa9b0acff64a2af4b9cf1afd3", "sha1_hash": "c42fcede3a7f5920d2cfa0a2a3ee3e1348f1779e", "sha256_hash": "4a0e739848ed9baf99b6ac33eff9047b483488bbaf9039c7d996eb9e1752fe6f", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f7b1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F7C2.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "1948b9f403d68cd6844908aabcc5c939", "sha1_hash": "67e3f5a917854dd20c1f7cd6ec9848514967ba58", "sha256_hash": "8522cb0c4505729ace062d2b3c3647447ef8fbf03a1e9c5f1acc638bf78cff5b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f7c2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F7C3.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "1948b9f403d68cd6844908aabcc5c939", "sha1_hash": "67e3f5a917854dd20c1f7cd6ec9848514967ba58", "sha256_hash": "8522cb0c4505729ace062d2b3c3647447ef8fbf03a1e9c5f1acc638bf78cff5b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f7c3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F7D4.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "bd51cab61855f9d12f4d77bc8385e650", "sha1_hash": "2b6c410e14106ae324de9ebd37a3f50ef2116bb0", "sha256_hash": "4901e09aaca43a2224b3d3ab32d7bfb8aa2811168c7c56e847450c90977ff47c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f7d4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F7D5.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "bd51cab61855f9d12f4d77bc8385e650", "sha1_hash": "2b6c410e14106ae324de9ebd37a3f50ef2116bb0", "sha256_hash": "4901e09aaca43a2224b3d3ab32d7bfb8aa2811168c7c56e847450c90977ff47c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f7d5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F7E5.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "db556c7c5654a84643530888819e14fa", "sha1_hash": "02c237a4065b907e3f5633d14ed2eb3724d15a7c", "sha256_hash": "45ec52e9a1b57b459fec2e02f20ee3e068b84a29ce3879f504d41ed2bec6e2f7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f7e5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F806.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "0b35b5699bddbc69989221709be7da6f", "sha1_hash": "5c0a221bea8809640159e961559f2581fc57c7ae", "sha256_hash": "5d9a9fb8e5859dbd9b32a5ab686bd912418accdfb41a8d92066e314a0a12cdd4", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f806.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F816.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "f036b8921890b0d10f00a5bf5bdec729", "sha1_hash": "be34e2dd32efe37497f5edcc21d63c56bdc8c9a2", "sha256_hash": "586b668ed7a5c3b8adbf7304f8d0ba1e81b7f6db1c8e28f36cf0d84cdb496085", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f816.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F827.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "34f91cc086c33b49dd108f5b14450c89", "sha1_hash": "e6bed0a0920ac06a427b3bc6a3243128a7eb50a9", "sha256_hash": "28df75a9d1d3bbfd16bc948c6efe745cdba2d547b02b6f075ca9b8d3f3f26e29", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f827.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F837.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "5d788fedeae6f1d83c718b993aaf0edd", "sha1_hash": "ff657760b607416f954c0d0f02cd4081f1bf8884", "sha256_hash": "38dd54a874e8468282ba8fda9eb499c8c9279e5ecbcfdee55be0059a1c9c4fac", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f837.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F838.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "5d788fedeae6f1d83c718b993aaf0edd", "sha1_hash": "ff657760b607416f954c0d0f02cd4081f1bf8884", "sha256_hash": "38dd54a874e8468282ba8fda9eb499c8c9279e5ecbcfdee55be0059a1c9c4fac", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f838.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F849.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "e7afa0433ffd6793611c0a074ae02376", "sha1_hash": "81765b7c10b940e6b6a118e2c4830b581485ca05", "sha256_hash": "d356cc8eb66171878f6a4055f83203f1ee1de244eb98f46917db817182bed6a5", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f849.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F84A.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "e7afa0433ffd6793611c0a074ae02376", "sha1_hash": "81765b7c10b940e6b6a118e2c4830b581485ca05", "sha256_hash": "d356cc8eb66171878f6a4055f83203f1ee1de244eb98f46917db817182bed6a5", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f84a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F84B.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "e7afa0433ffd6793611c0a074ae02376", "sha1_hash": "81765b7c10b940e6b6a118e2c4830b581485ca05", "sha256_hash": "d356cc8eb66171878f6a4055f83203f1ee1de244eb98f46917db817182bed6a5", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f84b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F85C.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "73b3446145b1a005af670273cae6c659", "sha1_hash": "1a5f91c6abd1921fdc318aee04047214c53b7728", "sha256_hash": "2e0cb62b2237bf00fc5d0cac237814459bc1a8c55af3a8322a516be603f607b7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f85c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F86C.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "53b31cba57364071f0b92fde987dbb3d", "sha1_hash": "5ce79151e953a2e7274fed831cbbad2172425346", "sha256_hash": "c8d9a97dda600fdc3fd84b54389f23829622ab669cc670f6f1b38726dc8b0566", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f86c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F86D.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "53b31cba57364071f0b92fde987dbb3d", "sha1_hash": "5ce79151e953a2e7274fed831cbbad2172425346", "sha256_hash": "c8d9a97dda600fdc3fd84b54389f23829622ab669cc670f6f1b38726dc8b0566", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f86d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F89D.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "95da43c0275776c1345d8855df05c984", "sha1_hash": "58ee37d07d867952be28228ea30697d807db2114", "sha256_hash": "42904201e2d09103766321fa614bd05f4a00c54de19288f8aff55e05ea5d6a70", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f89d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F89E.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "95da43c0275776c1345d8855df05c984", "sha1_hash": "58ee37d07d867952be28228ea30697d807db2114", "sha256_hash": "42904201e2d09103766321fa614bd05f4a00c54de19288f8aff55e05ea5d6a70", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f89e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F89F.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "a09268114b4cb6df8a6767265fa71727", "sha1_hash": "b51ae0ee85cbeb67a4aa34a88bcbb8aa174c6221", "sha256_hash": "4341640a4f141d3a35ab3c57580e1d2c9f71e3442ede2896bbf72f07968b3766", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f89f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F8CF.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "c1e7b3719d3e604334d4ea5170a9da97", "sha1_hash": "814555207667f27a53e2e8a503c560032c132172", "sha256_hash": "aa09ad35144137e416e44096a8b9c5f5053673e504744d69a28ab53539de015c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f8cf.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F8E0.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "ad613ffd617822549d6c82e66c06dd4c", "sha1_hash": "4bd9d96d580efbdc14c7a2c24fa3403fbee0faec", "sha256_hash": "df541758b76999b1786e35e3c6f9afab27889d377e60f31b21cea992d2cf3fc6", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f8e0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F8F0.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "c9d7caaccde02d9cbe0f9af60d6827dc", "sha1_hash": "95a6a85dc88f99e224cf7a6fef66214033274a22", "sha256_hash": "624b42c6e21d8e6392d494035eb838afc665f04bf8154cbebd3f99eab87a8777", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f8f0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F8F1.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "c9d7caaccde02d9cbe0f9af60d6827dc", "sha1_hash": "95a6a85dc88f99e224cf7a6fef66214033274a22", "sha256_hash": "624b42c6e21d8e6392d494035eb838afc665f04bf8154cbebd3f99eab87a8777", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f8f1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F902.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "e483e583f1511325f2fa9904bb27fa70", "sha1_hash": "4cd5bdd3a2fe1eec6fa520609fed4def59fd727f", "sha256_hash": "8226ebf822344f196d7f95a18bf20c7803664fa10947a9b73a8ef71083b33ad2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f902.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F903.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "e483e583f1511325f2fa9904bb27fa70", "sha1_hash": "4cd5bdd3a2fe1eec6fa520609fed4def59fd727f", "sha256_hash": "8226ebf822344f196d7f95a18bf20c7803664fa10947a9b73a8ef71083b33ad2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f903.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F914.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "dd1e78498286fe8b7914235fbfe4772a", "sha1_hash": "fb9888908deb70127878642bd1b74e5817873dc8", "sha256_hash": "157c5610fdba420b1bcd3f2bf7a2dbaa541da0a951f077471f5b0024ec858d6e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f914.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F915.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "dd1e78498286fe8b7914235fbfe4772a", "sha1_hash": "fb9888908deb70127878642bd1b74e5817873dc8", "sha256_hash": "157c5610fdba420b1bcd3f2bf7a2dbaa541da0a951f077471f5b0024ec858d6e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f915.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F916.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "dd1e78498286fe8b7914235fbfe4772a", "sha1_hash": "fb9888908deb70127878642bd1b74e5817873dc8", "sha256_hash": "157c5610fdba420b1bcd3f2bf7a2dbaa541da0a951f077471f5b0024ec858d6e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f916.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F926.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "b0e57fcf3eb588d105106b90168b352c", "sha1_hash": "ee62a235a427b229dfbeb59ff0c66e891b1ea9fc", "sha256_hash": "99e24199c9a832f4839c7e5c749dc99d2ef728004c42a30c6896edd5ada9a466", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f926.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F927.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "b0e57fcf3eb588d105106b90168b352c", "sha1_hash": "ee62a235a427b229dfbeb59ff0c66e891b1ea9fc", "sha256_hash": "99e24199c9a832f4839c7e5c749dc99d2ef728004c42a30c6896edd5ada9a466", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f927.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F928.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "b0e57fcf3eb588d105106b90168b352c", "sha1_hash": "ee62a235a427b229dfbeb59ff0c66e891b1ea9fc", "sha256_hash": "99e24199c9a832f4839c7e5c749dc99d2ef728004c42a30c6896edd5ada9a466", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f928.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F939.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "6779791e5c451ee29f3f08eeecbdf3f1", "sha1_hash": "0d10e85482ca5dfeaef1dccd914da033aaf479eb", "sha256_hash": "34bc853f027d1404caec15171d9d51a5e79f6ef0a423b7bbda419e71d6750288", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f939.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F93A.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "6779791e5c451ee29f3f08eeecbdf3f1", "sha1_hash": "0d10e85482ca5dfeaef1dccd914da033aaf479eb", "sha256_hash": "34bc853f027d1404caec15171d9d51a5e79f6ef0a423b7bbda419e71d6750288", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f93a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F94A.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "b04c67deab4025f734171f9b27454cbe", "sha1_hash": "a36bb54f7d0f7545656de9e1a5d5efc9475f6a30", "sha256_hash": "71127f5ad12f0455cabb4dc16456a9ea5004c3686b2c366961b59c5dac0f35ae", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f94a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F96B.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "f19a90ae7e669a69bff86c46ea7815da", "sha1_hash": "1994848ee4007ab80507cec3a98864d3214e9691", "sha256_hash": "a6af512d23f2e48b9184b61e0bfb9f9fc355d743e9fd10cbc97aeba44a27005b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f96b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F96C.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "03dbace4773f49af413532681a14eec1", "sha1_hash": "bd48ed36b583498d83f67b28dcb029354af96ef3", "sha256_hash": "59c055358a9142b72e21a30eb0492ce9af9cfbf4189768c8eca4d48f71029bc0", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f96c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F96D.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "03dbace4773f49af413532681a14eec1", "sha1_hash": "bd48ed36b583498d83f67b28dcb029354af96ef3", "sha256_hash": "59c055358a9142b72e21a30eb0492ce9af9cfbf4189768c8eca4d48f71029bc0", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f96d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F98D.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "741a7dea8e76eb32e7142675d554f22b", "sha1_hash": "6b605107d3827f9c9ffd4029b72ccdd72628cdc2", "sha256_hash": "8007de0dbdecff7d678e651c68a0b12b0dc20651fcdb628fc090c3084afeadd3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f98d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F98E.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "741a7dea8e76eb32e7142675d554f22b", "sha1_hash": "6b605107d3827f9c9ffd4029b72ccdd72628cdc2", "sha256_hash": "8007de0dbdecff7d678e651c68a0b12b0dc20651fcdb628fc090c3084afeadd3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f98e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F99F.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "897a33741143f50b74704df8eec736d9", "sha1_hash": "526a435f2efd108412d4088b073cabfeef22bac9", "sha256_hash": "bc7df27c00dd642509782a90f9d1b9dea55de8234d9de3890bd72c5f62ed56da", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f99f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F9A0.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "897a33741143f50b74704df8eec736d9", "sha1_hash": "526a435f2efd108412d4088b073cabfeef22bac9", "sha256_hash": "bc7df27c00dd642509782a90f9d1b9dea55de8234d9de3890bd72c5f62ed56da", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9a0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F9C0.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "c32740bd78c0eda34b5e1272188e4bbe", "sha1_hash": "a5cc6a17b4a4e1ad7e0ea976d5989bbe2df6ba9a", "sha256_hash": "dc2dba534fc133d5c92dd22761408da96ce04131d96f35f6808fd2dc21bb7374", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9c0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F9C1.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "c32740bd78c0eda34b5e1272188e4bbe", "sha1_hash": "a5cc6a17b4a4e1ad7e0ea976d5989bbe2df6ba9a", "sha256_hash": "dc2dba534fc133d5c92dd22761408da96ce04131d96f35f6808fd2dc21bb7374", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9c1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F9C2.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "c32740bd78c0eda34b5e1272188e4bbe", "sha1_hash": "a5cc6a17b4a4e1ad7e0ea976d5989bbe2df6ba9a", "sha256_hash": "dc2dba534fc133d5c92dd22761408da96ce04131d96f35f6808fd2dc21bb7374", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9c2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F9D2.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "7bfacda96d83ac7a5eab6029ed31d8d3", "sha1_hash": "2b648c326cc2b2ee0a9f1cc4618d82ad1931571f", "sha256_hash": "6e4a86d543899fe2a0739fd7395794ed3f485f157b40dc2ca93817e3b604b913", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9d2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F9D3.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "7bfacda96d83ac7a5eab6029ed31d8d3", "sha1_hash": "2b648c326cc2b2ee0a9f1cc4618d82ad1931571f", "sha256_hash": "6e4a86d543899fe2a0739fd7395794ed3f485f157b40dc2ca93817e3b604b913", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9d3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F9D4.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "7bfacda96d83ac7a5eab6029ed31d8d3", "sha1_hash": "2b648c326cc2b2ee0a9f1cc4618d82ad1931571f", "sha256_hash": "6e4a86d543899fe2a0739fd7395794ed3f485f157b40dc2ca93817e3b604b913", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9d4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F9E5.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "8ac380e6de1059d479390edacc24a177", "sha1_hash": "fd26c908afa389126339d2688cfe38988c66d52d", "sha256_hash": "4f2143552d67291e7516198a09565806a4bd7c6ed70f8ed7f6f70326e54db657", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9e5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F9E6.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "8ac380e6de1059d479390edacc24a177", "sha1_hash": "fd26c908afa389126339d2688cfe38988c66d52d", "sha256_hash": "4f2143552d67291e7516198a09565806a4bd7c6ed70f8ed7f6f70326e54db657", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9e6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\F9F7.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "125843ec029a307caee53b4425fbd0e3", "sha1_hash": "05789d4895e3a75820e0f1e1a219abbb8f3755ec", "sha256_hash": "41350403f48627cc9cb7443ba08ddaf9e285945ec92ce302c10cb17d836a900c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9f7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FA07.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "32bc58962b0017f1042a028ce6cd759c", "sha1_hash": "e857327c6c51dfd5f689e8703d9ab1292cedf6d6", "sha256_hash": "09cd28b840d6944ed8ebb3b83a724556f693e4e08237ff5ce84c0d20ba24675b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa07.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FA08.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "32bc58962b0017f1042a028ce6cd759c", "sha1_hash": "e857327c6c51dfd5f689e8703d9ab1292cedf6d6", "sha256_hash": "09cd28b840d6944ed8ebb3b83a724556f693e4e08237ff5ce84c0d20ba24675b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa08.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FA09.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "32bc58962b0017f1042a028ce6cd759c", "sha1_hash": "e857327c6c51dfd5f689e8703d9ab1292cedf6d6", "sha256_hash": "09cd28b840d6944ed8ebb3b83a724556f693e4e08237ff5ce84c0d20ba24675b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa09.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FA0A.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "32bc58962b0017f1042a028ce6cd759c", "sha1_hash": "e857327c6c51dfd5f689e8703d9ab1292cedf6d6", "sha256_hash": "09cd28b840d6944ed8ebb3b83a724556f693e4e08237ff5ce84c0d20ba24675b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa0a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FA1B.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "c861afd8ab2c119e747b9038121efbd4", "sha1_hash": "e4ef07dbdf70890a1ea1f4ce8c70ca3591809e3b", "sha256_hash": "f44eb347a2110f8913a5ed5c5e9924f7a631103eb659a1b5b4e5dc35938d0b45", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa1b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FA2C.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "5c8edf47a392abb29245c0e97c788d2a", "sha1_hash": "c8c9e10829621d8a837d039bbbc0ae90bf56f3df", "sha256_hash": "fce9e4ccb87999fb59ee2e263f81df07f922388a0dbf4287833a5289c4d992b3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa2c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FA2D.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "5c8edf47a392abb29245c0e97c788d2a", "sha1_hash": "c8c9e10829621d8a837d039bbbc0ae90bf56f3df", "sha256_hash": "fce9e4ccb87999fb59ee2e263f81df07f922388a0dbf4287833a5289c4d992b3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa2d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FA2E.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "5c8edf47a392abb29245c0e97c788d2a", "sha1_hash": "c8c9e10829621d8a837d039bbbc0ae90bf56f3df", "sha256_hash": "fce9e4ccb87999fb59ee2e263f81df07f922388a0dbf4287833a5289c4d992b3", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa2e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FA3E.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "ad92c5adef9404e652c1be24d9595274", "sha1_hash": "daef89630ad3aa8530b2d78ddd5a3839655ee87f", "sha256_hash": "38e33077367c38f9ec31aa9cf565a8cf75989237bbafe13fd01b4e34f12d2873", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa3e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FA3F.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "ad92c5adef9404e652c1be24d9595274", "sha1_hash": "daef89630ad3aa8530b2d78ddd5a3839655ee87f", "sha256_hash": "38e33077367c38f9ec31aa9cf565a8cf75989237bbafe13fd01b4e34f12d2873", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa3f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FA50.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "ed0ea0131bd1863d91c1615d80148e0b", "sha1_hash": "201e52a437c5b55eaf17ee2d2685ef39e4e77310", "sha256_hash": "e063b195f6b560352ca55d6b39967e1601c3b18ab9264069d844120ad6798bf7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa50.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FA51.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "ed0ea0131bd1863d91c1615d80148e0b", "sha1_hash": "201e52a437c5b55eaf17ee2d2685ef39e4e77310", "sha256_hash": "e063b195f6b560352ca55d6b39967e1601c3b18ab9264069d844120ad6798bf7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa51.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FA52.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "adb1ec5b8fff0370b151c026632030f2", "sha1_hash": "1d513be75293975e4281946cd43c72c46f79605e", "sha256_hash": "0e6f743e28b5364aecef7a7a1f029993567f93edf44b36f3c98953df7c74fbee", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa52.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FA62.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "adb1ec5b8fff0370b151c026632030f2", "sha1_hash": "1d513be75293975e4281946cd43c72c46f79605e", "sha256_hash": "0e6f743e28b5364aecef7a7a1f029993567f93edf44b36f3c98953df7c74fbee", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa62.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FA63.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "adb1ec5b8fff0370b151c026632030f2", "sha1_hash": "1d513be75293975e4281946cd43c72c46f79605e", "sha256_hash": "0e6f743e28b5364aecef7a7a1f029993567f93edf44b36f3c98953df7c74fbee", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa63.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FA74.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "288eb2692b7d4dabd18b3cd550d15b5e", "sha1_hash": "a742c56e5c9f1c78535a2d5c3d1b512ecc903701", "sha256_hash": "63052ebdc0c14a1f49a392276d6846fede6bce315e1c4787d62da9d1a64cecd5", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa74.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FA85.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "138f3113f76d726288c4e978cb0413f2", "sha1_hash": "611ca0828647b0ac4ea3bcd22f3c28686824a101", "sha256_hash": "573fd261ce7b58332e9f24a7c4a17d2224e3d0d4c48941e5e03297a7d305f35b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa85.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FA86.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "138f3113f76d726288c4e978cb0413f2", "sha1_hash": "611ca0828647b0ac4ea3bcd22f3c28686824a101", "sha256_hash": "573fd261ce7b58332e9f24a7c4a17d2224e3d0d4c48941e5e03297a7d305f35b", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa86.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FA96.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "418548d74f249fbcc5f08511e5c7bb56", "sha1_hash": "b751b27e5a560d2973a7432be8e37d02686faf24", "sha256_hash": "146953e94da698ad13f60d6002476e2ee28273caff5ab17f059f1d9b97054b2c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa96.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FA97.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "418548d74f249fbcc5f08511e5c7bb56", "sha1_hash": "b751b27e5a560d2973a7432be8e37d02686faf24", "sha256_hash": "146953e94da698ad13f60d6002476e2ee28273caff5ab17f059f1d9b97054b2c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa97.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FA98.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "418548d74f249fbcc5f08511e5c7bb56", "sha1_hash": "b751b27e5a560d2973a7432be8e37d02686faf24", "sha256_hash": "146953e94da698ad13f60d6002476e2ee28273caff5ab17f059f1d9b97054b2c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa98.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FA99.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "418548d74f249fbcc5f08511e5c7bb56", "sha1_hash": "b751b27e5a560d2973a7432be8e37d02686faf24", "sha256_hash": "146953e94da698ad13f60d6002476e2ee28273caff5ab17f059f1d9b97054b2c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa99.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FAAA.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "0511f1993ecc2f294faa8dace502d19c", "sha1_hash": "98ee28a4f58bdac0f7e0ddc22e03a7f530956408", "sha256_hash": "fc0750c6642725c86799dc19741bc1a529186a18530d7fd030a3668e961b30b7", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\faaa.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FACA.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "b5975ffa385dc00cc1ee73251b6f7cdf", "sha1_hash": "87164e350ca6d29c9ea1aa778ea40372a8eef860", "sha256_hash": "5e7554b0e9e8cdd55822716d16264911814f41976e4476e112c3a46bda5316df", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\faca.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FACB.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "b5975ffa385dc00cc1ee73251b6f7cdf", "sha1_hash": "87164e350ca6d29c9ea1aa778ea40372a8eef860", "sha256_hash": "5e7554b0e9e8cdd55822716d16264911814f41976e4476e112c3a46bda5316df", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\facb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FACC.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "93c8cf85d0d5b115d17169d1e9308d1c", "sha1_hash": "0253e619a7e637ad4e0dc752f4847c5031faa630", "sha256_hash": "77cef3d40b18c42fe9b813a853be8711f1b2f971da24c26fba35d44122d84b89", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\facc.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FACD.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "93c8cf85d0d5b115d17169d1e9308d1c", "sha1_hash": "0253e619a7e637ad4e0dc752f4847c5031faa630", "sha256_hash": "77cef3d40b18c42fe9b813a853be8711f1b2f971da24c26fba35d44122d84b89", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\facd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FB4B.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "a03c7050677123d24e0f908411639daf", "sha1_hash": "faad9f20113781013e8895743428e74fb4abf633", "sha256_hash": "cf4c4c6109dcf0a94857fefd4dc36767bf61ca3885e9e575481096e24f290e4c", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb4b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FB6B.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "5021321237c3cbcedbe86bc2eda5575f", "sha1_hash": "8282b1d20c1cbb3149c3269733801eeb9a3de567", "sha256_hash": "402bea642f6fa667bdd43ffe9acea915addead54da069c3282d074e05c03eb8e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb6b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FB6C.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "5021321237c3cbcedbe86bc2eda5575f", "sha1_hash": "8282b1d20c1cbb3149c3269733801eeb9a3de567", "sha256_hash": "402bea642f6fa667bdd43ffe9acea915addead54da069c3282d074e05c03eb8e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb6c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FB6D.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "5021321237c3cbcedbe86bc2eda5575f", "sha1_hash": "8282b1d20c1cbb3149c3269733801eeb9a3de567", "sha256_hash": "402bea642f6fa667bdd43ffe9acea915addead54da069c3282d074e05c03eb8e", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb6d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FB7E.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "3b6d47524dd9aadcd8087e8066cfedbb", "sha1_hash": "95e7c67e66d21b44a437cd408c1fe891073218e9", "sha256_hash": "8a14e9bef42d8e77d645765a27de8d55846007ef73b48a4cdf37619801f93ce2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb7e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FB7F.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "3b6d47524dd9aadcd8087e8066cfedbb", "sha1_hash": "95e7c67e66d21b44a437cd408c1fe891073218e9", "sha256_hash": "8a14e9bef42d8e77d645765a27de8d55846007ef73b48a4cdf37619801f93ce2", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb7f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FB90.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "f98f23a4f9e6dc8f433d6c263e6ad636", "sha1_hash": "ca167eead7432324b32261a98f0b05f6fd581edc", "sha256_hash": "df020e01c7255d67feab95591a7b9b90718d3d556352a17d5bc29c5a8df7cc41", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb90.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FB91.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "f98f23a4f9e6dc8f433d6c263e6ad636", "sha1_hash": "ca167eead7432324b32261a98f0b05f6fd581edc", "sha256_hash": "df020e01c7255d67feab95591a7b9b90718d3d556352a17d5bc29c5a8df7cc41", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb91.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FBA1.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "b8403b24cec2c2fe3ad8d388ff5c2692", "sha1_hash": "391d3e10403f244ec1919fca4dd1bf5d2180d73a", "sha256_hash": "232b42d82017c86b66aa5f4dcd362c5be6aee746f55e8465a4eb1e62eb6fae3d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fba1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FBA2.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "b8403b24cec2c2fe3ad8d388ff5c2692", "sha1_hash": "391d3e10403f244ec1919fca4dd1bf5d2180d73a", "sha256_hash": "232b42d82017c86b66aa5f4dcd362c5be6aee746f55e8465a4eb1e62eb6fae3d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fba2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FBA3.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "b8403b24cec2c2fe3ad8d388ff5c2692", "sha1_hash": "391d3e10403f244ec1919fca4dd1bf5d2180d73a", "sha256_hash": "232b42d82017c86b66aa5f4dcd362c5be6aee746f55e8465a4eb1e62eb6fae3d", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fba3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FBB4.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "e307f8f8f230a2dd8989867ae53a7840", "sha1_hash": "d6a7d14aeffddf8a05d8c52aaf0e949cc8af4df9", "sha256_hash": "f4d61ad4fa3f52aa710ba9ef52a71b9c8faa9dbbb52ff66c47b4441febe8c6e9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbb4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FBB5.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "e307f8f8f230a2dd8989867ae53a7840", "sha1_hash": "d6a7d14aeffddf8a05d8c52aaf0e949cc8af4df9", "sha256_hash": "f4d61ad4fa3f52aa710ba9ef52a71b9c8faa9dbbb52ff66c47b4441febe8c6e9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbb5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FBB6.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "e307f8f8f230a2dd8989867ae53a7840", "sha1_hash": "d6a7d14aeffddf8a05d8c52aaf0e949cc8af4df9", "sha256_hash": "f4d61ad4fa3f52aa710ba9ef52a71b9c8faa9dbbb52ff66c47b4441febe8c6e9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbb6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FBB7.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "e307f8f8f230a2dd8989867ae53a7840", "sha1_hash": "d6a7d14aeffddf8a05d8c52aaf0e949cc8af4df9", "sha256_hash": "f4d61ad4fa3f52aa710ba9ef52a71b9c8faa9dbbb52ff66c47b4441febe8c6e9", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbb7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FBD7.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "644b05368f7512cae99e3857f9027bcf", "sha1_hash": "690f3b113810afc8e70466194bf436cc1312b33e", "sha256_hash": "864f9116027c7a0276777094e7a0f8dc73993c34f9123c7d978ee744e4dbd500", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbd7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FBD8.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "644b05368f7512cae99e3857f9027bcf", "sha1_hash": "690f3b113810afc8e70466194bf436cc1312b33e", "sha256_hash": "864f9116027c7a0276777094e7a0f8dc73993c34f9123c7d978ee744e4dbd500", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbd8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FBE9.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "29a8e19f453787602095a98287b92983", "sha1_hash": "b7e1af9f360642f06d7d75a41e09838bdfc71afc", "sha256_hash": "d7c0b9600744ea6c64c05815a19cf3d91ada60e64edeeb3f9a3b5fbc98a22ee1", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbe9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FBEA.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "29a8e19f453787602095a98287b92983", "sha1_hash": "b7e1af9f360642f06d7d75a41e09838bdfc71afc", "sha256_hash": "d7c0b9600744ea6c64c05815a19cf3d91ada60e64edeeb3f9a3b5fbc98a22ee1", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbea.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FBEB.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "29a8e19f453787602095a98287b92983", "sha1_hash": "b7e1af9f360642f06d7d75a41e09838bdfc71afc", "sha256_hash": "d7c0b9600744ea6c64c05815a19cf3d91ada60e64edeeb3f9a3b5fbc98a22ee1", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbeb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FBEC.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "29a8e19f453787602095a98287b92983", "sha1_hash": "b7e1af9f360642f06d7d75a41e09838bdfc71afc", "sha256_hash": "d7c0b9600744ea6c64c05815a19cf3d91ada60e64edeeb3f9a3b5fbc98a22ee1", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbec.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FBFC.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "03b26eefb62150cc56da444a144e9be1", "sha1_hash": "f40a7f3e6c9d8b7a979d4d776a32767bb79bc89f", "sha256_hash": "1160ca78c4e98eda9addcb9966a4e56df9f102fcc1a9e48f3e6f512ff2974b61", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbfc.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FBFD.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "03b26eefb62150cc56da444a144e9be1", "sha1_hash": "f40a7f3e6c9d8b7a979d4d776a32767bb79bc89f", "sha256_hash": "1160ca78c4e98eda9addcb9966a4e56df9f102fcc1a9e48f3e6f512ff2974b61", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbfd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FBFE.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "03b26eefb62150cc56da444a144e9be1", "sha1_hash": "f40a7f3e6c9d8b7a979d4d776a32767bb79bc89f", "sha256_hash": "1160ca78c4e98eda9addcb9966a4e56df9f102fcc1a9e48f3e6f512ff2974b61", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbfe.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC0F.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "474a65b62cb05adc115bbd1ede09301b", "sha1_hash": "919343acf762452776e634a9bf202c30fb6a7f9b", "sha256_hash": "99eae660e8a11ebd18d71e8faf2fea8b3cfc95ae93bf339ff326e8e65b53a293", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc0f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC10.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "474a65b62cb05adc115bbd1ede09301b", "sha1_hash": "919343acf762452776e634a9bf202c30fb6a7f9b", "sha256_hash": "99eae660e8a11ebd18d71e8faf2fea8b3cfc95ae93bf339ff326e8e65b53a293", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc10.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC11.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "474a65b62cb05adc115bbd1ede09301b", "sha1_hash": "919343acf762452776e634a9bf202c30fb6a7f9b", "sha256_hash": "99eae660e8a11ebd18d71e8faf2fea8b3cfc95ae93bf339ff326e8e65b53a293", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc11.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC22.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 }, { "md5_hash": "e6a85d90c192b656121d5fb773bc9c7c", "sha1_hash": "f1923f3d154592e13686c626a452c5712572c703", "sha256_hash": "4ab81fc69870779cdfccf4c642b53c832301c6173f803deb225a6e428b875813", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc22.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC23.tmp", "hashes": [ { "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc23.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC24.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc24.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC25.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc25.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC35.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc35.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC36.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc36.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC37.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc37.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC38.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc38.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC49.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc49.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC4A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc4a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC4B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc4b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC4C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc4c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC5D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc5d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC5E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc5e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC5F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc5f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC6F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc6f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC70.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc70.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC71.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc71.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC72.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc72.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC83.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc83.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC84.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc84.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC85.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc85.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC86.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc86.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC96.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc96.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC97.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc97.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FC98.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc98.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FCA9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fca9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\FCBA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fcba.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Amsisigd\\Chakmcat.exe", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\amsisigd\\chakmcat.exe", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\697\\FD09.bat", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\697\\fd09.bat", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Windows\\system32\\c_1252.nls", "hashes": [], "norm_filename": "c:\\windows\\system32\\c_1252.nls", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\697.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\697.tmp", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\697\\FD09.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\697\\fd09.tmp", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Amsisigd", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\amsisigd", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\697", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\697", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "\\??\\C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\697\\FD09.bat", "hashes": [], "norm_filename": "\\??\\c:\\users\\ciihmn~1\\appdata\\local\\temp\\697\\fd09.bat", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Windows\\system32", "hashes": [], "norm_filename": "c:\\windows\\system32", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "\"C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\697\\FD09.bat\"", "hashes": [], "norm_filename": "c:\\windows\\system32\\\"c:\\users\\ciihmn~1\\appdata\\local\\temp\\697\\fd09.bat\"", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "\"C:\\Users\\CIIHMN~1\\AppData\\Roaming\\MICROS~1\\Amsisigd\\Chakmcat.exe\"", "hashes": [], "norm_filename": "c:\\windows\\system32\\\"c:\\users\\ciihmn~1\\appdata\\roaming\\micros~1\\amsisigd\\chakmcat.exe\"", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\12A3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\12a3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\12A4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\12a4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\12A5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\12a5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\12A6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\12a6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\12B7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\12b7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\12B8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\12b8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\12B9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\12b9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\12BA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\12ba.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\12CB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\12cb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\12CC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\12cc.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\12CD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\12cd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\12DD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\12dd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\12EE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\12ee.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\12EF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\12ef.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\12F0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\12f0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\12F1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\12f1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\12F2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\12f2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1302.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1302.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1303.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1303.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1304.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1304.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1305.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1305.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1316.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1316.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1317.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1317.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1318.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1318.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1319.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1319.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\131A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\131a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\132B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\132b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\132C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\132c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\132D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\132d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\132E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\132e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\133E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\133e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\133F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\133f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1340.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1340.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1341.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1341.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1352.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1352.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1353.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1353.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1354.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1354.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1355.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1355.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1375.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1375.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1376.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1376.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1387.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1387.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1388.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1388.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1389.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1389.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\138A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\138a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\138B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\138b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\139B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\139b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\139C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\139c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\139D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\139d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\139E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\139e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\13AF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\13af.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\13B0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\13b0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\13B1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\13b1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\13B2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\13b2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\13B3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\13b3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\13C4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\13c4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\13C5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\13c5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\13D5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\13d5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\13D6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\13d6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\13D7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\13d7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\13D8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\13d8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\13E9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\13e9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\13EA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\13ea.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\13EB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\13eb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\13EC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\13ec.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\13FD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\13fd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\13FE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\13fe.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\13FF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\13ff.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1400.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1400.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1401.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1401.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1411.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1411.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1412.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1412.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1413.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1413.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1414.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1414.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1425.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1425.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1435.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1435.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1436.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1436.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1437.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1437.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1448.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1448.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1459.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1459.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\145A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\145a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\146A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\146a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\146B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\146b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\146C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\146c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\146D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\146d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\146E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\146e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\147F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\147f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1480.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1480.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1481.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1481.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1482.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1482.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1493.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1493.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1494.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1494.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1495.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1495.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1496.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1496.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1497.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1497.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14A7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14a7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14A8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14a8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14A9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14a9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14AA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14aa.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14AB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14ab.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14BC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14bc.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14BD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14bd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14BE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14be.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14BF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14bf.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14C0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14c0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14D0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14d0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14D1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14d1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14D2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14d2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14D3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14d3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14D4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14d4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14E5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14e5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14E6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14e6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14E7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14e7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14E8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14e8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14E9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14e9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14FA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14fa.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14FB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14fb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14FC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14fc.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14FD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14fd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\14FE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\14fe.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\150E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\150e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\150F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\150f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1510.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1510.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1511.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1511.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1512.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1512.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1523.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1523.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1524.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1524.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1525.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1525.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1526.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1526.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1527.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1527.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1528.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1528.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1539.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1539.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\153A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\153a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\153B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\153b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\153C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\153c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\154C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\154c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\154D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\154d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\154E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\154e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\154F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\154f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1560.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1560.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1561.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1561.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1562.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1562.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1563.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1563.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1564.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1564.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1574.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1574.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1575.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1575.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1576.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1576.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1577.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1577.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1578.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1578.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1579.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1579.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\158A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\158a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\158B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\158b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\158C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\158c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\158D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\158d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\158E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\158e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\159F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\159f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\15A0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\15a0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\15A1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\15a1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\15A2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\15a2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\15B2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\15b2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\15B3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\15b3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\15B4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\15b4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\15B5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\15b5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\15C6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\15c6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\15C7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\15c7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\15C8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\15c8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\15C9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\15c9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\15CA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\15ca.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\15DB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\15db.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\15DC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\15dc.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\15DD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\15dd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\15DE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\15de.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\15EE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\15ee.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\15EF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\15ef.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\15F0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\15f0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\15F1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\15f1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\15F2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\15f2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\15F3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\15f3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1604.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1604.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1605.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1605.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1606.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1606.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1607.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1607.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1617.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1617.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1618.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1618.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1619.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1619.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\161A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\161a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\161B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\161b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\162C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\162c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\162D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\162d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\162E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\162e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\162F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\162f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1630.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1630.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1631.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1631.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1642.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1642.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1643.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1643.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1644.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1644.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1645.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1645.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1646.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1646.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1656.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1656.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1657.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1657.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1658.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1658.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1659.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1659.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\165A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\165a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\166B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\166b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\166C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\166c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\166D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\166d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\166E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\166e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\166F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\166f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1670.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1670.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1681.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1681.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1682.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1682.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1683.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1683.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1684.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1684.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1685.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1685.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1695.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1695.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1696.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1696.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1697.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1697.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1698.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1698.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1699.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1699.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16AA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16aa.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16AB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16ab.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16AC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16ac.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16AD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16ad.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16AE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16ae.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16BE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16be.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16BF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16bf.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16C0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16c0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16C1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16c1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16C2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16c2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16D3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16d3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16D4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16d4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16D5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16d5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16D6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16d6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16D7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16d7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16E8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16e8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16E9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16e9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16EA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16ea.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16EB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16eb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16EC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16ec.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16ED.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16ed.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16FD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16fd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16FE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16fe.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\16FF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\16ff.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1700.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1700.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1701.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1701.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1712.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1712.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1713.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1713.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1714.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1714.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1715.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1715.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1716.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1716.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1727.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1727.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1728.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1728.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1729.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1729.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\172A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\172a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\172B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\172b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\173B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\173b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\174C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\174c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\174D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\174d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\174E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\174e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\174F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\174f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1750.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1750.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1760.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1760.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1761.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1761.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1762.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1762.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1763.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1763.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1764.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1764.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1775.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1775.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1776.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1776.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1777.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1777.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1778.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1778.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1779.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1779.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\177A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\177a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\179A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\179a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\17AB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\17ab.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\17AC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\17ac.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\17AD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\17ad.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\17AE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\17ae.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\17BF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\17bf.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\17C0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\17c0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\17D0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\17d0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\17E1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\17e1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\17E2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\17e2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\17E3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\17e3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\17E4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\17e4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\17E5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\17e5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\17F5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\17f5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\17F6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\17f6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\17F7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\17f7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\17F8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\17f8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\17F9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\17f9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\180A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\180a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\180B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\180b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\180C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\180c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\180D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\180d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\180E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\180e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\181F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\181f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1820.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1820.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1821.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1821.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1822.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1822.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1823.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1823.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1833.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1833.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1834.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1834.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1835.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1835.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1836.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1836.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1837.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1837.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1848.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1848.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1849.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1849.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\184A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\184a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\184B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\184b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\185C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\185c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\185D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\185d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\186D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\186d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\186E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\186e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\186F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\186f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1870.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1870.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1871.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1871.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1872.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1872.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1883.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1883.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1884.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1884.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1885.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1885.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1886.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1886.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1896.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1896.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1897.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1897.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1898.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1898.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1899.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1899.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18AA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18aa.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18AB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18ab.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18AC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18ac.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18AD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18ad.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18AE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18ae.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18BF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18bf.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18C0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18c0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18D0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18d0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18D1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18d1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18D2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18d2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18D3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18d3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18D4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18d4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18E5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18e5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18E6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18e6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18E7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18e7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18E8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18e8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18E9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18e9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18FA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18fa.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18FB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18fb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18FC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18fc.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18FD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18fd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18FE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18fe.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\18FF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\18ff.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\190F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\190f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1910.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1910.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1911.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1911.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1912.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1912.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1913.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1913.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1924.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1924.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1925.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1925.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1926.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1926.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1927.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1927.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1928.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1928.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1938.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1938.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1939.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1939.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\193A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\193a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\193B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\193b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\193C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\193c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\194D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\194d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\194E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\194e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\194F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\194f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1950.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1950.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1951.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1951.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1962.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1962.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1963.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1963.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1964.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1964.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1965.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1965.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1975.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1975.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1976.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1976.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1987.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1987.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1988.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1988.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1989.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1989.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\198A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\198a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\199B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\199b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\199C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\199c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\199D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\199d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\199E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\199e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\199F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\199f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\19AF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\19af.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\19B0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\19b0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\19B1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\19b1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\19B2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\19b2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\19B3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\19b3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\19C4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\19c4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\19C5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\19c5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\19C6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\19c6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\19C7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\19c7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\19C8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\19c8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\19D8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\19d8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\19D9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\19d9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\19DA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\19da.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\19DB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\19db.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\19DC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\19dc.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\19ED.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\19ed.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\19EE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\19ee.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\19EF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\19ef.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\19F0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\19f0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A01.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a01.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A02.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a02.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A03.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a03.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A04.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a04.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A05.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a05.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A15.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a15.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A16.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a16.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A17.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a17.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A18.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a18.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A19.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a19.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A2A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a2a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A2B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a2b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A2C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a2c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A2D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a2d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A2E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a2e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A3F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a3f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A40.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a40.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A41.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a41.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A51.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a51.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A52.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a52.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A53.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a53.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A54.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a54.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A55.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a55.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A66.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a66.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A67.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a67.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A68.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a68.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A69.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a69.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A6A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a6a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A7A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a7a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A7B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a7b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A7C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a7c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A7D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a7d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A7E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a7e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A8F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a8f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A90.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a90.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A91.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a91.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A92.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a92.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A93.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a93.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1A94.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1a94.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1AA5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1aa5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1AA6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1aa6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1AA7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1aa7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1AA8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1aa8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1AA9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1aa9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1AB9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ab9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1ABA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1aba.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1ABB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1abb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1ACC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1acc.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1ACD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1acd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1ACE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ace.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1ACF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1acf.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1AD0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ad0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1AE1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ae1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1AE2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ae2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1AE3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ae3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1AE4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ae4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1AE5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ae5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1AF5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1af5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1AF6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1af6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1AF7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1af7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1AF8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1af8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1AF9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1af9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B0A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b0a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B0B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b0b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B0C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b0c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B0D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b0d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B0E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b0e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B1E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b1e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B1F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b1f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B20.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b20.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B21.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b21.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B22.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b22.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B33.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b33.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B34.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b34.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B35.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b35.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B36.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b36.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B37.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b37.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B48.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b48.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B49.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b49.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B4A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b4a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B4B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b4b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B4C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b4c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B5C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b5c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B5D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b5d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B6E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b6e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B6F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b6f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B70.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b70.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B71.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b71.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B72.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b72.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B83.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b83.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B84.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b84.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B85.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b85.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B86.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b86.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B96.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b96.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B97.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b97.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1B98.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1b98.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1BA9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ba9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1BAA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1baa.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1BAB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1bab.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1BAC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1bac.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1BAD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1bad.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1BBD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1bbd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1BBE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1bbe.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1BBF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1bbf.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1BC0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1bc0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1BC1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1bc1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1BD2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1bd2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1BD3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1bd3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1BD4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1bd4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1BD5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1bd5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1BD6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1bd6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1BE7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1be7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1BE8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1be8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1BE9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1be9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1BF9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1bf9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1BFA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1bfa.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1BFB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1bfb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1BFC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1bfc.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C0D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c0d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C0E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c0e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C0F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c0f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C10.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c10.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C21.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c21.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C22.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c22.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C23.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c23.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C33.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c33.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C34.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c34.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C35.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c35.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C36.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c36.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C37.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c37.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C48.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c48.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C49.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c49.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C4A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c4a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C4B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c4b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C5B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c5b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C5C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c5c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C5D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c5d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C5E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c5e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C5F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c5f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C70.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c70.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C71.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c71.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C72.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c72.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C73.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c73.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C74.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c74.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C85.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c85.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C86.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c86.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C87.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c87.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C88.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c88.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C98.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c98.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C99.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c99.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C9A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c9a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C9B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c9b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1C9C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1c9c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1CAD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1cad.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1CAE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1cae.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1CAF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1caf.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1CB0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1cb0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1CB1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1cb1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1CC2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1cc2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1CC3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1cc3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1CD3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1cd3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1CD4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1cd4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1CD5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1cd5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1CE6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ce6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1CE7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ce7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1CE8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ce8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1CE9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ce9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1CF9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1cf9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1CFA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1cfa.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1CFB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1cfb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1CFC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1cfc.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1CFD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1cfd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1D0E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1d0e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1D0F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1d0f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1D10.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1d10.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1D11.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1d11.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1D12.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1d12.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1D13.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1d13.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1D14.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1d14.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1D44.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1d44.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1D45.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1d45.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1D46.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1d46.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1D47.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1d47.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1D48.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1d48.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1D68.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1d68.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1D79.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1d79.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1D89.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1d89.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1D8A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1d8a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1D8B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1d8b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1D8C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1d8c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1D8D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1d8d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1D8E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1d8e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1D8F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1d8f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DA0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1da0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DA1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1da1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DA2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1da2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DA3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1da3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DA4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1da4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DA5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1da5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DA6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1da6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DC6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1dc6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DC7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1dc7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DC8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1dc8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DC9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1dc9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DDA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1dda.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DDB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ddb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DDC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ddc.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DDD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ddd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DDE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1dde.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DDF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ddf.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DE0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1de0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DF1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1df1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DF2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1df2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DF3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1df3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DF4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1df4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DF5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1df5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1DF6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1df6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E06.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e06.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E07.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e07.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E08.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e08.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E09.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e09.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E0A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e0a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E0B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e0b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E0C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e0c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E2C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e2c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E2D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e2d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E2E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e2e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E2F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e2f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E30.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e30.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E31.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e31.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E32.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e32.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E43.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e43.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E44.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e44.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E45.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e45.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E46.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e46.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E47.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e47.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E48.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e48.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E49.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e49.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E5A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e5a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E5B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e5b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E5C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e5c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E5D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e5d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E5E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e5e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E5F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e5f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E6F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e6f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E70.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e70.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E71.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e71.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E72.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e72.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E73.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e73.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E74.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e74.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E75.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e75.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E86.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e86.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E87.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e87.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E88.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e88.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E89.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e89.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E8A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e8a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E8B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e8b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E8C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e8c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E9D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e9d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E9E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e9e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1E9F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1e9f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EA0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ea0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EA1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ea1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EA2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ea2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EB2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1eb2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EB3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1eb3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EB4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1eb4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EB5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1eb5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EB6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1eb6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EB7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1eb7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EB8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1eb8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EC9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ec9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1ECA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1eca.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1ECB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ecb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1ECC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ecc.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1ECD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ecd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1ECE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ece.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1ECF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ecf.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EDF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1edf.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EE0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ee0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EE1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ee1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EE2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ee2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EE3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ee3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EE4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ee4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EE5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ee5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EF6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ef6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EF7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ef7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EF8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ef8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EF9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1ef9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EFA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1efa.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1EFB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1efb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1F0C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1f0c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1F0D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1f0d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1F0E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1f0e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1F0F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1f0f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1F10.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1f10.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1F11.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1f11.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\1F21.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\1f21.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\84526935.scr", "hashes": [ { "md5_hash": "f549977bce0051085abbe8d7728be589", "sha1_hash": "33e0317a4da4cc10737f5ff54f010315a3b71867", "sha256_hash": "21610f6f3397058086f90d9e0f74ba524aeb69d788efca24f344327460532a58", "type": "file_hash", "version": 1 } ], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\84526935.scr", "operations": [ "access", "write" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Windows\\SYSTEM32\\ntdll.dll", "hashes": [], "norm_filename": "c:\\windows\\system32\\ntdll.dll", "operations": [ "access", "read" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\8i341t8m.default\\prefs.js", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\mozilla\\firefox\\profiles\\8i341t8m.default\\prefs.js", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\6DB4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\6db4.tmp", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\A7BD.bi1", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\a7bd.bi1", "operations": [ "read", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7993.bin", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7993.bin", "operations": [ "read", "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\state.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\state.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8F3C.bin", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8f3c.bin", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\router-stability", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\router-stability", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\geoip", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\geoip", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\cached-certs", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\cached-certs", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\cached-consensus", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\cached-consensus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\unverified-consensus", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\unverified-consensus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\cached-microdesc-consensus", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\cached-microdesc-consensus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\unverified-microdesc-consensus", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\unverified-microdesc-consensus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "\\tor\\fallback-consensus", "hashes": [], "norm_filename": "c:\\tor\\fallback-consensus", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\cached-microdescs", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\cached-microdescs", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\cached-microdescs.new", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\cached-microdescs.new", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\cached-descriptors", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\cached-descriptors", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\cached-extrainfo", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\cached-extrainfo", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\A7BD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\a7bd.tmp", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7993.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7993.tmp", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8F3C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8f3c.tmp", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\state", "hashes": [], "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\state", "operations": [ "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7C83.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7c83.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7C93.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7c93.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7C94.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7c94.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7C95.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7c95.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7C96.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7c96.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7C97.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7c97.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7C98.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7c98.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CA9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ca9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CAA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7caa.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CAB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7cab.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CAC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7cac.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CAD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7cad.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CBD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7cbd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CBE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7cbe.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CBF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7cbf.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CC0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7cc0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CC1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7cc1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CC2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7cc2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CD3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7cd3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CD4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7cd4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CD5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7cd5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CD6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7cd6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CD7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7cd7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CD8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7cd8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CD9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7cd9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CEA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7cea.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CEB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ceb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CEC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7cec.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CED.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ced.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CEE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7cee.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CEF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7cef.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7CFF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7cff.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D00.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d00.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D01.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d01.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D02.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d02.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D03.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d03.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D14.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d14.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D15.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d15.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D16.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d16.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D17.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d17.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D18.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d18.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D19.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d19.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D2A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d2a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D2B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d2b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D2C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d2c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D2D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d2d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D2E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d2e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D2F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d2f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D3F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d3f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D40.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d40.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D41.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d41.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D42.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d42.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D43.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d43.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D44.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d44.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D55.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d55.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D56.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d56.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D57.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d57.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D58.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d58.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D59.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d59.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D5A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d5a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D6A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d6a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D6B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d6b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D6C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d6c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D6D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d6d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D6E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d6e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D7F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d7f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D80.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d80.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D81.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d81.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D82.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d82.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D83.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d83.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D84.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d84.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D95.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d95.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D96.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d96.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D97.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d97.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D98.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d98.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D99.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d99.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7D9A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7d9a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DAA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7daa.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DAB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7dab.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DAC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7dac.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DAD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7dad.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DAE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7dae.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DAF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7daf.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DC0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7dc0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DC1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7dc1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DC2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7dc2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DC3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7dc3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DC4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7dc4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DD5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7dd5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DD6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7dd6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DD7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7dd7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DD8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7dd8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DD9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7dd9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DDA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7dda.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DDB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ddb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DEB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7deb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DEC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7dec.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DED.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ded.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DEE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7dee.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7DEF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7def.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E00.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e00.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E01.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e01.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E02.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e02.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E03.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e03.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E04.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e04.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E14.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e14.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E15.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e15.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E16.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e16.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E17.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e17.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E18.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e18.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E29.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e29.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E2A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e2a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E2B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e2b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E2C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e2c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E2D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e2d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E2E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e2e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E3F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e3f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E40.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e40.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E41.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e41.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E42.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e42.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E43.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e43.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E44.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e44.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E54.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e54.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E55.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e55.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E56.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e56.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E57.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e57.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E58.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e58.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E69.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e69.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E6A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e6a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E6B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e6b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E6C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e6c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E6D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e6d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E7E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e7e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E7F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e7f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E80.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e80.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E81.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e81.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E82.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e82.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E83.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e83.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E93.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e93.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E94.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e94.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E95.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e95.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E96.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e96.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E97.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e97.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7E98.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7e98.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7EA9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ea9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7EAA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7eaa.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7EBA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7eba.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7EBB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ebb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7EBC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ebc.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7EBD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ebd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7EBE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ebe.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7EBF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ebf.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7ED0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ed0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7ED1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ed1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7ED2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ed2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7ED3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ed3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7ED4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ed4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7EE5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ee5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7EE6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ee6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7EF6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ef6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7EF7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ef7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7EF8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ef8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7EF9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ef9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F0A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f0a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F0B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f0b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F0C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f0c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F0D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f0d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F0E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f0e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F1F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f1f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F20.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f20.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F21.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f21.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F22.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f22.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F23.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f23.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F24.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f24.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F34.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f34.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F35.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f35.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F36.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f36.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F37.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f37.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F38.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f38.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F49.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f49.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F4A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f4a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F4B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f4b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F4C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f4c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F4D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f4d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F5D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f5d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F5E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f5e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F5F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f5f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F60.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f60.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F61.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f61.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F62.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f62.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F73.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f73.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F74.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f74.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F85.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f85.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F86.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f86.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F87.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f87.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F88.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f88.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F98.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f98.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F99.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f99.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F9A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f9a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F9B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f9b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F9C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f9c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F9D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f9d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F9E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f9e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7F9F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7f9f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7FA0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7fa0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7FB1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7fb1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7FB2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7fb2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7FB3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7fb3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7FB4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7fb4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7FB5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7fb5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7FB6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7fb6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7FC7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7fc7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7FC8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7fc8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7FD8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7fd8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7FD9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7fd9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7FDA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7fda.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7FDB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7fdb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7FEC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7fec.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7FED.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7fed.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7FEE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7fee.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7FEF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7fef.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\7FF0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\7ff0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8000.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8000.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8001.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8001.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8002.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8002.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8003.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8003.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8004.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8004.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8015.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8015.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8016.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8016.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8017.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8017.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8018.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8018.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8019.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8019.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\802A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\802a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\802B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\802b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\802C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\802c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\802D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\802d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\803D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\803d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\803E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\803e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\803F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\803f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8040.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8040.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8041.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8041.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8052.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8052.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8053.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8053.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8054.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8054.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8055.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8055.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8066.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8066.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8067.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8067.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8068.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8068.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8069.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8069.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\806A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\806a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\807A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\807a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\807B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\807b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\807C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\807c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\807D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\807d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\807E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\807e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\807F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\807f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8090.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8090.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8091.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8091.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8092.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8092.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8093.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8093.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8094.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8094.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8095.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8095.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80A5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80a5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80A6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80a6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80A7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80a7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80A8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80a8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80A9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80a9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80BA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80ba.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80BB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80bb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80BC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80bc.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80BD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80bd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80BE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80be.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80BF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80bf.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80D0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80d0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80D1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80d1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80D2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80d2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80D3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80d3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80D4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80d4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80D5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80d5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80E5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80e5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80E6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80e6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80E7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80e7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80E8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80e8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80E9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80e9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80FA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80fa.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80FB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80fb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80FC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80fc.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80FD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80fd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80FE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80fe.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\80FF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\80ff.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8110.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8110.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8111.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8111.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8112.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8112.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8113.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8113.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8123.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8123.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8124.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8124.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8125.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8125.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8126.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8126.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8127.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8127.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8128.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8128.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8139.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8139.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\813A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\813a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\813B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\813b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\813C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\813c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\813D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\813d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\814D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\814d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\814E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\814e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\814F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\814f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8150.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8150.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8151.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8151.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8152.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8152.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8163.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8163.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8164.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8164.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8165.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8165.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8166.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8166.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8167.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8167.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8178.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8178.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8179.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8179.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\817A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\817a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\817B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\817b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\818B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\818b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\818C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\818c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\818D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\818d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\818E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\818e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\819F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\819f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81A0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81a0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81A1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81a1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81A2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81a2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81A3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81a3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81A4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81a4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81B5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81b5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81B6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81b6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81B7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81b7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81B8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81b8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81B9.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81b9.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81BA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81ba.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81CA.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81ca.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81CB.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81cb.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81CC.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81cc.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81CD.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81cd.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81CE.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81ce.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81DF.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81df.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81E0.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81e0.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81E1.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81e1.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81E2.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81e2.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81E3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81e3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81F3.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81f3.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81F4.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81f4.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81F5.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81f5.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81F6.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81f6.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81F7.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81f7.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\81F8.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\81f8.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8209.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8209.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\820A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\820a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\820B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\820b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\820C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\820c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\820D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\820d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\820E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\820e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\821F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\821f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8220.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8220.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8221.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8221.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8222.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8222.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8223.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8223.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8224.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8224.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8225.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8225.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8235.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8235.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8236.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8236.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8237.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8237.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8238.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8238.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8239.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8239.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\823A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\823a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\824B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\824b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\824C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\824c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\824D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\824d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\824E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\824e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\825F.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\825f.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8260.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8260.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8261.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8261.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8262.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8262.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8263.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8263.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8264.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8264.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8274.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8274.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8275.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8275.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8276.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8276.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8277.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8277.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8278.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8278.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\8279.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\8279.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\828A.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\828a.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\828B.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\828b.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\828C.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\828c.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\828D.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\828d.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\828E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\828e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 }, { "filename": "C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\829E.tmp", "hashes": [], "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\829e.tmp", "operations": [ "write", "access" ], "type": "file_artifact", "version": 1 } ], "ips": [ { "ip_address": "208.67.222.222", "type": "ip_address_artifact", "version": 1 }, { "ip_address": "127.0.0.1", "type": "ip_address_artifact", "version": 1 }, { "ip_address": "193.23.244.244", "type": "ip_address_artifact", "version": 1 }, { "ip_address": "18.0.0.1", "type": "ip_address_artifact", "version": 1 } ], "mutexes": [ { "mutex_name": "{BB8A49DA-DE80-A5F2-C01F-F2A9F4C346ED}", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 }, { "mutex_name": "Local\\{14572DFD-6357-66D5-8D88-47FA113C6BCE}", "operations": [ "delete", "access" ], "type": "mutex_artifact", "version": 1 }, { "mutex_name": "Local\\{2EBE0010-B5EF-903D-AF42-B9C45396FD38}", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 }, { "mutex_name": "Local\\{CC210EB6-BBF2-DEC8-A5C0-1FF2A9F4C346}", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 }, { "mutex_name": "{0F90C438-223E-19A7-A4B3-765D18970AE1}", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 }, { "mutex_name": "Nameless", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 }, { "mutex_name": "{B3575357-76B9-5D62-1897-0AE1CCBBDEA5}", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 }, { "mutex_name": "{DB45C3D0-7EC1-C5FA-603F-92C994E3E60D}", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 }, { "mutex_name": "{BF4FAD76-121A-4972-1463-668D8847FA11}", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 }, { "mutex_name": "{2B1EAAC7-8E9D-9587-F08F-A2992433F6DD}", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 }, { "mutex_name": "{67DC9F31-9A2E-31AD-DC8B-6EF5D0EF82F9}", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 } ], "registry": [ { "operations": [ "access", "read" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows Script Host\\Settings", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows Script Host\\Settings", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_CLASSES_ROOT\\.WSF", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CLASSES_ROOT\\WSFFile\\ScriptEngine", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows Script\\Features", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\COM3", "type": "registry_artifact", "version": 1 }, { "operations": [ "write", "access" ], "reg_key_name": "HKEY_USERS\\S-1-5-21-1462094071-1423818996-289466292-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_USERS\\S-1-5-21-1462094071-1423818996-289466292-1000\\Software\\AppDataLow\\Software\\Microsoft\\07430283-BA24-D1EC-FC2B-8E95F08FA299", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_USERS", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_USERS\\S-1-5-21-1462094071-1423818996-289466292-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Policies\\Microsoft\\Windows\\System", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Command Processor", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\Command Processor", "type": "registry_artifact", "version": 1 }, { "operations": [ "write", "access", "read" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\AppDataLow\\Software\\Microsoft\\07430283-BA24-D1EC-FC2B-8E95F08FA299", "type": "registry_artifact", "version": 1 }, { "operations": [ "write", "access" ], "reg_key_name": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", "type": "registry_artifact", "version": 1 }, { "operations": [ "write", "access" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\AppDataLow\\Software\\Microsoft\\07430283-BA24-D1EC-FC2B-8E95F08FA299\\Files", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\AppDataLow\\Software\\Microsoft\\07430283-BA24-D1EC-FC2B-8E95F08FA299\\Run", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\AppDataLow\\Software\\Microsoft\\07430283-BA24-D1EC-FC2B-8E95F08FA299\\Config", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WAB\\DLLPath", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows Mail", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows Live Mail", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\", "type": "registry_artifact", "version": 1 }, { "operations": [ "read" ], "reg_key_name": "TreatAs", "type": "registry_artifact", "version": 1 }, { "operations": [ "read" ], "reg_key_name": "InprocHandler32", "type": "registry_artifact", "version": 1 }, { "operations": [ "read" ], "reg_key_name": "InprocHandler", "type": "registry_artifact", "version": 1 }, { "operations": [ "read" ], "reg_key_name": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender", "type": "registry_artifact", "version": 1 }, { "operations": [ "read" ], "reg_key_name": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-time Protection", "type": "registry_artifact", "version": 1 }, { "operations": [ "read" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Notifications\\Settings\\Windows.SystemToast.SecurityAndMaintenance", "type": "registry_artifact", "version": 1 }, { "operations": [ "read" ], "reg_key_name": "HKEY_CLASSES_ROOT\\AppUserModelId\\Windows.SystemToast.SecurityAndMaintenance", "type": "registry_artifact", "version": 1 }, { "operations": [ "read" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Notifications\\Current\\\\Windows.SystemToast.SecurityAndMaintenance\\195", "type": "registry_artifact", "version": 1 }, { "operations": [ "read" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Notifications\\Current\\\\Windows.SystemToast.SecurityAndMaintenance\\196", "type": "registry_artifact", "version": 1 }, { "operations": [ "read" ], "reg_key_name": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows", "type": "registry_artifact", "version": 1 }, { "operations": [ "read" ], "reg_key_name": "HKEY_CURRENT_USER\\Control Panel\\Desktop", "type": "registry_artifact", "version": 1 }, { "operations": [ "read" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Search", "type": "registry_artifact", "version": 1 }, { "operations": [ "read" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\GameDVR", "type": "registry_artifact", "version": 1 }, { "operations": [ "read" ], "reg_key_name": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace", "type": "registry_artifact", "version": 1 }, { "operations": [ "read" ], "reg_key_name": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace", "type": "registry_artifact", "version": 1 }, { "operations": [ "read" ], "reg_key_name": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows Mail Setup", "type": "registry_artifact", "version": 1 }, { "operations": [ "access", "read" ], "reg_key_name": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Services\\Tcpip\\Parameters", "type": "registry_artifact", "version": 1 }, { "operations": [ "access" ], "reg_key_name": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows NT\\DNSClient", "type": "registry_artifact", "version": 1 }, { "operations": [ "read" ], "reg_key_name": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", "type": "registry_artifact", "version": 1 } ], "type": "artifacts", "urls": [ { "operations": "GET", "type": "url_artifact", "url": "https://www.atdrrtd.vs", "version": 1 }, { "operations": "GET", "type": "url_artifact", "url": "https://wsfxvers.ch/fdsffffjt.ico", "version": 1 }, { "operations": "GET", "type": "url_artifact", "url": "https://serfd.ch/fjgnt343.ico", "version": 1 }, { "operations": "GET", "type": "url_artifact", "url": "https://www.apapernotion.com/wp-includes/Text/ri.php", "version": 1 }, { "operations": "GET", "type": "url_artifact", "url": "titanliquor.ca/images/A/2.tif", "version": 1 } ], "version": 1 }, "extracted_files": [ { "archive_path": "extracted_files/33e0317a4da4cc10737f5ff54f010315a3b71867", "file_type": "created_file", "id": "file_2", "md5_hash": "f549977bce0051085abbe8d7728be589", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\84526935.scr", "sha1_hash": "33e0317a4da4cc10737f5ff54f010315a3b71867", "sha256_hash": "21610f6f3397058086f90d9e0f74ba524aeb69d788efca24f344327460532a58", "size": 490496, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_3", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f2d7.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_5", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f2d8.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_7", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f2e8.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_9", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f2f9.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_11", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f2fa.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_13", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f2fb.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_15", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f2fc.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_17", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f32c.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_19", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f33c.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_21", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f33d.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_23", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f33e.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_25", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f33f.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_27", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f350.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_29", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f351.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_31", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f381.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_33", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f382.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_35", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f383.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_37", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f384.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_39", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f385.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_41", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f396.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_43", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f397.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_45", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f398.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_47", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f399.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_49", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f39a.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_51", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f3d9.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_53", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f3da.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_55", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f3eb.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_57", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f3ec.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_59", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f3ed.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_61", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f3fd.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_63", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f41e.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_65", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f42e.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_67", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f42f.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_69", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f430.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_71", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f441.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_73", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f442.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_75", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f472.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_77", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f473.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_79", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f474.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_81", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f475.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_83", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f485.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_85", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f486.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_87", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f487.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_89", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f488.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_91", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f499.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_93", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4b9.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_95", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4ba.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_97", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4bb.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_99", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4cc.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_101", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4cd.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_103", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4ce.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_105", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4cf.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_107", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4df.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_109", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4e0.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_111", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4f1.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_113", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4f2.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_115", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4f3.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_117", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4f4.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_119", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4f5.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_121", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f506.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_123", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f507.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_125", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f508.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_127", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f509.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_129", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f50a.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_131", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f51a.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_133", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f51b.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_135", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f51c.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_137", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f53d.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_139", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f53e.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_141", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f53f.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_143", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f540.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_145", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f541.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_147", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f551.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_149", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f552.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_151", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f553.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_153", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f554.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_155", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f565.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_157", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f566.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_159", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f567.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_161", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f568.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_163", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f569.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_165", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f579.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_167", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f57a.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_169", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f57b.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_171", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f57c.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_173", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f58d.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_175", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f58e.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_177", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f58f.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_179", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f590.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_181", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5a1.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_183", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5a2.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_185", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5a3.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_187", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5b3.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_189", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5b4.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_191", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5b5.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_193", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5c6.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_195", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5c7.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_197", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5c8.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_199", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5d9.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_201", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5e9.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_203", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5ea.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_205", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5fb.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_207", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5fc.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_209", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5fd.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_211", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f60d.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_213", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f60e.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_215", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f60f.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_217", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f610.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_219", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f621.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_221", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f622.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_223", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f623.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_225", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f634.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_227", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f635.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_229", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f636.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_231", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f637.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_233", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f647.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_235", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f648.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_237", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f649.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_239", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6b8.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_241", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6c8.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_243", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6c9.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_245", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6da.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_247", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6db.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_249", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6dc.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_251", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6ed.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_253", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6ee.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_255", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6fe.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_257", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6ff.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_259", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f700.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_261", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f701.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_263", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f712.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_265", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f722.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_267", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f723.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_269", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f724.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_271", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f725.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_273", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f736.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_275", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f737.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_277", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f738.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_279", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f749.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_281", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f74a.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_283", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f75a.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_285", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f75b.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_287", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f75c.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_289", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f77d.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_291", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f77e.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_293", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f78e.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_295", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f78f.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_297", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f790.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_299", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f7a1.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_301", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f7b1.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_303", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f7c2.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_305", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f7c3.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_307", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f7d4.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_309", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f7d5.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_311", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f7e5.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_313", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f806.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_315", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f816.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_317", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f827.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_319", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f837.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_321", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f838.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_323", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f849.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_325", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f84a.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_327", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f84b.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_329", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f85c.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_331", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f86c.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_333", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f86d.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_335", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f89d.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_337", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f89e.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_339", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f89f.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_341", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f8cf.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_343", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f8e0.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_345", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f8f0.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_347", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f8f1.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_349", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f902.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_351", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f903.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_353", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f914.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_355", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f915.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_357", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f916.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_359", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f926.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_361", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f927.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_363", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f928.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_365", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f939.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_367", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f93a.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_369", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f94a.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_371", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f96b.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_373", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f96c.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_375", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f96d.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_377", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f98d.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_379", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f98e.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_381", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f99f.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_383", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9a0.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_385", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9c0.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_387", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9c1.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_389", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9c2.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_391", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9d2.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_393", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9d3.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_395", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9d4.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_397", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9e5.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_399", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9e6.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_401", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9f7.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_403", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa07.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_405", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa08.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_407", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa09.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_409", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa0a.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_411", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa1b.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_413", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa2c.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_415", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa2d.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_417", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa2e.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_419", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa3e.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_421", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa3f.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_423", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa50.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_425", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa51.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_427", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa52.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_429", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa62.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_431", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa63.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_433", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa74.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_435", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa85.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_437", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa86.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_439", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa96.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_441", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa97.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_443", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa98.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_445", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa99.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_447", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\faaa.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_449", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\faca.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_451", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\facb.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_453", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\facc.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_455", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\facd.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_457", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb4b.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_459", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb6b.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_461", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb6c.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_463", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb6d.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_465", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb7e.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_467", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb7f.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_469", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb90.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_471", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb91.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_473", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fba1.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_475", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fba2.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_477", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fba3.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_479", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbb4.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_481", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbb5.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_483", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbb6.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_485", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbb7.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_487", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbd7.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_489", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbd8.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_491", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbe9.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_493", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbea.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_495", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbeb.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_497", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbec.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_499", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbfc.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_501", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbfd.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_503", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbfe.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_505", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc0f.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_507", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc10.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_509", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc11.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_511", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc22.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/da39a3ee5e6b4b0d3255bfef95601890afd80709", "file_type": "created_file", "id": "file_513", "md5_hash": "d41d8cd98f00b204e9800998ecf8427e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc23.tmp", "sha1_hash": "da39a3ee5e6b4b0d3255bfef95601890afd80709", "sha256_hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "size": 0, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b59526005703af82972679d96fc346768b4bfae8", "file_type": "created_file", "id": "file_4", "md5_hash": "ab28e0b612bc4ddf226676cd532c962d", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f2d7.tmp", "sha1_hash": "b59526005703af82972679d96fc346768b4bfae8", "sha256_hash": "60e9853af737363ea6439bee3a65a6683c9afdf1a87425e2e03c4b247e16534f", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b59526005703af82972679d96fc346768b4bfae8", "file_type": "created_file", "id": "file_6", "md5_hash": "ab28e0b612bc4ddf226676cd532c962d", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f2d8.tmp", "sha1_hash": "b59526005703af82972679d96fc346768b4bfae8", "sha256_hash": "60e9853af737363ea6439bee3a65a6683c9afdf1a87425e2e03c4b247e16534f", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4ccc4866976f7ec567851d7c90015a60fd7ccf2a", "file_type": "created_file", "id": "file_8", "md5_hash": "fd530f884ded068a1e9bd0ac2a1e36d8", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f2e8.tmp", "sha1_hash": "4ccc4866976f7ec567851d7c90015a60fd7ccf2a", "sha256_hash": "db674604dc1fe9df020558e69b3038c738c697231903aa596700ac18070ffe85", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/78a9aa849ec7e4dc62c0a1f49454d93c45aabfca", "file_type": "created_file", "id": "file_10", "md5_hash": "df400c07cdf87dea697f5313673f45da", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f2f9.tmp", "sha1_hash": "78a9aa849ec7e4dc62c0a1f49454d93c45aabfca", "sha256_hash": "da0800d82ed1c8d9d3a55ac2db30f1f9e27fdace3eb20f90926fcfbadc5a26f8", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/54af4a938d39230c512a88002c59cb74f0bc0d07", "file_type": "created_file", "id": "file_12", "md5_hash": "4721c4ad3b7ab96da65f5567ea559b3c", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f2fa.tmp", "sha1_hash": "54af4a938d39230c512a88002c59cb74f0bc0d07", "sha256_hash": "4240d971d7c5c08a44a34da39e4e65e50322fa79dfcc7c1904395409116280b7", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a277c6508628e442c5d51332f94b533596097639", "file_type": "created_file", "id": "file_14", "md5_hash": "a8a2dadf629bfbc4b37e71549b0305f3", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f2fb.tmp", "sha1_hash": "a277c6508628e442c5d51332f94b533596097639", "sha256_hash": "39e93984d5cd1d066156fd8694cede26f9c1cf87a1bcd93412a4adea1d435933", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a277c6508628e442c5d51332f94b533596097639", "file_type": "created_file", "id": "file_16", "md5_hash": "a8a2dadf629bfbc4b37e71549b0305f3", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f2fc.tmp", "sha1_hash": "a277c6508628e442c5d51332f94b533596097639", "sha256_hash": "39e93984d5cd1d066156fd8694cede26f9c1cf87a1bcd93412a4adea1d435933", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7027b22c141ed485279594918c8593af5e251aba", "file_type": "created_file", "id": "file_18", "md5_hash": "cf7f81d4b988308d3cd856a6b41bbc56", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f32c.tmp", "sha1_hash": "7027b22c141ed485279594918c8593af5e251aba", "sha256_hash": "b05fdcc590001a2ba4dc7ac6c86157b0f33767ca499f98e60d711e86c4351a7a", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4d7147388a576aeb70d0f8afb28cfc8461aca2af", "file_type": "created_file", "id": "file_20", "md5_hash": "37b7354ecaa8543098eb12c981ad4402", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f33c.tmp", "sha1_hash": "4d7147388a576aeb70d0f8afb28cfc8461aca2af", "sha256_hash": "4509324384f471a0043d8adb1b060297bbf35c6ced8275ed4c667bc78e21bb2c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4d7147388a576aeb70d0f8afb28cfc8461aca2af", "file_type": "created_file", "id": "file_22", "md5_hash": "37b7354ecaa8543098eb12c981ad4402", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f33d.tmp", "sha1_hash": "4d7147388a576aeb70d0f8afb28cfc8461aca2af", "sha256_hash": "4509324384f471a0043d8adb1b060297bbf35c6ced8275ed4c667bc78e21bb2c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4d7147388a576aeb70d0f8afb28cfc8461aca2af", "file_type": "created_file", "id": "file_24", "md5_hash": "37b7354ecaa8543098eb12c981ad4402", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f33e.tmp", "sha1_hash": "4d7147388a576aeb70d0f8afb28cfc8461aca2af", "sha256_hash": "4509324384f471a0043d8adb1b060297bbf35c6ced8275ed4c667bc78e21bb2c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4d7147388a576aeb70d0f8afb28cfc8461aca2af", "file_type": "created_file", "id": "file_26", "md5_hash": "37b7354ecaa8543098eb12c981ad4402", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f33f.tmp", "sha1_hash": "4d7147388a576aeb70d0f8afb28cfc8461aca2af", "sha256_hash": "4509324384f471a0043d8adb1b060297bbf35c6ced8275ed4c667bc78e21bb2c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/11ccbfeeeb88c1587a72cd8875ed8600a511aeec", "file_type": "created_file", "id": "file_28", "md5_hash": "6563b28cb7911859a2569c553f469639", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f350.tmp", "sha1_hash": "11ccbfeeeb88c1587a72cd8875ed8600a511aeec", "sha256_hash": "9c91d18494f82e9c8ec624330f428cfb6866396caff0b7ff09ed31f91be429f8", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/11ccbfeeeb88c1587a72cd8875ed8600a511aeec", "file_type": "created_file", "id": "file_30", "md5_hash": "6563b28cb7911859a2569c553f469639", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f351.tmp", "sha1_hash": "11ccbfeeeb88c1587a72cd8875ed8600a511aeec", "sha256_hash": "9c91d18494f82e9c8ec624330f428cfb6866396caff0b7ff09ed31f91be429f8", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f84633d25ea9b41c542644c0a381cb8457721ca2", "file_type": "created_file", "id": "file_32", "md5_hash": "103e0b8fd12bb07ef8961566a7765a55", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f381.tmp", "sha1_hash": "f84633d25ea9b41c542644c0a381cb8457721ca2", "sha256_hash": "b249383eaadc3cac29adbbd2b933929ed5d6054e781c28770961aecbc70d7974", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f84633d25ea9b41c542644c0a381cb8457721ca2", "file_type": "created_file", "id": "file_34", "md5_hash": "103e0b8fd12bb07ef8961566a7765a55", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f382.tmp", "sha1_hash": "f84633d25ea9b41c542644c0a381cb8457721ca2", "sha256_hash": "b249383eaadc3cac29adbbd2b933929ed5d6054e781c28770961aecbc70d7974", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f84633d25ea9b41c542644c0a381cb8457721ca2", "file_type": "created_file", "id": "file_36", "md5_hash": "103e0b8fd12bb07ef8961566a7765a55", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f383.tmp", "sha1_hash": "f84633d25ea9b41c542644c0a381cb8457721ca2", "sha256_hash": "b249383eaadc3cac29adbbd2b933929ed5d6054e781c28770961aecbc70d7974", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f84633d25ea9b41c542644c0a381cb8457721ca2", "file_type": "created_file", "id": "file_38", "md5_hash": "103e0b8fd12bb07ef8961566a7765a55", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f384.tmp", "sha1_hash": "f84633d25ea9b41c542644c0a381cb8457721ca2", "sha256_hash": "b249383eaadc3cac29adbbd2b933929ed5d6054e781c28770961aecbc70d7974", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f84633d25ea9b41c542644c0a381cb8457721ca2", "file_type": "created_file", "id": "file_40", "md5_hash": "103e0b8fd12bb07ef8961566a7765a55", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f385.tmp", "sha1_hash": "f84633d25ea9b41c542644c0a381cb8457721ca2", "sha256_hash": "b249383eaadc3cac29adbbd2b933929ed5d6054e781c28770961aecbc70d7974", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/041bcbffc817e9e86000ae0c3c77281280719268", "file_type": "created_file", "id": "file_42", "md5_hash": "375354fe68646f0128f6ab29e48869bd", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f396.tmp", "sha1_hash": "041bcbffc817e9e86000ae0c3c77281280719268", "sha256_hash": "5d393fd606d3ae2b4153699180cef6ad3c3f5aebe6cf05c43c109f7634949670", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/041bcbffc817e9e86000ae0c3c77281280719268", "file_type": "created_file", "id": "file_44", "md5_hash": "375354fe68646f0128f6ab29e48869bd", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f397.tmp", "sha1_hash": "041bcbffc817e9e86000ae0c3c77281280719268", "sha256_hash": "5d393fd606d3ae2b4153699180cef6ad3c3f5aebe6cf05c43c109f7634949670", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/041bcbffc817e9e86000ae0c3c77281280719268", "file_type": "created_file", "id": "file_46", "md5_hash": "375354fe68646f0128f6ab29e48869bd", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f398.tmp", "sha1_hash": "041bcbffc817e9e86000ae0c3c77281280719268", "sha256_hash": "5d393fd606d3ae2b4153699180cef6ad3c3f5aebe6cf05c43c109f7634949670", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/041bcbffc817e9e86000ae0c3c77281280719268", "file_type": "created_file", "id": "file_48", "md5_hash": "375354fe68646f0128f6ab29e48869bd", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f399.tmp", "sha1_hash": "041bcbffc817e9e86000ae0c3c77281280719268", "sha256_hash": "5d393fd606d3ae2b4153699180cef6ad3c3f5aebe6cf05c43c109f7634949670", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/041bcbffc817e9e86000ae0c3c77281280719268", "file_type": "created_file", "id": "file_50", "md5_hash": "375354fe68646f0128f6ab29e48869bd", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f39a.tmp", "sha1_hash": "041bcbffc817e9e86000ae0c3c77281280719268", "sha256_hash": "5d393fd606d3ae2b4153699180cef6ad3c3f5aebe6cf05c43c109f7634949670", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f1ba32861024ce89f2616150c71bd25a0be1097a", "file_type": "created_file", "id": "file_52", "md5_hash": "9914902ffd73d3d52944d5f02c990052", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f3d9.tmp", "sha1_hash": "f1ba32861024ce89f2616150c71bd25a0be1097a", "sha256_hash": "438e2d2f7eed159de5d7d589ba5188e73b43c5f47aa6d561169346ae1e3d1c05", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f1ba32861024ce89f2616150c71bd25a0be1097a", "file_type": "created_file", "id": "file_54", "md5_hash": "9914902ffd73d3d52944d5f02c990052", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f3da.tmp", "sha1_hash": "f1ba32861024ce89f2616150c71bd25a0be1097a", "sha256_hash": "438e2d2f7eed159de5d7d589ba5188e73b43c5f47aa6d561169346ae1e3d1c05", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e9542f012dcc2786e80130fd539129b7f7d6d553", "file_type": "created_file", "id": "file_56", "md5_hash": "2841502da02a6dc1929c6b679d2d952b", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f3eb.tmp", "sha1_hash": "e9542f012dcc2786e80130fd539129b7f7d6d553", "sha256_hash": "7faae97a81dfe6e3a19ab568d3c36e4b68df217f4c7f21ea4bc13c1e33b8e92c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e9542f012dcc2786e80130fd539129b7f7d6d553", "file_type": "created_file", "id": "file_58", "md5_hash": "2841502da02a6dc1929c6b679d2d952b", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f3ec.tmp", "sha1_hash": "e9542f012dcc2786e80130fd539129b7f7d6d553", "sha256_hash": "7faae97a81dfe6e3a19ab568d3c36e4b68df217f4c7f21ea4bc13c1e33b8e92c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e9542f012dcc2786e80130fd539129b7f7d6d553", "file_type": "created_file", "id": "file_60", "md5_hash": "2841502da02a6dc1929c6b679d2d952b", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f3ed.tmp", "sha1_hash": "e9542f012dcc2786e80130fd539129b7f7d6d553", "sha256_hash": "7faae97a81dfe6e3a19ab568d3c36e4b68df217f4c7f21ea4bc13c1e33b8e92c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/cb0dc4b48c5703356951c02485ad6fcea8f6bc96", "file_type": "created_file", "id": "file_62", "md5_hash": "14f8d6416125ae53432caacf7f85edcf", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f3fd.tmp", "sha1_hash": "cb0dc4b48c5703356951c02485ad6fcea8f6bc96", "sha256_hash": "22924b1e57cb5405ae74e97b9d7b20c90b31c6111067035a1072de62688e230e", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/158000124dbae9ab0a834a306a1f2e52ead8cedd", "file_type": "created_file", "id": "file_64", "md5_hash": "aa75d8a30aacd8184640a5bc63dd8add", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f41e.tmp", "sha1_hash": "158000124dbae9ab0a834a306a1f2e52ead8cedd", "sha256_hash": "c20f0cc73e42057066194ead502dee19fe7b65238890cc6ea3eca658d96ea018", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ebeb1642dad077201aab5cd2566c8f34b0a3b604", "file_type": "created_file", "id": "file_66", "md5_hash": "684c21c6a46af124447bdb10f9c4de69", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f42e.tmp", "sha1_hash": "ebeb1642dad077201aab5cd2566c8f34b0a3b604", "sha256_hash": "a7c626455caeb41a1a6db61c703e08eb645ad45d2d84587ed95e25a1dccf756d", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ebeb1642dad077201aab5cd2566c8f34b0a3b604", "file_type": "created_file", "id": "file_68", "md5_hash": "684c21c6a46af124447bdb10f9c4de69", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f42f.tmp", "sha1_hash": "ebeb1642dad077201aab5cd2566c8f34b0a3b604", "sha256_hash": "a7c626455caeb41a1a6db61c703e08eb645ad45d2d84587ed95e25a1dccf756d", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ebeb1642dad077201aab5cd2566c8f34b0a3b604", "file_type": "created_file", "id": "file_70", "md5_hash": "684c21c6a46af124447bdb10f9c4de69", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f430.tmp", "sha1_hash": "ebeb1642dad077201aab5cd2566c8f34b0a3b604", "sha256_hash": "a7c626455caeb41a1a6db61c703e08eb645ad45d2d84587ed95e25a1dccf756d", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/39cce3420bf79b006df70fad5bd4bd25a4ed2354", "file_type": "created_file", "id": "file_72", "md5_hash": "18ccd98a45f94ad63b8f2751d5c64f47", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f441.tmp", "sha1_hash": "39cce3420bf79b006df70fad5bd4bd25a4ed2354", "sha256_hash": "2a020923b05677c27a82d2e6b8a3e4385827616724b78702394d76b0a03a3841", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/39cce3420bf79b006df70fad5bd4bd25a4ed2354", "file_type": "created_file", "id": "file_74", "md5_hash": "18ccd98a45f94ad63b8f2751d5c64f47", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f442.tmp", "sha1_hash": "39cce3420bf79b006df70fad5bd4bd25a4ed2354", "sha256_hash": "2a020923b05677c27a82d2e6b8a3e4385827616724b78702394d76b0a03a3841", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/452bdea5a923e770304174c86876749ad68736e5", "file_type": "created_file", "id": "file_76", "md5_hash": "0fe5a713f286f220c91a08b30542ae0f", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f472.tmp", "sha1_hash": "452bdea5a923e770304174c86876749ad68736e5", "sha256_hash": "8123adf3394eb1db518c72de323441ab548b3ab30b9d3844102c1723c94d2f83", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/452bdea5a923e770304174c86876749ad68736e5", "file_type": "created_file", "id": "file_78", "md5_hash": "0fe5a713f286f220c91a08b30542ae0f", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f473.tmp", "sha1_hash": "452bdea5a923e770304174c86876749ad68736e5", "sha256_hash": "8123adf3394eb1db518c72de323441ab548b3ab30b9d3844102c1723c94d2f83", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/452bdea5a923e770304174c86876749ad68736e5", "file_type": "created_file", "id": "file_80", "md5_hash": "0fe5a713f286f220c91a08b30542ae0f", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f474.tmp", "sha1_hash": "452bdea5a923e770304174c86876749ad68736e5", "sha256_hash": "8123adf3394eb1db518c72de323441ab548b3ab30b9d3844102c1723c94d2f83", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/452bdea5a923e770304174c86876749ad68736e5", "file_type": "created_file", "id": "file_82", "md5_hash": "0fe5a713f286f220c91a08b30542ae0f", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f475.tmp", "sha1_hash": "452bdea5a923e770304174c86876749ad68736e5", "sha256_hash": "8123adf3394eb1db518c72de323441ab548b3ab30b9d3844102c1723c94d2f83", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3ac8c45455eaec9ee64251ecece9f70481af4b21", "file_type": "created_file", "id": "file_84", "md5_hash": "e102f4f45076f59380e7c6d844d55c39", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f485.tmp", "sha1_hash": "3ac8c45455eaec9ee64251ecece9f70481af4b21", "sha256_hash": "7822a8a931d8d38d67968a64e969ab18e9369a8d0b3fadbfd0018add463b0dd9", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3ac8c45455eaec9ee64251ecece9f70481af4b21", "file_type": "created_file", "id": "file_86", "md5_hash": "e102f4f45076f59380e7c6d844d55c39", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f486.tmp", "sha1_hash": "3ac8c45455eaec9ee64251ecece9f70481af4b21", "sha256_hash": "7822a8a931d8d38d67968a64e969ab18e9369a8d0b3fadbfd0018add463b0dd9", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3ac8c45455eaec9ee64251ecece9f70481af4b21", "file_type": "created_file", "id": "file_88", "md5_hash": "e102f4f45076f59380e7c6d844d55c39", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f487.tmp", "sha1_hash": "3ac8c45455eaec9ee64251ecece9f70481af4b21", "sha256_hash": "7822a8a931d8d38d67968a64e969ab18e9369a8d0b3fadbfd0018add463b0dd9", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3ac8c45455eaec9ee64251ecece9f70481af4b21", "file_type": "created_file", "id": "file_90", "md5_hash": "e102f4f45076f59380e7c6d844d55c39", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f488.tmp", "sha1_hash": "3ac8c45455eaec9ee64251ecece9f70481af4b21", "sha256_hash": "7822a8a931d8d38d67968a64e969ab18e9369a8d0b3fadbfd0018add463b0dd9", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/be8269c4c4929b4f35d057725d122d17805716b9", "file_type": "created_file", "id": "file_92", "md5_hash": "9884e4f00c2714eeebf230e5b40e9480", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f499.tmp", "sha1_hash": "be8269c4c4929b4f35d057725d122d17805716b9", "sha256_hash": "f42fda1c199b447e1d1e4008eb7897c4ca4ecf3a2f7fdea829b9c35e6e044458", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f2173b4759317545d5f81a88982aa637099de5b6", "file_type": "created_file", "id": "file_94", "md5_hash": "b9fbcebb04b9f7e4d3f07b023a0229fd", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4b9.tmp", "sha1_hash": "f2173b4759317545d5f81a88982aa637099de5b6", "sha256_hash": "359c38c6582afda6a9913c1f4870e5e35e47a1f8d6959dea71abb2b94b094476", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f2173b4759317545d5f81a88982aa637099de5b6", "file_type": "created_file", "id": "file_96", "md5_hash": "b9fbcebb04b9f7e4d3f07b023a0229fd", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4ba.tmp", "sha1_hash": "f2173b4759317545d5f81a88982aa637099de5b6", "sha256_hash": "359c38c6582afda6a9913c1f4870e5e35e47a1f8d6959dea71abb2b94b094476", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f2173b4759317545d5f81a88982aa637099de5b6", "file_type": "created_file", "id": "file_98", "md5_hash": "b9fbcebb04b9f7e4d3f07b023a0229fd", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4bb.tmp", "sha1_hash": "f2173b4759317545d5f81a88982aa637099de5b6", "sha256_hash": "359c38c6582afda6a9913c1f4870e5e35e47a1f8d6959dea71abb2b94b094476", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c7e08e3a085493db3cb9df920890015bda11cc50", "file_type": "created_file", "id": "file_100", "md5_hash": "b3574d66d7c98d6f82168937555180f2", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4cc.tmp", "sha1_hash": "c7e08e3a085493db3cb9df920890015bda11cc50", "sha256_hash": "8544a403db6bc12357c9d122731239fb5101b1949bdfe09ffe6dbfeebcc73919", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c7e08e3a085493db3cb9df920890015bda11cc50", "file_type": "created_file", "id": "file_102", "md5_hash": "b3574d66d7c98d6f82168937555180f2", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4cd.tmp", "sha1_hash": "c7e08e3a085493db3cb9df920890015bda11cc50", "sha256_hash": "8544a403db6bc12357c9d122731239fb5101b1949bdfe09ffe6dbfeebcc73919", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c7e08e3a085493db3cb9df920890015bda11cc50", "file_type": "created_file", "id": "file_104", "md5_hash": "b3574d66d7c98d6f82168937555180f2", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4ce.tmp", "sha1_hash": "c7e08e3a085493db3cb9df920890015bda11cc50", "sha256_hash": "8544a403db6bc12357c9d122731239fb5101b1949bdfe09ffe6dbfeebcc73919", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c7e08e3a085493db3cb9df920890015bda11cc50", "file_type": "created_file", "id": "file_106", "md5_hash": "b3574d66d7c98d6f82168937555180f2", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4cf.tmp", "sha1_hash": "c7e08e3a085493db3cb9df920890015bda11cc50", "sha256_hash": "8544a403db6bc12357c9d122731239fb5101b1949bdfe09ffe6dbfeebcc73919", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/6bdb6c1b524e52bc373739e7022ee164a7b63086", "file_type": "created_file", "id": "file_108", "md5_hash": "426861378070228083370ab1716f5d34", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4df.tmp", "sha1_hash": "6bdb6c1b524e52bc373739e7022ee164a7b63086", "sha256_hash": "c371441da18d02cf86e7de5a784754e94b67f74f69012029901896b081d114d2", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/6bdb6c1b524e52bc373739e7022ee164a7b63086", "file_type": "created_file", "id": "file_110", "md5_hash": "426861378070228083370ab1716f5d34", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4e0.tmp", "sha1_hash": "6bdb6c1b524e52bc373739e7022ee164a7b63086", "sha256_hash": "c371441da18d02cf86e7de5a784754e94b67f74f69012029901896b081d114d2", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/cb22abc76e59b8fd55b756731f2942b02a50d765", "file_type": "created_file", "id": "file_112", "md5_hash": "8c63a5d8e82e6edd83997890130d40c7", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4f1.tmp", "sha1_hash": "cb22abc76e59b8fd55b756731f2942b02a50d765", "sha256_hash": "854926af3596aa48c171f2877729389f90de5d6add7a00334444d67683c510d6", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/cb22abc76e59b8fd55b756731f2942b02a50d765", "file_type": "created_file", "id": "file_114", "md5_hash": "8c63a5d8e82e6edd83997890130d40c7", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4f2.tmp", "sha1_hash": "cb22abc76e59b8fd55b756731f2942b02a50d765", "sha256_hash": "854926af3596aa48c171f2877729389f90de5d6add7a00334444d67683c510d6", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/cb22abc76e59b8fd55b756731f2942b02a50d765", "file_type": "created_file", "id": "file_116", "md5_hash": "8c63a5d8e82e6edd83997890130d40c7", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4f3.tmp", "sha1_hash": "cb22abc76e59b8fd55b756731f2942b02a50d765", "sha256_hash": "854926af3596aa48c171f2877729389f90de5d6add7a00334444d67683c510d6", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/cb22abc76e59b8fd55b756731f2942b02a50d765", "file_type": "created_file", "id": "file_118", "md5_hash": "8c63a5d8e82e6edd83997890130d40c7", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4f4.tmp", "sha1_hash": "cb22abc76e59b8fd55b756731f2942b02a50d765", "sha256_hash": "854926af3596aa48c171f2877729389f90de5d6add7a00334444d67683c510d6", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/cb22abc76e59b8fd55b756731f2942b02a50d765", "file_type": "created_file", "id": "file_120", "md5_hash": "8c63a5d8e82e6edd83997890130d40c7", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f4f5.tmp", "sha1_hash": "cb22abc76e59b8fd55b756731f2942b02a50d765", "sha256_hash": "854926af3596aa48c171f2877729389f90de5d6add7a00334444d67683c510d6", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3ddcbdc4fe23523efffc6cd03757955809caa83f", "file_type": "created_file", "id": "file_122", "md5_hash": "c753a995dd61c55c0ce9d9d0c996ed8a", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f506.tmp", "sha1_hash": "3ddcbdc4fe23523efffc6cd03757955809caa83f", "sha256_hash": "d0750b1dbe19dff3d69c999b47a93a5cf6b79c4e776579d6372394b6c22b4226", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3ddcbdc4fe23523efffc6cd03757955809caa83f", "file_type": "created_file", "id": "file_124", "md5_hash": "c753a995dd61c55c0ce9d9d0c996ed8a", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f507.tmp", "sha1_hash": "3ddcbdc4fe23523efffc6cd03757955809caa83f", "sha256_hash": "d0750b1dbe19dff3d69c999b47a93a5cf6b79c4e776579d6372394b6c22b4226", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3ddcbdc4fe23523efffc6cd03757955809caa83f", "file_type": "created_file", "id": "file_126", "md5_hash": "c753a995dd61c55c0ce9d9d0c996ed8a", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f508.tmp", "sha1_hash": "3ddcbdc4fe23523efffc6cd03757955809caa83f", "sha256_hash": "d0750b1dbe19dff3d69c999b47a93a5cf6b79c4e776579d6372394b6c22b4226", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3ddcbdc4fe23523efffc6cd03757955809caa83f", "file_type": "created_file", "id": "file_128", "md5_hash": "c753a995dd61c55c0ce9d9d0c996ed8a", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f509.tmp", "sha1_hash": "3ddcbdc4fe23523efffc6cd03757955809caa83f", "sha256_hash": "d0750b1dbe19dff3d69c999b47a93a5cf6b79c4e776579d6372394b6c22b4226", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3ddcbdc4fe23523efffc6cd03757955809caa83f", "file_type": "created_file", "id": "file_130", "md5_hash": "c753a995dd61c55c0ce9d9d0c996ed8a", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f50a.tmp", "sha1_hash": "3ddcbdc4fe23523efffc6cd03757955809caa83f", "sha256_hash": "d0750b1dbe19dff3d69c999b47a93a5cf6b79c4e776579d6372394b6c22b4226", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ec9e7a1edd0c96c7522983fc4d03bfe30a7446a5", "file_type": "created_file", "id": "file_132", "md5_hash": "a3894421dceb69d0f1ad369951902696", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f51a.tmp", "sha1_hash": "ec9e7a1edd0c96c7522983fc4d03bfe30a7446a5", "sha256_hash": "16d20f692fc19048728ae91e65e8c6e1e260af1e71617b19192047fd64ea981e", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ec9e7a1edd0c96c7522983fc4d03bfe30a7446a5", "file_type": "created_file", "id": "file_134", "md5_hash": "a3894421dceb69d0f1ad369951902696", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f51b.tmp", "sha1_hash": "ec9e7a1edd0c96c7522983fc4d03bfe30a7446a5", "sha256_hash": "16d20f692fc19048728ae91e65e8c6e1e260af1e71617b19192047fd64ea981e", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ec9e7a1edd0c96c7522983fc4d03bfe30a7446a5", "file_type": "created_file", "id": "file_136", "md5_hash": "a3894421dceb69d0f1ad369951902696", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f51c.tmp", "sha1_hash": "ec9e7a1edd0c96c7522983fc4d03bfe30a7446a5", "sha256_hash": "16d20f692fc19048728ae91e65e8c6e1e260af1e71617b19192047fd64ea981e", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0a6d1315f79a81a81ff0baebe5a096255566bab0", "file_type": "created_file", "id": "file_138", "md5_hash": "7d1c896adc01c20ba38921c393cf3bf5", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f53d.tmp", "sha1_hash": "0a6d1315f79a81a81ff0baebe5a096255566bab0", "sha256_hash": "4655b8389012aa3c527d58ae9ca214ca5ed4cdfbf378bcd6fe1a04b3b53e85ca", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0a6d1315f79a81a81ff0baebe5a096255566bab0", "file_type": "created_file", "id": "file_140", "md5_hash": "7d1c896adc01c20ba38921c393cf3bf5", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f53e.tmp", "sha1_hash": "0a6d1315f79a81a81ff0baebe5a096255566bab0", "sha256_hash": "4655b8389012aa3c527d58ae9ca214ca5ed4cdfbf378bcd6fe1a04b3b53e85ca", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0a6d1315f79a81a81ff0baebe5a096255566bab0", "file_type": "created_file", "id": "file_142", "md5_hash": "7d1c896adc01c20ba38921c393cf3bf5", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f53f.tmp", "sha1_hash": "0a6d1315f79a81a81ff0baebe5a096255566bab0", "sha256_hash": "4655b8389012aa3c527d58ae9ca214ca5ed4cdfbf378bcd6fe1a04b3b53e85ca", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0a6d1315f79a81a81ff0baebe5a096255566bab0", "file_type": "created_file", "id": "file_144", "md5_hash": "7d1c896adc01c20ba38921c393cf3bf5", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f540.tmp", "sha1_hash": "0a6d1315f79a81a81ff0baebe5a096255566bab0", "sha256_hash": "4655b8389012aa3c527d58ae9ca214ca5ed4cdfbf378bcd6fe1a04b3b53e85ca", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0a6d1315f79a81a81ff0baebe5a096255566bab0", "file_type": "created_file", "id": "file_146", "md5_hash": "7d1c896adc01c20ba38921c393cf3bf5", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f541.tmp", "sha1_hash": "0a6d1315f79a81a81ff0baebe5a096255566bab0", "sha256_hash": "4655b8389012aa3c527d58ae9ca214ca5ed4cdfbf378bcd6fe1a04b3b53e85ca", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f7cd0536d3e7f06fa69d9d2445911a3048a59c29", "file_type": "created_file", "id": "file_148", "md5_hash": "4a0b19c62039f27899009aabbdf4770d", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f551.tmp", "sha1_hash": "f7cd0536d3e7f06fa69d9d2445911a3048a59c29", "sha256_hash": "7567e47e4a26c271f09bf78392cd1a89f48c9803f8393306761911ebb53f032c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f7cd0536d3e7f06fa69d9d2445911a3048a59c29", "file_type": "created_file", "id": "file_150", "md5_hash": "4a0b19c62039f27899009aabbdf4770d", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f552.tmp", "sha1_hash": "f7cd0536d3e7f06fa69d9d2445911a3048a59c29", "sha256_hash": "7567e47e4a26c271f09bf78392cd1a89f48c9803f8393306761911ebb53f032c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f7cd0536d3e7f06fa69d9d2445911a3048a59c29", "file_type": "created_file", "id": "file_152", "md5_hash": "4a0b19c62039f27899009aabbdf4770d", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f553.tmp", "sha1_hash": "f7cd0536d3e7f06fa69d9d2445911a3048a59c29", "sha256_hash": "7567e47e4a26c271f09bf78392cd1a89f48c9803f8393306761911ebb53f032c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f7cd0536d3e7f06fa69d9d2445911a3048a59c29", "file_type": "created_file", "id": "file_154", "md5_hash": "4a0b19c62039f27899009aabbdf4770d", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f554.tmp", "sha1_hash": "f7cd0536d3e7f06fa69d9d2445911a3048a59c29", "sha256_hash": "7567e47e4a26c271f09bf78392cd1a89f48c9803f8393306761911ebb53f032c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/03ecd7fa3b32daf89555f179195c5c4ea2eea2d9", "file_type": "created_file", "id": "file_156", "md5_hash": "23b161ac199d8c597729dbdb84b9c077", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f565.tmp", "sha1_hash": "03ecd7fa3b32daf89555f179195c5c4ea2eea2d9", "sha256_hash": "c7624be02d1c2cb148ab1636771aebeb4cbb4eaa771e63c14b6433a1ee5b33c4", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/03ecd7fa3b32daf89555f179195c5c4ea2eea2d9", "file_type": "created_file", "id": "file_158", "md5_hash": "23b161ac199d8c597729dbdb84b9c077", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f566.tmp", "sha1_hash": "03ecd7fa3b32daf89555f179195c5c4ea2eea2d9", "sha256_hash": "c7624be02d1c2cb148ab1636771aebeb4cbb4eaa771e63c14b6433a1ee5b33c4", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/03ecd7fa3b32daf89555f179195c5c4ea2eea2d9", "file_type": "created_file", "id": "file_160", "md5_hash": "23b161ac199d8c597729dbdb84b9c077", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f567.tmp", "sha1_hash": "03ecd7fa3b32daf89555f179195c5c4ea2eea2d9", "sha256_hash": "c7624be02d1c2cb148ab1636771aebeb4cbb4eaa771e63c14b6433a1ee5b33c4", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/03ecd7fa3b32daf89555f179195c5c4ea2eea2d9", "file_type": "created_file", "id": "file_162", "md5_hash": "23b161ac199d8c597729dbdb84b9c077", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f568.tmp", "sha1_hash": "03ecd7fa3b32daf89555f179195c5c4ea2eea2d9", "sha256_hash": "c7624be02d1c2cb148ab1636771aebeb4cbb4eaa771e63c14b6433a1ee5b33c4", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/03ecd7fa3b32daf89555f179195c5c4ea2eea2d9", "file_type": "created_file", "id": "file_164", "md5_hash": "23b161ac199d8c597729dbdb84b9c077", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f569.tmp", "sha1_hash": "03ecd7fa3b32daf89555f179195c5c4ea2eea2d9", "sha256_hash": "c7624be02d1c2cb148ab1636771aebeb4cbb4eaa771e63c14b6433a1ee5b33c4", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b0310d8410d972e6653160557a61c3740a392da7", "file_type": "created_file", "id": "file_166", "md5_hash": "6c2e843da5e5c4585641c3e39a20d0b5", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f579.tmp", "sha1_hash": "b0310d8410d972e6653160557a61c3740a392da7", "sha256_hash": "f8f41e0bf9b26685f9f49a646407fda564b61f98fbfc46499113ebfaf04ca409", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b0310d8410d972e6653160557a61c3740a392da7", "file_type": "created_file", "id": "file_168", "md5_hash": "6c2e843da5e5c4585641c3e39a20d0b5", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f57a.tmp", "sha1_hash": "b0310d8410d972e6653160557a61c3740a392da7", "sha256_hash": "f8f41e0bf9b26685f9f49a646407fda564b61f98fbfc46499113ebfaf04ca409", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b0310d8410d972e6653160557a61c3740a392da7", "file_type": "created_file", "id": "file_170", "md5_hash": "6c2e843da5e5c4585641c3e39a20d0b5", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f57b.tmp", "sha1_hash": "b0310d8410d972e6653160557a61c3740a392da7", "sha256_hash": "f8f41e0bf9b26685f9f49a646407fda564b61f98fbfc46499113ebfaf04ca409", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b0310d8410d972e6653160557a61c3740a392da7", "file_type": "created_file", "id": "file_172", "md5_hash": "6c2e843da5e5c4585641c3e39a20d0b5", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f57c.tmp", "sha1_hash": "b0310d8410d972e6653160557a61c3740a392da7", "sha256_hash": "f8f41e0bf9b26685f9f49a646407fda564b61f98fbfc46499113ebfaf04ca409", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9b8b4271cd9764a98008263488ebde8bf9a0e68b", "file_type": "created_file", "id": "file_174", "md5_hash": "82a4d57805e2c28295c1b84376ec3403", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f58d.tmp", "sha1_hash": "9b8b4271cd9764a98008263488ebde8bf9a0e68b", "sha256_hash": "3de59a36c317e7c0fae4c4aec2d5631570bee33aa9253993883c14fb2da50bcf", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9b8b4271cd9764a98008263488ebde8bf9a0e68b", "file_type": "created_file", "id": "file_176", "md5_hash": "82a4d57805e2c28295c1b84376ec3403", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f58e.tmp", "sha1_hash": "9b8b4271cd9764a98008263488ebde8bf9a0e68b", "sha256_hash": "3de59a36c317e7c0fae4c4aec2d5631570bee33aa9253993883c14fb2da50bcf", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9b8b4271cd9764a98008263488ebde8bf9a0e68b", "file_type": "created_file", "id": "file_178", "md5_hash": "82a4d57805e2c28295c1b84376ec3403", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f58f.tmp", "sha1_hash": "9b8b4271cd9764a98008263488ebde8bf9a0e68b", "sha256_hash": "3de59a36c317e7c0fae4c4aec2d5631570bee33aa9253993883c14fb2da50bcf", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/9b8b4271cd9764a98008263488ebde8bf9a0e68b", "file_type": "created_file", "id": "file_180", "md5_hash": "82a4d57805e2c28295c1b84376ec3403", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f590.tmp", "sha1_hash": "9b8b4271cd9764a98008263488ebde8bf9a0e68b", "sha256_hash": "3de59a36c317e7c0fae4c4aec2d5631570bee33aa9253993883c14fb2da50bcf", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/03448f68180ca7416d9353e9c8430b8188253396", "file_type": "created_file", "id": "file_182", "md5_hash": "65bd4174941856c5365044693e566c11", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5a1.tmp", "sha1_hash": "03448f68180ca7416d9353e9c8430b8188253396", "sha256_hash": "f36f82223a4a106163c74c0ad620c3047d3cc2cdc0e232801e223e95381d309c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/03448f68180ca7416d9353e9c8430b8188253396", "file_type": "created_file", "id": "file_184", "md5_hash": "65bd4174941856c5365044693e566c11", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5a2.tmp", "sha1_hash": "03448f68180ca7416d9353e9c8430b8188253396", "sha256_hash": "f36f82223a4a106163c74c0ad620c3047d3cc2cdc0e232801e223e95381d309c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/03448f68180ca7416d9353e9c8430b8188253396", "file_type": "created_file", "id": "file_186", "md5_hash": "65bd4174941856c5365044693e566c11", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5a3.tmp", "sha1_hash": "03448f68180ca7416d9353e9c8430b8188253396", "sha256_hash": "f36f82223a4a106163c74c0ad620c3047d3cc2cdc0e232801e223e95381d309c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/836254f5cbc625d36dcdc47b8574c639efe502ee", "file_type": "created_file", "id": "file_188", "md5_hash": "909c4777c9d2ceee9731b841043461e7", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5b3.tmp", "sha1_hash": "836254f5cbc625d36dcdc47b8574c639efe502ee", "sha256_hash": "5642676307f1b769c607971b10c0cfa559892ae103fe09d5ea636dd2e7d9d01f", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/836254f5cbc625d36dcdc47b8574c639efe502ee", "file_type": "created_file", "id": "file_190", "md5_hash": "909c4777c9d2ceee9731b841043461e7", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5b4.tmp", "sha1_hash": "836254f5cbc625d36dcdc47b8574c639efe502ee", "sha256_hash": "5642676307f1b769c607971b10c0cfa559892ae103fe09d5ea636dd2e7d9d01f", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/836254f5cbc625d36dcdc47b8574c639efe502ee", "file_type": "created_file", "id": "file_192", "md5_hash": "909c4777c9d2ceee9731b841043461e7", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5b5.tmp", "sha1_hash": "836254f5cbc625d36dcdc47b8574c639efe502ee", "sha256_hash": "5642676307f1b769c607971b10c0cfa559892ae103fe09d5ea636dd2e7d9d01f", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/bb0f1154d13a8eb32ab2ea618c6b387761bdf2c7", "file_type": "created_file", "id": "file_194", "md5_hash": "dac45c31e753c98cdfbb9a51edfb4ed1", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5c6.tmp", "sha1_hash": "bb0f1154d13a8eb32ab2ea618c6b387761bdf2c7", "sha256_hash": "fa5f036fda7fcdfeb8aa05db8ff3ac6b531c448f81eb24a4f57df9709054c5ec", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/bb0f1154d13a8eb32ab2ea618c6b387761bdf2c7", "file_type": "created_file", "id": "file_196", "md5_hash": "dac45c31e753c98cdfbb9a51edfb4ed1", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5c7.tmp", "sha1_hash": "bb0f1154d13a8eb32ab2ea618c6b387761bdf2c7", "sha256_hash": "fa5f036fda7fcdfeb8aa05db8ff3ac6b531c448f81eb24a4f57df9709054c5ec", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/bb0f1154d13a8eb32ab2ea618c6b387761bdf2c7", "file_type": "created_file", "id": "file_198", "md5_hash": "dac45c31e753c98cdfbb9a51edfb4ed1", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5c8.tmp", "sha1_hash": "bb0f1154d13a8eb32ab2ea618c6b387761bdf2c7", "sha256_hash": "fa5f036fda7fcdfeb8aa05db8ff3ac6b531c448f81eb24a4f57df9709054c5ec", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/86df95f8233d001921091452a721280960ed9701", "file_type": "created_file", "id": "file_200", "md5_hash": "5d9e27165b41816cfcc8873e8e932017", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5d9.tmp", "sha1_hash": "86df95f8233d001921091452a721280960ed9701", "sha256_hash": "55da333db9d4c95cad23543590530407e1b8613be331be9544ed0a5a74fe8f47", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f9a26317f4b5230acf410efc869e5cedf678243b", "file_type": "created_file", "id": "file_202", "md5_hash": "39651cbfc4ba04e334dfc22acb4677aa", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5e9.tmp", "sha1_hash": "f9a26317f4b5230acf410efc869e5cedf678243b", "sha256_hash": "8585ea0f33414259b66ecaf5f8704a786967be092f4f9f6cbe3dc837f3833374", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f9a26317f4b5230acf410efc869e5cedf678243b", "file_type": "created_file", "id": "file_204", "md5_hash": "39651cbfc4ba04e334dfc22acb4677aa", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5ea.tmp", "sha1_hash": "f9a26317f4b5230acf410efc869e5cedf678243b", "sha256_hash": "8585ea0f33414259b66ecaf5f8704a786967be092f4f9f6cbe3dc837f3833374", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/802479d5223500d2bcb0d688a12919792c1b7234", "file_type": "created_file", "id": "file_206", "md5_hash": "1eb125acfc4ea168b8f1b26d23e6e14a", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5fb.tmp", "sha1_hash": "802479d5223500d2bcb0d688a12919792c1b7234", "sha256_hash": "7044172508df63cd40967a61aa41ae2c93b5beddaeebfbacbe8320bab5369b4f", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/802479d5223500d2bcb0d688a12919792c1b7234", "file_type": "created_file", "id": "file_208", "md5_hash": "1eb125acfc4ea168b8f1b26d23e6e14a", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5fc.tmp", "sha1_hash": "802479d5223500d2bcb0d688a12919792c1b7234", "sha256_hash": "7044172508df63cd40967a61aa41ae2c93b5beddaeebfbacbe8320bab5369b4f", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/802479d5223500d2bcb0d688a12919792c1b7234", "file_type": "created_file", "id": "file_210", "md5_hash": "1eb125acfc4ea168b8f1b26d23e6e14a", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f5fd.tmp", "sha1_hash": "802479d5223500d2bcb0d688a12919792c1b7234", "sha256_hash": "7044172508df63cd40967a61aa41ae2c93b5beddaeebfbacbe8320bab5369b4f", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0337b72b2c72bf5c45e9302038d87fe81e026adf", "file_type": "created_file", "id": "file_212", "md5_hash": "d679411f3fa692e6b752155b21d207de", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f60d.tmp", "sha1_hash": "0337b72b2c72bf5c45e9302038d87fe81e026adf", "sha256_hash": "4fb1ecfa8639a9267c67cbe35f87dc80958c06ea9e061b31449169aff6d63faf", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0337b72b2c72bf5c45e9302038d87fe81e026adf", "file_type": "created_file", "id": "file_214", "md5_hash": "d679411f3fa692e6b752155b21d207de", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f60e.tmp", "sha1_hash": "0337b72b2c72bf5c45e9302038d87fe81e026adf", "sha256_hash": "4fb1ecfa8639a9267c67cbe35f87dc80958c06ea9e061b31449169aff6d63faf", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0337b72b2c72bf5c45e9302038d87fe81e026adf", "file_type": "created_file", "id": "file_216", "md5_hash": "d679411f3fa692e6b752155b21d207de", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f60f.tmp", "sha1_hash": "0337b72b2c72bf5c45e9302038d87fe81e026adf", "sha256_hash": "4fb1ecfa8639a9267c67cbe35f87dc80958c06ea9e061b31449169aff6d63faf", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0337b72b2c72bf5c45e9302038d87fe81e026adf", "file_type": "created_file", "id": "file_218", "md5_hash": "d679411f3fa692e6b752155b21d207de", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f610.tmp", "sha1_hash": "0337b72b2c72bf5c45e9302038d87fe81e026adf", "sha256_hash": "4fb1ecfa8639a9267c67cbe35f87dc80958c06ea9e061b31449169aff6d63faf", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e005a7ef6a8de613bccde48b1ee2a79dc6bb84c5", "file_type": "created_file", "id": "file_220", "md5_hash": "c434ddec0db61048762ff94721be7089", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f621.tmp", "sha1_hash": "e005a7ef6a8de613bccde48b1ee2a79dc6bb84c5", "sha256_hash": "db4e0f1ad6ecb6b825a9c9ba0687efc9038523a0584ab67902c20e2656612ef1", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e005a7ef6a8de613bccde48b1ee2a79dc6bb84c5", "file_type": "created_file", "id": "file_222", "md5_hash": "c434ddec0db61048762ff94721be7089", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f622.tmp", "sha1_hash": "e005a7ef6a8de613bccde48b1ee2a79dc6bb84c5", "sha256_hash": "db4e0f1ad6ecb6b825a9c9ba0687efc9038523a0584ab67902c20e2656612ef1", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e005a7ef6a8de613bccde48b1ee2a79dc6bb84c5", "file_type": "created_file", "id": "file_224", "md5_hash": "c434ddec0db61048762ff94721be7089", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f623.tmp", "sha1_hash": "e005a7ef6a8de613bccde48b1ee2a79dc6bb84c5", "sha256_hash": "db4e0f1ad6ecb6b825a9c9ba0687efc9038523a0584ab67902c20e2656612ef1", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8d49dc7f490f9440bc696f6541d77fb475fc823a", "file_type": "created_file", "id": "file_226", "md5_hash": "44e8b72140c5937b35d5e11930f7894d", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f634.tmp", "sha1_hash": "8d49dc7f490f9440bc696f6541d77fb475fc823a", "sha256_hash": "940ce76f327c39d19a5736ec21801f09c0f1b02f65fb91fad20dade63ac1916f", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8d49dc7f490f9440bc696f6541d77fb475fc823a", "file_type": "created_file", "id": "file_228", "md5_hash": "44e8b72140c5937b35d5e11930f7894d", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f635.tmp", "sha1_hash": "8d49dc7f490f9440bc696f6541d77fb475fc823a", "sha256_hash": "940ce76f327c39d19a5736ec21801f09c0f1b02f65fb91fad20dade63ac1916f", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8d49dc7f490f9440bc696f6541d77fb475fc823a", "file_type": "created_file", "id": "file_230", "md5_hash": "44e8b72140c5937b35d5e11930f7894d", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f636.tmp", "sha1_hash": "8d49dc7f490f9440bc696f6541d77fb475fc823a", "sha256_hash": "940ce76f327c39d19a5736ec21801f09c0f1b02f65fb91fad20dade63ac1916f", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ddf517ac9febd17ed5f2231aefccc1d03c9b1049", "file_type": "created_file", "id": "file_232", "md5_hash": "e6cb259c1703ccdd1197a25dd4942506", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f637.tmp", "sha1_hash": "ddf517ac9febd17ed5f2231aefccc1d03c9b1049", "sha256_hash": "fdaf5dbca4e66c9a3bdcd8d821342467ee34d931352acadcb9eef82d8bc73298", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ddf517ac9febd17ed5f2231aefccc1d03c9b1049", "file_type": "created_file", "id": "file_234", "md5_hash": "e6cb259c1703ccdd1197a25dd4942506", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f647.tmp", "sha1_hash": "ddf517ac9febd17ed5f2231aefccc1d03c9b1049", "sha256_hash": "fdaf5dbca4e66c9a3bdcd8d821342467ee34d931352acadcb9eef82d8bc73298", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ddf517ac9febd17ed5f2231aefccc1d03c9b1049", "file_type": "created_file", "id": "file_236", "md5_hash": "e6cb259c1703ccdd1197a25dd4942506", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f648.tmp", "sha1_hash": "ddf517ac9febd17ed5f2231aefccc1d03c9b1049", "sha256_hash": "fdaf5dbca4e66c9a3bdcd8d821342467ee34d931352acadcb9eef82d8bc73298", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ddf517ac9febd17ed5f2231aefccc1d03c9b1049", "file_type": "created_file", "id": "file_238", "md5_hash": "e6cb259c1703ccdd1197a25dd4942506", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f649.tmp", "sha1_hash": "ddf517ac9febd17ed5f2231aefccc1d03c9b1049", "sha256_hash": "fdaf5dbca4e66c9a3bdcd8d821342467ee34d931352acadcb9eef82d8bc73298", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/49aee81e576bd9dbfba4d2ccf670b594bf53a140", "file_type": "created_file", "id": "file_240", "md5_hash": "d9ae701f5dd0b628c625a54059cb9744", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6b8.tmp", "sha1_hash": "49aee81e576bd9dbfba4d2ccf670b594bf53a140", "sha256_hash": "6c4b9203660981bcdcec8d86415f9b4cdbee1c4471a1da2a90d0f8b4a6cd6290", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3562ca4504eb475d1b1041998c7dac1318917d40", "file_type": "created_file", "id": "file_242", "md5_hash": "c4559a377c8f3401cca201ae5c720ef7", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6c8.tmp", "sha1_hash": "3562ca4504eb475d1b1041998c7dac1318917d40", "sha256_hash": "0cb503a6c00617b3243aade53619796743a68a841325b68bdb34d2248164e300", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/3562ca4504eb475d1b1041998c7dac1318917d40", "file_type": "created_file", "id": "file_244", "md5_hash": "c4559a377c8f3401cca201ae5c720ef7", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6c9.tmp", "sha1_hash": "3562ca4504eb475d1b1041998c7dac1318917d40", "sha256_hash": "0cb503a6c00617b3243aade53619796743a68a841325b68bdb34d2248164e300", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ed18709babbec5fdbddf0dd8aabb12bf68fea721", "file_type": "created_file", "id": "file_246", "md5_hash": "3d47d77bc99f5fe1d95276a04cce1137", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6da.tmp", "sha1_hash": "ed18709babbec5fdbddf0dd8aabb12bf68fea721", "sha256_hash": "d07a04edff9dc3e382e4852c5af20f3fc0d8aa10e925a89c38c4d555fd4f9f78", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ed18709babbec5fdbddf0dd8aabb12bf68fea721", "file_type": "created_file", "id": "file_248", "md5_hash": "3d47d77bc99f5fe1d95276a04cce1137", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6db.tmp", "sha1_hash": "ed18709babbec5fdbddf0dd8aabb12bf68fea721", "sha256_hash": "d07a04edff9dc3e382e4852c5af20f3fc0d8aa10e925a89c38c4d555fd4f9f78", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ed18709babbec5fdbddf0dd8aabb12bf68fea721", "file_type": "created_file", "id": "file_250", "md5_hash": "3d47d77bc99f5fe1d95276a04cce1137", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6dc.tmp", "sha1_hash": "ed18709babbec5fdbddf0dd8aabb12bf68fea721", "sha256_hash": "d07a04edff9dc3e382e4852c5af20f3fc0d8aa10e925a89c38c4d555fd4f9f78", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d10090a0b0ad3cf65d7bf341298295b93c75213b", "file_type": "created_file", "id": "file_252", "md5_hash": "9eb625764eff9a5f53568df532d096ed", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6ed.tmp", "sha1_hash": "d10090a0b0ad3cf65d7bf341298295b93c75213b", "sha256_hash": "5d14c595d307d37561310fc179766d170422b1cdf39cdca4e25e2d0153f92cb3", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d10090a0b0ad3cf65d7bf341298295b93c75213b", "file_type": "created_file", "id": "file_254", "md5_hash": "9eb625764eff9a5f53568df532d096ed", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6ee.tmp", "sha1_hash": "d10090a0b0ad3cf65d7bf341298295b93c75213b", "sha256_hash": "5d14c595d307d37561310fc179766d170422b1cdf39cdca4e25e2d0153f92cb3", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/77fa96cf44e3939971ca3b9342b7b6c62c508187", "file_type": "created_file", "id": "file_256", "md5_hash": "b5efbbd58f1dbb99e7fa14062ac32059", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6fe.tmp", "sha1_hash": "77fa96cf44e3939971ca3b9342b7b6c62c508187", "sha256_hash": "a7233f7c8b8a2957d37230ab75c25294696b7799ef4e5501ca51609331aa6a8e", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/77fa96cf44e3939971ca3b9342b7b6c62c508187", "file_type": "created_file", "id": "file_258", "md5_hash": "b5efbbd58f1dbb99e7fa14062ac32059", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f6ff.tmp", "sha1_hash": "77fa96cf44e3939971ca3b9342b7b6c62c508187", "sha256_hash": "a7233f7c8b8a2957d37230ab75c25294696b7799ef4e5501ca51609331aa6a8e", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/77fa96cf44e3939971ca3b9342b7b6c62c508187", "file_type": "created_file", "id": "file_260", "md5_hash": "b5efbbd58f1dbb99e7fa14062ac32059", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f700.tmp", "sha1_hash": "77fa96cf44e3939971ca3b9342b7b6c62c508187", "sha256_hash": "a7233f7c8b8a2957d37230ab75c25294696b7799ef4e5501ca51609331aa6a8e", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7f76ab35199a93d5e2c0e6fdb557f3307278241a", "file_type": "created_file", "id": "file_262", "md5_hash": "e26e61abc079fd0947f6a6a8b92eb4a7", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f701.tmp", "sha1_hash": "7f76ab35199a93d5e2c0e6fdb557f3307278241a", "sha256_hash": "f808fc0bccf2dff452da42c01e07725c2da632190bd91a5f6c6699cc91fdeb3f", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/7f76ab35199a93d5e2c0e6fdb557f3307278241a", "file_type": "created_file", "id": "file_264", "md5_hash": "e26e61abc079fd0947f6a6a8b92eb4a7", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f712.tmp", "sha1_hash": "7f76ab35199a93d5e2c0e6fdb557f3307278241a", "sha256_hash": "f808fc0bccf2dff452da42c01e07725c2da632190bd91a5f6c6699cc91fdeb3f", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f62d92c1bc87085916fe4e42952634f38083f67b", "file_type": "created_file", "id": "file_266", "md5_hash": "4d65fe16cac0bcd7260a56a45bcf8f5d", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f722.tmp", "sha1_hash": "f62d92c1bc87085916fe4e42952634f38083f67b", "sha256_hash": "8e804af1c8c68413dbc3bf40dc1b88ac1a6e5d545d07262995317429e3befeb6", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f62d92c1bc87085916fe4e42952634f38083f67b", "file_type": "created_file", "id": "file_268", "md5_hash": "4d65fe16cac0bcd7260a56a45bcf8f5d", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f723.tmp", "sha1_hash": "f62d92c1bc87085916fe4e42952634f38083f67b", "sha256_hash": "8e804af1c8c68413dbc3bf40dc1b88ac1a6e5d545d07262995317429e3befeb6", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f62d92c1bc87085916fe4e42952634f38083f67b", "file_type": "created_file", "id": "file_270", "md5_hash": "4d65fe16cac0bcd7260a56a45bcf8f5d", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f724.tmp", "sha1_hash": "f62d92c1bc87085916fe4e42952634f38083f67b", "sha256_hash": "8e804af1c8c68413dbc3bf40dc1b88ac1a6e5d545d07262995317429e3befeb6", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f62d92c1bc87085916fe4e42952634f38083f67b", "file_type": "created_file", "id": "file_272", "md5_hash": "4d65fe16cac0bcd7260a56a45bcf8f5d", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f725.tmp", "sha1_hash": "f62d92c1bc87085916fe4e42952634f38083f67b", "sha256_hash": "8e804af1c8c68413dbc3bf40dc1b88ac1a6e5d545d07262995317429e3befeb6", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/aaf7be35be5cc96b7b25100d4ab1b49f53752284", "file_type": "created_file", "id": "file_274", "md5_hash": "f8afc9c6812316cec7696bb2a37678a3", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f736.tmp", "sha1_hash": "aaf7be35be5cc96b7b25100d4ab1b49f53752284", "sha256_hash": "90624a7ba75f055bed571c30352161717c67572d7623e8936c9989b930990696", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/aaf7be35be5cc96b7b25100d4ab1b49f53752284", "file_type": "created_file", "id": "file_276", "md5_hash": "f8afc9c6812316cec7696bb2a37678a3", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f737.tmp", "sha1_hash": "aaf7be35be5cc96b7b25100d4ab1b49f53752284", "sha256_hash": "90624a7ba75f055bed571c30352161717c67572d7623e8936c9989b930990696", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/aaf7be35be5cc96b7b25100d4ab1b49f53752284", "file_type": "created_file", "id": "file_278", "md5_hash": "f8afc9c6812316cec7696bb2a37678a3", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f738.tmp", "sha1_hash": "aaf7be35be5cc96b7b25100d4ab1b49f53752284", "sha256_hash": "90624a7ba75f055bed571c30352161717c67572d7623e8936c9989b930990696", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c237aac1bfdd06bbfeb577aaa3edc0d5e763d198", "file_type": "created_file", "id": "file_280", "md5_hash": "c42ccc8f7fbc68f572190e4e1572d7de", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f749.tmp", "sha1_hash": "c237aac1bfdd06bbfeb577aaa3edc0d5e763d198", "sha256_hash": "68dc58bf8e170ef3616394c060f41602c6bff4ebd2bdf8225dc24c20832d9068", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c237aac1bfdd06bbfeb577aaa3edc0d5e763d198", "file_type": "created_file", "id": "file_282", "md5_hash": "c42ccc8f7fbc68f572190e4e1572d7de", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f74a.tmp", "sha1_hash": "c237aac1bfdd06bbfeb577aaa3edc0d5e763d198", "sha256_hash": "68dc58bf8e170ef3616394c060f41602c6bff4ebd2bdf8225dc24c20832d9068", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2127e787799c9e7d732630fc4dfb1ea4d0617aad", "file_type": "created_file", "id": "file_284", "md5_hash": "1465f646c10c7a837ad269d7406b7648", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f75a.tmp", "sha1_hash": "2127e787799c9e7d732630fc4dfb1ea4d0617aad", "sha256_hash": "18c80ffadcc8321911f11ad7c61f13d1be11378edcceb69494fe84a366393896", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2127e787799c9e7d732630fc4dfb1ea4d0617aad", "file_type": "created_file", "id": "file_286", "md5_hash": "1465f646c10c7a837ad269d7406b7648", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f75b.tmp", "sha1_hash": "2127e787799c9e7d732630fc4dfb1ea4d0617aad", "sha256_hash": "18c80ffadcc8321911f11ad7c61f13d1be11378edcceb69494fe84a366393896", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2127e787799c9e7d732630fc4dfb1ea4d0617aad", "file_type": "created_file", "id": "file_288", "md5_hash": "1465f646c10c7a837ad269d7406b7648", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f75c.tmp", "sha1_hash": "2127e787799c9e7d732630fc4dfb1ea4d0617aad", "sha256_hash": "18c80ffadcc8321911f11ad7c61f13d1be11378edcceb69494fe84a366393896", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/940b3f697a8db360b6583033e24b09217e81b226", "file_type": "created_file", "id": "file_290", "md5_hash": "bcce097053a3f275ce63b83cc9003344", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f77d.tmp", "sha1_hash": "940b3f697a8db360b6583033e24b09217e81b226", "sha256_hash": "d7d4ea3fb166395e6967e5f2aeb2a9099cd58fc3c0bd5c4c2b02f9876411c6f4", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/940b3f697a8db360b6583033e24b09217e81b226", "file_type": "created_file", "id": "file_292", "md5_hash": "bcce097053a3f275ce63b83cc9003344", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f77e.tmp", "sha1_hash": "940b3f697a8db360b6583033e24b09217e81b226", "sha256_hash": "d7d4ea3fb166395e6967e5f2aeb2a9099cd58fc3c0bd5c4c2b02f9876411c6f4", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ae6369b1f7b9a6b43c7cdbaf3245e8f1f54fd0e3", "file_type": "created_file", "id": "file_294", "md5_hash": "2772d0360800271925bf506615111529", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f78e.tmp", "sha1_hash": "ae6369b1f7b9a6b43c7cdbaf3245e8f1f54fd0e3", "sha256_hash": "159758f584f37f9f1f2b5317516c5a55814a2532cd4014a3f6b580d7d42b8b42", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ae6369b1f7b9a6b43c7cdbaf3245e8f1f54fd0e3", "file_type": "created_file", "id": "file_296", "md5_hash": "2772d0360800271925bf506615111529", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f78f.tmp", "sha1_hash": "ae6369b1f7b9a6b43c7cdbaf3245e8f1f54fd0e3", "sha256_hash": "159758f584f37f9f1f2b5317516c5a55814a2532cd4014a3f6b580d7d42b8b42", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ae6369b1f7b9a6b43c7cdbaf3245e8f1f54fd0e3", "file_type": "created_file", "id": "file_298", "md5_hash": "2772d0360800271925bf506615111529", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f790.tmp", "sha1_hash": "ae6369b1f7b9a6b43c7cdbaf3245e8f1f54fd0e3", "sha256_hash": "159758f584f37f9f1f2b5317516c5a55814a2532cd4014a3f6b580d7d42b8b42", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/96f634f884f15734c7288f84f3b2d75ee84a3b68", "file_type": "created_file", "id": "file_300", "md5_hash": "2677f86fc97191cfdcf4df7911e67aaa", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f7a1.tmp", "sha1_hash": "96f634f884f15734c7288f84f3b2d75ee84a3b68", "sha256_hash": "5189b0d164dcaf3e4cc07d9401f77ec50cc9fc77957fff4acc1c7aa374a3d584", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c42fcede3a7f5920d2cfa0a2a3ee3e1348f1779e", "file_type": "created_file", "id": "file_302", "md5_hash": "f0c25a3aa9b0acff64a2af4b9cf1afd3", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f7b1.tmp", "sha1_hash": "c42fcede3a7f5920d2cfa0a2a3ee3e1348f1779e", "sha256_hash": "4a0e739848ed9baf99b6ac33eff9047b483488bbaf9039c7d996eb9e1752fe6f", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/67e3f5a917854dd20c1f7cd6ec9848514967ba58", "file_type": "created_file", "id": "file_304", "md5_hash": "1948b9f403d68cd6844908aabcc5c939", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f7c2.tmp", "sha1_hash": "67e3f5a917854dd20c1f7cd6ec9848514967ba58", "sha256_hash": "8522cb0c4505729ace062d2b3c3647447ef8fbf03a1e9c5f1acc638bf78cff5b", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/67e3f5a917854dd20c1f7cd6ec9848514967ba58", "file_type": "created_file", "id": "file_306", "md5_hash": "1948b9f403d68cd6844908aabcc5c939", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f7c3.tmp", "sha1_hash": "67e3f5a917854dd20c1f7cd6ec9848514967ba58", "sha256_hash": "8522cb0c4505729ace062d2b3c3647447ef8fbf03a1e9c5f1acc638bf78cff5b", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2b6c410e14106ae324de9ebd37a3f50ef2116bb0", "file_type": "created_file", "id": "file_308", "md5_hash": "bd51cab61855f9d12f4d77bc8385e650", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f7d4.tmp", "sha1_hash": "2b6c410e14106ae324de9ebd37a3f50ef2116bb0", "sha256_hash": "4901e09aaca43a2224b3d3ab32d7bfb8aa2811168c7c56e847450c90977ff47c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2b6c410e14106ae324de9ebd37a3f50ef2116bb0", "file_type": "created_file", "id": "file_310", "md5_hash": "bd51cab61855f9d12f4d77bc8385e650", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f7d5.tmp", "sha1_hash": "2b6c410e14106ae324de9ebd37a3f50ef2116bb0", "sha256_hash": "4901e09aaca43a2224b3d3ab32d7bfb8aa2811168c7c56e847450c90977ff47c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/02c237a4065b907e3f5633d14ed2eb3724d15a7c", "file_type": "created_file", "id": "file_312", "md5_hash": "db556c7c5654a84643530888819e14fa", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f7e5.tmp", "sha1_hash": "02c237a4065b907e3f5633d14ed2eb3724d15a7c", "sha256_hash": "45ec52e9a1b57b459fec2e02f20ee3e068b84a29ce3879f504d41ed2bec6e2f7", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5c0a221bea8809640159e961559f2581fc57c7ae", "file_type": "created_file", "id": "file_314", "md5_hash": "0b35b5699bddbc69989221709be7da6f", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f806.tmp", "sha1_hash": "5c0a221bea8809640159e961559f2581fc57c7ae", "sha256_hash": "5d9a9fb8e5859dbd9b32a5ab686bd912418accdfb41a8d92066e314a0a12cdd4", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/be34e2dd32efe37497f5edcc21d63c56bdc8c9a2", "file_type": "created_file", "id": "file_316", "md5_hash": "f036b8921890b0d10f00a5bf5bdec729", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f816.tmp", "sha1_hash": "be34e2dd32efe37497f5edcc21d63c56bdc8c9a2", "sha256_hash": "586b668ed7a5c3b8adbf7304f8d0ba1e81b7f6db1c8e28f36cf0d84cdb496085", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e6bed0a0920ac06a427b3bc6a3243128a7eb50a9", "file_type": "created_file", "id": "file_318", "md5_hash": "34f91cc086c33b49dd108f5b14450c89", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f827.tmp", "sha1_hash": "e6bed0a0920ac06a427b3bc6a3243128a7eb50a9", "sha256_hash": "28df75a9d1d3bbfd16bc948c6efe745cdba2d547b02b6f075ca9b8d3f3f26e29", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ff657760b607416f954c0d0f02cd4081f1bf8884", "file_type": "created_file", "id": "file_320", "md5_hash": "5d788fedeae6f1d83c718b993aaf0edd", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f837.tmp", "sha1_hash": "ff657760b607416f954c0d0f02cd4081f1bf8884", "sha256_hash": "38dd54a874e8468282ba8fda9eb499c8c9279e5ecbcfdee55be0059a1c9c4fac", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ff657760b607416f954c0d0f02cd4081f1bf8884", "file_type": "created_file", "id": "file_322", "md5_hash": "5d788fedeae6f1d83c718b993aaf0edd", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f838.tmp", "sha1_hash": "ff657760b607416f954c0d0f02cd4081f1bf8884", "sha256_hash": "38dd54a874e8468282ba8fda9eb499c8c9279e5ecbcfdee55be0059a1c9c4fac", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/81765b7c10b940e6b6a118e2c4830b581485ca05", "file_type": "created_file", "id": "file_324", "md5_hash": "e7afa0433ffd6793611c0a074ae02376", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f849.tmp", "sha1_hash": "81765b7c10b940e6b6a118e2c4830b581485ca05", "sha256_hash": "d356cc8eb66171878f6a4055f83203f1ee1de244eb98f46917db817182bed6a5", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/81765b7c10b940e6b6a118e2c4830b581485ca05", "file_type": "created_file", "id": "file_326", "md5_hash": "e7afa0433ffd6793611c0a074ae02376", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f84a.tmp", "sha1_hash": "81765b7c10b940e6b6a118e2c4830b581485ca05", "sha256_hash": "d356cc8eb66171878f6a4055f83203f1ee1de244eb98f46917db817182bed6a5", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/81765b7c10b940e6b6a118e2c4830b581485ca05", "file_type": "created_file", "id": "file_328", "md5_hash": "e7afa0433ffd6793611c0a074ae02376", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f84b.tmp", "sha1_hash": "81765b7c10b940e6b6a118e2c4830b581485ca05", "sha256_hash": "d356cc8eb66171878f6a4055f83203f1ee1de244eb98f46917db817182bed6a5", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/1a5f91c6abd1921fdc318aee04047214c53b7728", "file_type": "created_file", "id": "file_330", "md5_hash": "73b3446145b1a005af670273cae6c659", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f85c.tmp", "sha1_hash": "1a5f91c6abd1921fdc318aee04047214c53b7728", "sha256_hash": "2e0cb62b2237bf00fc5d0cac237814459bc1a8c55af3a8322a516be603f607b7", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5ce79151e953a2e7274fed831cbbad2172425346", "file_type": "created_file", "id": "file_332", "md5_hash": "53b31cba57364071f0b92fde987dbb3d", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f86c.tmp", "sha1_hash": "5ce79151e953a2e7274fed831cbbad2172425346", "sha256_hash": "c8d9a97dda600fdc3fd84b54389f23829622ab669cc670f6f1b38726dc8b0566", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/5ce79151e953a2e7274fed831cbbad2172425346", "file_type": "created_file", "id": "file_334", "md5_hash": "53b31cba57364071f0b92fde987dbb3d", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f86d.tmp", "sha1_hash": "5ce79151e953a2e7274fed831cbbad2172425346", "sha256_hash": "c8d9a97dda600fdc3fd84b54389f23829622ab669cc670f6f1b38726dc8b0566", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/58ee37d07d867952be28228ea30697d807db2114", "file_type": "created_file", "id": "file_336", "md5_hash": "95da43c0275776c1345d8855df05c984", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f89d.tmp", "sha1_hash": "58ee37d07d867952be28228ea30697d807db2114", "sha256_hash": "42904201e2d09103766321fa614bd05f4a00c54de19288f8aff55e05ea5d6a70", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/58ee37d07d867952be28228ea30697d807db2114", "file_type": "created_file", "id": "file_338", "md5_hash": "95da43c0275776c1345d8855df05c984", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f89e.tmp", "sha1_hash": "58ee37d07d867952be28228ea30697d807db2114", "sha256_hash": "42904201e2d09103766321fa614bd05f4a00c54de19288f8aff55e05ea5d6a70", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b51ae0ee85cbeb67a4aa34a88bcbb8aa174c6221", "file_type": "created_file", "id": "file_340", "md5_hash": "a09268114b4cb6df8a6767265fa71727", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f89f.tmp", "sha1_hash": "b51ae0ee85cbeb67a4aa34a88bcbb8aa174c6221", "sha256_hash": "4341640a4f141d3a35ab3c57580e1d2c9f71e3442ede2896bbf72f07968b3766", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/814555207667f27a53e2e8a503c560032c132172", "file_type": "created_file", "id": "file_342", "md5_hash": "c1e7b3719d3e604334d4ea5170a9da97", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f8cf.tmp", "sha1_hash": "814555207667f27a53e2e8a503c560032c132172", "sha256_hash": "aa09ad35144137e416e44096a8b9c5f5053673e504744d69a28ab53539de015c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4bd9d96d580efbdc14c7a2c24fa3403fbee0faec", "file_type": "created_file", "id": "file_344", "md5_hash": "ad613ffd617822549d6c82e66c06dd4c", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f8e0.tmp", "sha1_hash": "4bd9d96d580efbdc14c7a2c24fa3403fbee0faec", "sha256_hash": "df541758b76999b1786e35e3c6f9afab27889d377e60f31b21cea992d2cf3fc6", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/95a6a85dc88f99e224cf7a6fef66214033274a22", "file_type": "created_file", "id": "file_346", "md5_hash": "c9d7caaccde02d9cbe0f9af60d6827dc", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f8f0.tmp", "sha1_hash": "95a6a85dc88f99e224cf7a6fef66214033274a22", "sha256_hash": "624b42c6e21d8e6392d494035eb838afc665f04bf8154cbebd3f99eab87a8777", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/95a6a85dc88f99e224cf7a6fef66214033274a22", "file_type": "created_file", "id": "file_348", "md5_hash": "c9d7caaccde02d9cbe0f9af60d6827dc", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f8f1.tmp", "sha1_hash": "95a6a85dc88f99e224cf7a6fef66214033274a22", "sha256_hash": "624b42c6e21d8e6392d494035eb838afc665f04bf8154cbebd3f99eab87a8777", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4cd5bdd3a2fe1eec6fa520609fed4def59fd727f", "file_type": "created_file", "id": "file_350", "md5_hash": "e483e583f1511325f2fa9904bb27fa70", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f902.tmp", "sha1_hash": "4cd5bdd3a2fe1eec6fa520609fed4def59fd727f", "sha256_hash": "8226ebf822344f196d7f95a18bf20c7803664fa10947a9b73a8ef71083b33ad2", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/4cd5bdd3a2fe1eec6fa520609fed4def59fd727f", "file_type": "created_file", "id": "file_352", "md5_hash": "e483e583f1511325f2fa9904bb27fa70", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f903.tmp", "sha1_hash": "4cd5bdd3a2fe1eec6fa520609fed4def59fd727f", "sha256_hash": "8226ebf822344f196d7f95a18bf20c7803664fa10947a9b73a8ef71083b33ad2", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/fb9888908deb70127878642bd1b74e5817873dc8", "file_type": "created_file", "id": "file_354", "md5_hash": "dd1e78498286fe8b7914235fbfe4772a", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f914.tmp", "sha1_hash": "fb9888908deb70127878642bd1b74e5817873dc8", "sha256_hash": "157c5610fdba420b1bcd3f2bf7a2dbaa541da0a951f077471f5b0024ec858d6e", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/fb9888908deb70127878642bd1b74e5817873dc8", "file_type": "created_file", "id": "file_356", "md5_hash": "dd1e78498286fe8b7914235fbfe4772a", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f915.tmp", "sha1_hash": "fb9888908deb70127878642bd1b74e5817873dc8", "sha256_hash": "157c5610fdba420b1bcd3f2bf7a2dbaa541da0a951f077471f5b0024ec858d6e", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/fb9888908deb70127878642bd1b74e5817873dc8", "file_type": "created_file", "id": "file_358", "md5_hash": "dd1e78498286fe8b7914235fbfe4772a", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f916.tmp", "sha1_hash": "fb9888908deb70127878642bd1b74e5817873dc8", "sha256_hash": "157c5610fdba420b1bcd3f2bf7a2dbaa541da0a951f077471f5b0024ec858d6e", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ee62a235a427b229dfbeb59ff0c66e891b1ea9fc", "file_type": "created_file", "id": "file_360", "md5_hash": "b0e57fcf3eb588d105106b90168b352c", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f926.tmp", "sha1_hash": "ee62a235a427b229dfbeb59ff0c66e891b1ea9fc", "sha256_hash": "99e24199c9a832f4839c7e5c749dc99d2ef728004c42a30c6896edd5ada9a466", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ee62a235a427b229dfbeb59ff0c66e891b1ea9fc", "file_type": "created_file", "id": "file_362", "md5_hash": "b0e57fcf3eb588d105106b90168b352c", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f927.tmp", "sha1_hash": "ee62a235a427b229dfbeb59ff0c66e891b1ea9fc", "sha256_hash": "99e24199c9a832f4839c7e5c749dc99d2ef728004c42a30c6896edd5ada9a466", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ee62a235a427b229dfbeb59ff0c66e891b1ea9fc", "file_type": "created_file", "id": "file_364", "md5_hash": "b0e57fcf3eb588d105106b90168b352c", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f928.tmp", "sha1_hash": "ee62a235a427b229dfbeb59ff0c66e891b1ea9fc", "sha256_hash": "99e24199c9a832f4839c7e5c749dc99d2ef728004c42a30c6896edd5ada9a466", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0d10e85482ca5dfeaef1dccd914da033aaf479eb", "file_type": "created_file", "id": "file_366", "md5_hash": "6779791e5c451ee29f3f08eeecbdf3f1", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f939.tmp", "sha1_hash": "0d10e85482ca5dfeaef1dccd914da033aaf479eb", "sha256_hash": "34bc853f027d1404caec15171d9d51a5e79f6ef0a423b7bbda419e71d6750288", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0d10e85482ca5dfeaef1dccd914da033aaf479eb", "file_type": "created_file", "id": "file_368", "md5_hash": "6779791e5c451ee29f3f08eeecbdf3f1", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f93a.tmp", "sha1_hash": "0d10e85482ca5dfeaef1dccd914da033aaf479eb", "sha256_hash": "34bc853f027d1404caec15171d9d51a5e79f6ef0a423b7bbda419e71d6750288", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a36bb54f7d0f7545656de9e1a5d5efc9475f6a30", "file_type": "created_file", "id": "file_370", "md5_hash": "b04c67deab4025f734171f9b27454cbe", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f94a.tmp", "sha1_hash": "a36bb54f7d0f7545656de9e1a5d5efc9475f6a30", "sha256_hash": "71127f5ad12f0455cabb4dc16456a9ea5004c3686b2c366961b59c5dac0f35ae", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/1994848ee4007ab80507cec3a98864d3214e9691", "file_type": "created_file", "id": "file_372", "md5_hash": "f19a90ae7e669a69bff86c46ea7815da", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f96b.tmp", "sha1_hash": "1994848ee4007ab80507cec3a98864d3214e9691", "sha256_hash": "a6af512d23f2e48b9184b61e0bfb9f9fc355d743e9fd10cbc97aeba44a27005b", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/bd48ed36b583498d83f67b28dcb029354af96ef3", "file_type": "created_file", "id": "file_374", "md5_hash": "03dbace4773f49af413532681a14eec1", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f96c.tmp", "sha1_hash": "bd48ed36b583498d83f67b28dcb029354af96ef3", "sha256_hash": "59c055358a9142b72e21a30eb0492ce9af9cfbf4189768c8eca4d48f71029bc0", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/bd48ed36b583498d83f67b28dcb029354af96ef3", "file_type": "created_file", "id": "file_376", "md5_hash": "03dbace4773f49af413532681a14eec1", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f96d.tmp", "sha1_hash": "bd48ed36b583498d83f67b28dcb029354af96ef3", "sha256_hash": "59c055358a9142b72e21a30eb0492ce9af9cfbf4189768c8eca4d48f71029bc0", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/6b605107d3827f9c9ffd4029b72ccdd72628cdc2", "file_type": "created_file", "id": "file_378", "md5_hash": "741a7dea8e76eb32e7142675d554f22b", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f98d.tmp", "sha1_hash": "6b605107d3827f9c9ffd4029b72ccdd72628cdc2", "sha256_hash": "8007de0dbdecff7d678e651c68a0b12b0dc20651fcdb628fc090c3084afeadd3", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/6b605107d3827f9c9ffd4029b72ccdd72628cdc2", "file_type": "created_file", "id": "file_380", "md5_hash": "741a7dea8e76eb32e7142675d554f22b", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f98e.tmp", "sha1_hash": "6b605107d3827f9c9ffd4029b72ccdd72628cdc2", "sha256_hash": "8007de0dbdecff7d678e651c68a0b12b0dc20651fcdb628fc090c3084afeadd3", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/526a435f2efd108412d4088b073cabfeef22bac9", "file_type": "created_file", "id": "file_382", "md5_hash": "897a33741143f50b74704df8eec736d9", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f99f.tmp", "sha1_hash": "526a435f2efd108412d4088b073cabfeef22bac9", "sha256_hash": "bc7df27c00dd642509782a90f9d1b9dea55de8234d9de3890bd72c5f62ed56da", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/526a435f2efd108412d4088b073cabfeef22bac9", "file_type": "created_file", "id": "file_384", "md5_hash": "897a33741143f50b74704df8eec736d9", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9a0.tmp", "sha1_hash": "526a435f2efd108412d4088b073cabfeef22bac9", "sha256_hash": "bc7df27c00dd642509782a90f9d1b9dea55de8234d9de3890bd72c5f62ed56da", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a5cc6a17b4a4e1ad7e0ea976d5989bbe2df6ba9a", "file_type": "created_file", "id": "file_386", "md5_hash": "c32740bd78c0eda34b5e1272188e4bbe", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9c0.tmp", "sha1_hash": "a5cc6a17b4a4e1ad7e0ea976d5989bbe2df6ba9a", "sha256_hash": "dc2dba534fc133d5c92dd22761408da96ce04131d96f35f6808fd2dc21bb7374", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a5cc6a17b4a4e1ad7e0ea976d5989bbe2df6ba9a", "file_type": "created_file", "id": "file_388", "md5_hash": "c32740bd78c0eda34b5e1272188e4bbe", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9c1.tmp", "sha1_hash": "a5cc6a17b4a4e1ad7e0ea976d5989bbe2df6ba9a", "sha256_hash": "dc2dba534fc133d5c92dd22761408da96ce04131d96f35f6808fd2dc21bb7374", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a5cc6a17b4a4e1ad7e0ea976d5989bbe2df6ba9a", "file_type": "created_file", "id": "file_390", "md5_hash": "c32740bd78c0eda34b5e1272188e4bbe", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9c2.tmp", "sha1_hash": "a5cc6a17b4a4e1ad7e0ea976d5989bbe2df6ba9a", "sha256_hash": "dc2dba534fc133d5c92dd22761408da96ce04131d96f35f6808fd2dc21bb7374", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2b648c326cc2b2ee0a9f1cc4618d82ad1931571f", "file_type": "created_file", "id": "file_392", "md5_hash": "7bfacda96d83ac7a5eab6029ed31d8d3", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9d2.tmp", "sha1_hash": "2b648c326cc2b2ee0a9f1cc4618d82ad1931571f", "sha256_hash": "6e4a86d543899fe2a0739fd7395794ed3f485f157b40dc2ca93817e3b604b913", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2b648c326cc2b2ee0a9f1cc4618d82ad1931571f", "file_type": "created_file", "id": "file_394", "md5_hash": "7bfacda96d83ac7a5eab6029ed31d8d3", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9d3.tmp", "sha1_hash": "2b648c326cc2b2ee0a9f1cc4618d82ad1931571f", "sha256_hash": "6e4a86d543899fe2a0739fd7395794ed3f485f157b40dc2ca93817e3b604b913", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/2b648c326cc2b2ee0a9f1cc4618d82ad1931571f", "file_type": "created_file", "id": "file_396", "md5_hash": "7bfacda96d83ac7a5eab6029ed31d8d3", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9d4.tmp", "sha1_hash": "2b648c326cc2b2ee0a9f1cc4618d82ad1931571f", "sha256_hash": "6e4a86d543899fe2a0739fd7395794ed3f485f157b40dc2ca93817e3b604b913", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/fd26c908afa389126339d2688cfe38988c66d52d", "file_type": "created_file", "id": "file_398", "md5_hash": "8ac380e6de1059d479390edacc24a177", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9e5.tmp", "sha1_hash": "fd26c908afa389126339d2688cfe38988c66d52d", "sha256_hash": "4f2143552d67291e7516198a09565806a4bd7c6ed70f8ed7f6f70326e54db657", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/fd26c908afa389126339d2688cfe38988c66d52d", "file_type": "created_file", "id": "file_400", "md5_hash": "8ac380e6de1059d479390edacc24a177", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9e6.tmp", "sha1_hash": "fd26c908afa389126339d2688cfe38988c66d52d", "sha256_hash": "4f2143552d67291e7516198a09565806a4bd7c6ed70f8ed7f6f70326e54db657", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/05789d4895e3a75820e0f1e1a219abbb8f3755ec", "file_type": "created_file", "id": "file_402", "md5_hash": "125843ec029a307caee53b4425fbd0e3", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\f9f7.tmp", "sha1_hash": "05789d4895e3a75820e0f1e1a219abbb8f3755ec", "sha256_hash": "41350403f48627cc9cb7443ba08ddaf9e285945ec92ce302c10cb17d836a900c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e857327c6c51dfd5f689e8703d9ab1292cedf6d6", "file_type": "created_file", "id": "file_404", "md5_hash": "32bc58962b0017f1042a028ce6cd759c", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa07.tmp", "sha1_hash": "e857327c6c51dfd5f689e8703d9ab1292cedf6d6", "sha256_hash": "09cd28b840d6944ed8ebb3b83a724556f693e4e08237ff5ce84c0d20ba24675b", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e857327c6c51dfd5f689e8703d9ab1292cedf6d6", "file_type": "created_file", "id": "file_406", "md5_hash": "32bc58962b0017f1042a028ce6cd759c", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa08.tmp", "sha1_hash": "e857327c6c51dfd5f689e8703d9ab1292cedf6d6", "sha256_hash": "09cd28b840d6944ed8ebb3b83a724556f693e4e08237ff5ce84c0d20ba24675b", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e857327c6c51dfd5f689e8703d9ab1292cedf6d6", "file_type": "created_file", "id": "file_408", "md5_hash": "32bc58962b0017f1042a028ce6cd759c", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa09.tmp", "sha1_hash": "e857327c6c51dfd5f689e8703d9ab1292cedf6d6", "sha256_hash": "09cd28b840d6944ed8ebb3b83a724556f693e4e08237ff5ce84c0d20ba24675b", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e857327c6c51dfd5f689e8703d9ab1292cedf6d6", "file_type": "created_file", "id": "file_410", "md5_hash": "32bc58962b0017f1042a028ce6cd759c", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa0a.tmp", "sha1_hash": "e857327c6c51dfd5f689e8703d9ab1292cedf6d6", "sha256_hash": "09cd28b840d6944ed8ebb3b83a724556f693e4e08237ff5ce84c0d20ba24675b", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/e4ef07dbdf70890a1ea1f4ce8c70ca3591809e3b", "file_type": "created_file", "id": "file_412", "md5_hash": "c861afd8ab2c119e747b9038121efbd4", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa1b.tmp", "sha1_hash": "e4ef07dbdf70890a1ea1f4ce8c70ca3591809e3b", "sha256_hash": "f44eb347a2110f8913a5ed5c5e9924f7a631103eb659a1b5b4e5dc35938d0b45", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c8c9e10829621d8a837d039bbbc0ae90bf56f3df", "file_type": "created_file", "id": "file_414", "md5_hash": "5c8edf47a392abb29245c0e97c788d2a", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa2c.tmp", "sha1_hash": "c8c9e10829621d8a837d039bbbc0ae90bf56f3df", "sha256_hash": "fce9e4ccb87999fb59ee2e263f81df07f922388a0dbf4287833a5289c4d992b3", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c8c9e10829621d8a837d039bbbc0ae90bf56f3df", "file_type": "created_file", "id": "file_416", "md5_hash": "5c8edf47a392abb29245c0e97c788d2a", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa2d.tmp", "sha1_hash": "c8c9e10829621d8a837d039bbbc0ae90bf56f3df", "sha256_hash": "fce9e4ccb87999fb59ee2e263f81df07f922388a0dbf4287833a5289c4d992b3", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/c8c9e10829621d8a837d039bbbc0ae90bf56f3df", "file_type": "created_file", "id": "file_418", "md5_hash": "5c8edf47a392abb29245c0e97c788d2a", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa2e.tmp", "sha1_hash": "c8c9e10829621d8a837d039bbbc0ae90bf56f3df", "sha256_hash": "fce9e4ccb87999fb59ee2e263f81df07f922388a0dbf4287833a5289c4d992b3", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/daef89630ad3aa8530b2d78ddd5a3839655ee87f", "file_type": "created_file", "id": "file_420", "md5_hash": "ad92c5adef9404e652c1be24d9595274", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa3e.tmp", "sha1_hash": "daef89630ad3aa8530b2d78ddd5a3839655ee87f", "sha256_hash": "38e33077367c38f9ec31aa9cf565a8cf75989237bbafe13fd01b4e34f12d2873", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/daef89630ad3aa8530b2d78ddd5a3839655ee87f", "file_type": "created_file", "id": "file_422", "md5_hash": "ad92c5adef9404e652c1be24d9595274", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa3f.tmp", "sha1_hash": "daef89630ad3aa8530b2d78ddd5a3839655ee87f", "sha256_hash": "38e33077367c38f9ec31aa9cf565a8cf75989237bbafe13fd01b4e34f12d2873", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/201e52a437c5b55eaf17ee2d2685ef39e4e77310", "file_type": "created_file", "id": "file_424", "md5_hash": "ed0ea0131bd1863d91c1615d80148e0b", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa50.tmp", "sha1_hash": "201e52a437c5b55eaf17ee2d2685ef39e4e77310", "sha256_hash": "e063b195f6b560352ca55d6b39967e1601c3b18ab9264069d844120ad6798bf7", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/201e52a437c5b55eaf17ee2d2685ef39e4e77310", "file_type": "created_file", "id": "file_426", "md5_hash": "ed0ea0131bd1863d91c1615d80148e0b", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa51.tmp", "sha1_hash": "201e52a437c5b55eaf17ee2d2685ef39e4e77310", "sha256_hash": "e063b195f6b560352ca55d6b39967e1601c3b18ab9264069d844120ad6798bf7", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/1d513be75293975e4281946cd43c72c46f79605e", "file_type": "created_file", "id": "file_428", "md5_hash": "adb1ec5b8fff0370b151c026632030f2", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa52.tmp", "sha1_hash": "1d513be75293975e4281946cd43c72c46f79605e", "sha256_hash": "0e6f743e28b5364aecef7a7a1f029993567f93edf44b36f3c98953df7c74fbee", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/1d513be75293975e4281946cd43c72c46f79605e", "file_type": "created_file", "id": "file_430", "md5_hash": "adb1ec5b8fff0370b151c026632030f2", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa62.tmp", "sha1_hash": "1d513be75293975e4281946cd43c72c46f79605e", "sha256_hash": "0e6f743e28b5364aecef7a7a1f029993567f93edf44b36f3c98953df7c74fbee", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/1d513be75293975e4281946cd43c72c46f79605e", "file_type": "created_file", "id": "file_432", "md5_hash": "adb1ec5b8fff0370b151c026632030f2", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa63.tmp", "sha1_hash": "1d513be75293975e4281946cd43c72c46f79605e", "sha256_hash": "0e6f743e28b5364aecef7a7a1f029993567f93edf44b36f3c98953df7c74fbee", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/a742c56e5c9f1c78535a2d5c3d1b512ecc903701", "file_type": "created_file", "id": "file_434", "md5_hash": "288eb2692b7d4dabd18b3cd550d15b5e", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa74.tmp", "sha1_hash": "a742c56e5c9f1c78535a2d5c3d1b512ecc903701", "sha256_hash": "63052ebdc0c14a1f49a392276d6846fede6bce315e1c4787d62da9d1a64cecd5", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/611ca0828647b0ac4ea3bcd22f3c28686824a101", "file_type": "created_file", "id": "file_436", "md5_hash": "138f3113f76d726288c4e978cb0413f2", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa85.tmp", "sha1_hash": "611ca0828647b0ac4ea3bcd22f3c28686824a101", "sha256_hash": "573fd261ce7b58332e9f24a7c4a17d2224e3d0d4c48941e5e03297a7d305f35b", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/611ca0828647b0ac4ea3bcd22f3c28686824a101", "file_type": "created_file", "id": "file_438", "md5_hash": "138f3113f76d726288c4e978cb0413f2", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa86.tmp", "sha1_hash": "611ca0828647b0ac4ea3bcd22f3c28686824a101", "sha256_hash": "573fd261ce7b58332e9f24a7c4a17d2224e3d0d4c48941e5e03297a7d305f35b", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b751b27e5a560d2973a7432be8e37d02686faf24", "file_type": "created_file", "id": "file_440", "md5_hash": "418548d74f249fbcc5f08511e5c7bb56", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa96.tmp", "sha1_hash": "b751b27e5a560d2973a7432be8e37d02686faf24", "sha256_hash": "146953e94da698ad13f60d6002476e2ee28273caff5ab17f059f1d9b97054b2c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b751b27e5a560d2973a7432be8e37d02686faf24", "file_type": "created_file", "id": "file_442", "md5_hash": "418548d74f249fbcc5f08511e5c7bb56", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa97.tmp", "sha1_hash": "b751b27e5a560d2973a7432be8e37d02686faf24", "sha256_hash": "146953e94da698ad13f60d6002476e2ee28273caff5ab17f059f1d9b97054b2c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b751b27e5a560d2973a7432be8e37d02686faf24", "file_type": "created_file", "id": "file_444", "md5_hash": "418548d74f249fbcc5f08511e5c7bb56", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa98.tmp", "sha1_hash": "b751b27e5a560d2973a7432be8e37d02686faf24", "sha256_hash": "146953e94da698ad13f60d6002476e2ee28273caff5ab17f059f1d9b97054b2c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b751b27e5a560d2973a7432be8e37d02686faf24", "file_type": "created_file", "id": "file_446", "md5_hash": "418548d74f249fbcc5f08511e5c7bb56", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fa99.tmp", "sha1_hash": "b751b27e5a560d2973a7432be8e37d02686faf24", "sha256_hash": "146953e94da698ad13f60d6002476e2ee28273caff5ab17f059f1d9b97054b2c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/98ee28a4f58bdac0f7e0ddc22e03a7f530956408", "file_type": "created_file", "id": "file_448", "md5_hash": "0511f1993ecc2f294faa8dace502d19c", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\faaa.tmp", "sha1_hash": "98ee28a4f58bdac0f7e0ddc22e03a7f530956408", "sha256_hash": "fc0750c6642725c86799dc19741bc1a529186a18530d7fd030a3668e961b30b7", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/87164e350ca6d29c9ea1aa778ea40372a8eef860", "file_type": "created_file", "id": "file_450", "md5_hash": "b5975ffa385dc00cc1ee73251b6f7cdf", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\faca.tmp", "sha1_hash": "87164e350ca6d29c9ea1aa778ea40372a8eef860", "sha256_hash": "5e7554b0e9e8cdd55822716d16264911814f41976e4476e112c3a46bda5316df", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/87164e350ca6d29c9ea1aa778ea40372a8eef860", "file_type": "created_file", "id": "file_452", "md5_hash": "b5975ffa385dc00cc1ee73251b6f7cdf", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\facb.tmp", "sha1_hash": "87164e350ca6d29c9ea1aa778ea40372a8eef860", "sha256_hash": "5e7554b0e9e8cdd55822716d16264911814f41976e4476e112c3a46bda5316df", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0253e619a7e637ad4e0dc752f4847c5031faa630", "file_type": "created_file", "id": "file_454", "md5_hash": "93c8cf85d0d5b115d17169d1e9308d1c", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\facc.tmp", "sha1_hash": "0253e619a7e637ad4e0dc752f4847c5031faa630", "sha256_hash": "77cef3d40b18c42fe9b813a853be8711f1b2f971da24c26fba35d44122d84b89", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/0253e619a7e637ad4e0dc752f4847c5031faa630", "file_type": "created_file", "id": "file_456", "md5_hash": "93c8cf85d0d5b115d17169d1e9308d1c", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\facd.tmp", "sha1_hash": "0253e619a7e637ad4e0dc752f4847c5031faa630", "sha256_hash": "77cef3d40b18c42fe9b813a853be8711f1b2f971da24c26fba35d44122d84b89", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/faad9f20113781013e8895743428e74fb4abf633", "file_type": "created_file", "id": "file_458", "md5_hash": "a03c7050677123d24e0f908411639daf", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb4b.tmp", "sha1_hash": "faad9f20113781013e8895743428e74fb4abf633", "sha256_hash": "cf4c4c6109dcf0a94857fefd4dc36767bf61ca3885e9e575481096e24f290e4c", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8282b1d20c1cbb3149c3269733801eeb9a3de567", "file_type": "created_file", "id": "file_460", "md5_hash": "5021321237c3cbcedbe86bc2eda5575f", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb6b.tmp", "sha1_hash": "8282b1d20c1cbb3149c3269733801eeb9a3de567", "sha256_hash": "402bea642f6fa667bdd43ffe9acea915addead54da069c3282d074e05c03eb8e", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8282b1d20c1cbb3149c3269733801eeb9a3de567", "file_type": "created_file", "id": "file_462", "md5_hash": "5021321237c3cbcedbe86bc2eda5575f", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb6c.tmp", "sha1_hash": "8282b1d20c1cbb3149c3269733801eeb9a3de567", "sha256_hash": "402bea642f6fa667bdd43ffe9acea915addead54da069c3282d074e05c03eb8e", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/8282b1d20c1cbb3149c3269733801eeb9a3de567", "file_type": "created_file", "id": "file_464", "md5_hash": "5021321237c3cbcedbe86bc2eda5575f", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb6d.tmp", "sha1_hash": "8282b1d20c1cbb3149c3269733801eeb9a3de567", "sha256_hash": "402bea642f6fa667bdd43ffe9acea915addead54da069c3282d074e05c03eb8e", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/95e7c67e66d21b44a437cd408c1fe891073218e9", "file_type": "created_file", "id": "file_466", "md5_hash": "3b6d47524dd9aadcd8087e8066cfedbb", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb7e.tmp", "sha1_hash": "95e7c67e66d21b44a437cd408c1fe891073218e9", "sha256_hash": "8a14e9bef42d8e77d645765a27de8d55846007ef73b48a4cdf37619801f93ce2", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/95e7c67e66d21b44a437cd408c1fe891073218e9", "file_type": "created_file", "id": "file_468", "md5_hash": "3b6d47524dd9aadcd8087e8066cfedbb", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb7f.tmp", "sha1_hash": "95e7c67e66d21b44a437cd408c1fe891073218e9", "sha256_hash": "8a14e9bef42d8e77d645765a27de8d55846007ef73b48a4cdf37619801f93ce2", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ca167eead7432324b32261a98f0b05f6fd581edc", "file_type": "created_file", "id": "file_470", "md5_hash": "f98f23a4f9e6dc8f433d6c263e6ad636", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb90.tmp", "sha1_hash": "ca167eead7432324b32261a98f0b05f6fd581edc", "sha256_hash": "df020e01c7255d67feab95591a7b9b90718d3d556352a17d5bc29c5a8df7cc41", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/ca167eead7432324b32261a98f0b05f6fd581edc", "file_type": "created_file", "id": "file_472", "md5_hash": "f98f23a4f9e6dc8f433d6c263e6ad636", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fb91.tmp", "sha1_hash": "ca167eead7432324b32261a98f0b05f6fd581edc", "sha256_hash": "df020e01c7255d67feab95591a7b9b90718d3d556352a17d5bc29c5a8df7cc41", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/391d3e10403f244ec1919fca4dd1bf5d2180d73a", "file_type": "created_file", "id": "file_474", "md5_hash": "b8403b24cec2c2fe3ad8d388ff5c2692", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fba1.tmp", "sha1_hash": "391d3e10403f244ec1919fca4dd1bf5d2180d73a", "sha256_hash": "232b42d82017c86b66aa5f4dcd362c5be6aee746f55e8465a4eb1e62eb6fae3d", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/391d3e10403f244ec1919fca4dd1bf5d2180d73a", "file_type": "created_file", "id": "file_476", "md5_hash": "b8403b24cec2c2fe3ad8d388ff5c2692", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fba2.tmp", "sha1_hash": "391d3e10403f244ec1919fca4dd1bf5d2180d73a", "sha256_hash": "232b42d82017c86b66aa5f4dcd362c5be6aee746f55e8465a4eb1e62eb6fae3d", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/391d3e10403f244ec1919fca4dd1bf5d2180d73a", "file_type": "created_file", "id": "file_478", "md5_hash": "b8403b24cec2c2fe3ad8d388ff5c2692", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fba3.tmp", "sha1_hash": "391d3e10403f244ec1919fca4dd1bf5d2180d73a", "sha256_hash": "232b42d82017c86b66aa5f4dcd362c5be6aee746f55e8465a4eb1e62eb6fae3d", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d6a7d14aeffddf8a05d8c52aaf0e949cc8af4df9", "file_type": "created_file", "id": "file_480", "md5_hash": "e307f8f8f230a2dd8989867ae53a7840", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbb4.tmp", "sha1_hash": "d6a7d14aeffddf8a05d8c52aaf0e949cc8af4df9", "sha256_hash": "f4d61ad4fa3f52aa710ba9ef52a71b9c8faa9dbbb52ff66c47b4441febe8c6e9", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d6a7d14aeffddf8a05d8c52aaf0e949cc8af4df9", "file_type": "created_file", "id": "file_482", "md5_hash": "e307f8f8f230a2dd8989867ae53a7840", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbb5.tmp", "sha1_hash": "d6a7d14aeffddf8a05d8c52aaf0e949cc8af4df9", "sha256_hash": "f4d61ad4fa3f52aa710ba9ef52a71b9c8faa9dbbb52ff66c47b4441febe8c6e9", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d6a7d14aeffddf8a05d8c52aaf0e949cc8af4df9", "file_type": "created_file", "id": "file_484", "md5_hash": "e307f8f8f230a2dd8989867ae53a7840", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbb6.tmp", "sha1_hash": "d6a7d14aeffddf8a05d8c52aaf0e949cc8af4df9", "sha256_hash": "f4d61ad4fa3f52aa710ba9ef52a71b9c8faa9dbbb52ff66c47b4441febe8c6e9", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/d6a7d14aeffddf8a05d8c52aaf0e949cc8af4df9", "file_type": "created_file", "id": "file_486", "md5_hash": "e307f8f8f230a2dd8989867ae53a7840", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbb7.tmp", "sha1_hash": "d6a7d14aeffddf8a05d8c52aaf0e949cc8af4df9", "sha256_hash": "f4d61ad4fa3f52aa710ba9ef52a71b9c8faa9dbbb52ff66c47b4441febe8c6e9", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/690f3b113810afc8e70466194bf436cc1312b33e", "file_type": "created_file", "id": "file_488", "md5_hash": "644b05368f7512cae99e3857f9027bcf", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbd7.tmp", "sha1_hash": "690f3b113810afc8e70466194bf436cc1312b33e", "sha256_hash": "864f9116027c7a0276777094e7a0f8dc73993c34f9123c7d978ee744e4dbd500", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/690f3b113810afc8e70466194bf436cc1312b33e", "file_type": "created_file", "id": "file_490", "md5_hash": "644b05368f7512cae99e3857f9027bcf", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbd8.tmp", "sha1_hash": "690f3b113810afc8e70466194bf436cc1312b33e", "sha256_hash": "864f9116027c7a0276777094e7a0f8dc73993c34f9123c7d978ee744e4dbd500", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b7e1af9f360642f06d7d75a41e09838bdfc71afc", "file_type": "created_file", "id": "file_492", "md5_hash": "29a8e19f453787602095a98287b92983", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbe9.tmp", "sha1_hash": "b7e1af9f360642f06d7d75a41e09838bdfc71afc", "sha256_hash": "d7c0b9600744ea6c64c05815a19cf3d91ada60e64edeeb3f9a3b5fbc98a22ee1", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b7e1af9f360642f06d7d75a41e09838bdfc71afc", "file_type": "created_file", "id": "file_494", "md5_hash": "29a8e19f453787602095a98287b92983", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbea.tmp", "sha1_hash": "b7e1af9f360642f06d7d75a41e09838bdfc71afc", "sha256_hash": "d7c0b9600744ea6c64c05815a19cf3d91ada60e64edeeb3f9a3b5fbc98a22ee1", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b7e1af9f360642f06d7d75a41e09838bdfc71afc", "file_type": "created_file", "id": "file_496", "md5_hash": "29a8e19f453787602095a98287b92983", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbeb.tmp", "sha1_hash": "b7e1af9f360642f06d7d75a41e09838bdfc71afc", "sha256_hash": "d7c0b9600744ea6c64c05815a19cf3d91ada60e64edeeb3f9a3b5fbc98a22ee1", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/b7e1af9f360642f06d7d75a41e09838bdfc71afc", "file_type": "created_file", "id": "file_498", "md5_hash": "29a8e19f453787602095a98287b92983", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbec.tmp", "sha1_hash": "b7e1af9f360642f06d7d75a41e09838bdfc71afc", "sha256_hash": "d7c0b9600744ea6c64c05815a19cf3d91ada60e64edeeb3f9a3b5fbc98a22ee1", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f40a7f3e6c9d8b7a979d4d776a32767bb79bc89f", "file_type": "created_file", "id": "file_500", "md5_hash": "03b26eefb62150cc56da444a144e9be1", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbfc.tmp", "sha1_hash": "f40a7f3e6c9d8b7a979d4d776a32767bb79bc89f", "sha256_hash": "1160ca78c4e98eda9addcb9966a4e56df9f102fcc1a9e48f3e6f512ff2974b61", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f40a7f3e6c9d8b7a979d4d776a32767bb79bc89f", "file_type": "created_file", "id": "file_502", "md5_hash": "03b26eefb62150cc56da444a144e9be1", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbfd.tmp", "sha1_hash": "f40a7f3e6c9d8b7a979d4d776a32767bb79bc89f", "sha256_hash": "1160ca78c4e98eda9addcb9966a4e56df9f102fcc1a9e48f3e6f512ff2974b61", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f40a7f3e6c9d8b7a979d4d776a32767bb79bc89f", "file_type": "created_file", "id": "file_504", "md5_hash": "03b26eefb62150cc56da444a144e9be1", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fbfe.tmp", "sha1_hash": "f40a7f3e6c9d8b7a979d4d776a32767bb79bc89f", "sha256_hash": "1160ca78c4e98eda9addcb9966a4e56df9f102fcc1a9e48f3e6f512ff2974b61", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/919343acf762452776e634a9bf202c30fb6a7f9b", "file_type": "created_file", "id": "file_506", "md5_hash": "474a65b62cb05adc115bbd1ede09301b", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc0f.tmp", "sha1_hash": "919343acf762452776e634a9bf202c30fb6a7f9b", "sha256_hash": "99eae660e8a11ebd18d71e8faf2fea8b3cfc95ae93bf339ff326e8e65b53a293", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/919343acf762452776e634a9bf202c30fb6a7f9b", "file_type": "created_file", "id": "file_508", "md5_hash": "474a65b62cb05adc115bbd1ede09301b", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc10.tmp", "sha1_hash": "919343acf762452776e634a9bf202c30fb6a7f9b", "sha256_hash": "99eae660e8a11ebd18d71e8faf2fea8b3cfc95ae93bf339ff326e8e65b53a293", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/919343acf762452776e634a9bf202c30fb6a7f9b", "file_type": "created_file", "id": "file_510", "md5_hash": "474a65b62cb05adc115bbd1ede09301b", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc11.tmp", "sha1_hash": "919343acf762452776e634a9bf202c30fb6a7f9b", "sha256_hash": "99eae660e8a11ebd18d71e8faf2fea8b3cfc95ae93bf339ff326e8e65b53a293", "size": 8, "type": "extracted_file", "version": 1 }, { "archive_path": "extracted_files/f1923f3d154592e13686c626a452c5712572c703", "file_type": "created_file", "id": "file_512", "md5_hash": "e6a85d90c192b656121d5fb773bc9c7c", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\fc22.tmp", "sha1_hash": "f1923f3d154592e13686c626a452c5712572c703", "sha256_hash": "4ab81fc69870779cdfccf4c642b53c832301c6173f803deb225a6e428b875813", "size": 8, "type": "extracted_file", "version": 1 } ], "process_dumps": [ { "archive_path": "process_dumps/process_00000001-region_00000001-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "filename": "process_00000001-region_00000001-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "id": "proc_dump_514", "md5_hash": "b31e4ef1b23217660362c1477fe24460", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "3de0ac5bc787558aa4b2fa0567b698c71ad91f82", "sha256_hash": "a3f0fd86e613ee209b3be803a156d666b6d27052dc714bc3d8a3ae4323c4a6cb", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000002-addr_0x0000009c3c600000-size_0x0000000000020000-perm_rw.bin", "filename": "process_00000001-region_00000002-addr_0x0000009c3c600000-size_0x0000000000020000-perm_rw.bin", "id": "proc_dump_515", "md5_hash": "fdb41decab05b449458d44dc61c8b2bc", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "c209cc481c8833be70ea7d5ad7333665e76d6daa", "sha256_hash": "151f997a30ca7d1f42c74476613743eb1485ac90e364046d39f439d4841c1063", "size": 131072, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000004-addr_0x0000009c3c640000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000004-addr_0x0000009c3c640000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_516", "md5_hash": "fce7779a2f066f06cf8bf231539fe442", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "41cfb772d08e985b1434e6dc60883c2136133251", "sha256_hash": "beb5dcf6e6a0cd8fb4c4969441828f89b96fafee7b8558807d5d8da7ef32d2dd", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000007-addr_0x0000009c3c760000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000007-addr_0x0000009c3c760000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_517", "md5_hash": "48f71d94b4497c07d29edd204ac73634", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "d0dbc13258ce427f599ff96e8ae98b68a155fae5", "sha256_hash": "e4702b903d77ec0bacde716b1ba080868d45574a82d21bf7e39e560a416da654", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000010-addr_0x00007ff7cb69c000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000010-addr_0x00007ff7cb69c000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_518", "md5_hash": "6772028e2444ef7000e5377bbfe32f91", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "b69b8590745d26f2996d13568620e64ccd55b459", "sha256_hash": "ecb1e927efcee113d4d7d822f41d068aa4fec12ad7f2e6ae079b3e30eae1cdaa", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000011-addr_0x00007ff7cb69e000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000001-region_00000011-addr_0x00007ff7cb69e000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_519", "md5_hash": "cf356718b04769105f70a5f4636f79a6", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "365b9d75703db00456f349fff9c3fb56d014e14f", "sha256_hash": "5d3950cf6aa4b6ceefab5912f77f49d18ecbdc943238e3d1fe6fd99e6cd9b861", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000153-addr_0x0000009c3c7b0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000153-addr_0x0000009c3c7b0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_520", "md5_hash": "3cd64dbda90f47648133d29271163f82", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1ea89eec792c26dcaa8b8aa7fb53c6d74c9f27be", "sha256_hash": "52cb60c3b652215b209ad9f52325291e99ea3ec07bcc595baaf39cc31bf91063", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000231-addr_0x0000009c3c610000-size_0x0000000000007000-perm_rw.bin", "filename": "process_00000001-region_00000231-addr_0x0000009c3c610000-size_0x0000000000007000-perm_rw.bin", "id": "proc_dump_546", "md5_hash": "1c8e08051fad13c54a3c7003a6ee41dd", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "5b9d7d649c14aa8e4c60f74d67ee458bb3fa8b10", "sha256_hash": "9ee17bbb3d1eddb45962a0c013255e006bccb2b6da0c2d0451cadfcb4154ae68", "size": 28672, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000233-addr_0x0000009c3c970000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000233-addr_0x0000009c3c970000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_547", "md5_hash": "22be3d2d532aef3597ae259d380a4651", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "73e6bbe62af0ade7ceb260d197752db07079ed52", "sha256_hash": "9f03f0b5355a31376383788cb351166d47854854747e636122dbf9df1be1f746", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000235-addr_0x00007ff7cb69a000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000235-addr_0x00007ff7cb69a000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_548", "md5_hash": "8d4df1dceadff359b27f0ff514363ba3", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "a1476712103bce3b6c6a327b3363f21cad48f7cf", "sha256_hash": "06a3b3d76f37ea786ddd1d8c839b70d9d254af98d7e7b68bfdd8787533392678", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000246-addr_0x0000009c3c770000-size_0x0000000000007000-perm_rw.bin", "filename": "process_00000001-region_00000246-addr_0x0000009c3c770000-size_0x0000000000007000-perm_rw.bin", "id": "proc_dump_549", "md5_hash": "f642c63b98296482ae5e74065923a679", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "b376eac3404eff9af3831574ed0fd7b1b7cd5094", "sha256_hash": "8499b4465df5d0ccc932f99531a25854759a7bae520ad146eaffa944977752c8", "size": 28672, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000247-addr_0x0000009c3cb20000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000001-region_00000247-addr_0x0000009c3cb20000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_550", "md5_hash": "5eec048b49f2890a4355266358916451", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "67e80d0e72c4038148dc6facff23d34c52a28032", "sha256_hash": "b4ee4f6d43102d2916748d20a41be3af30b76c8993abd7d678d6eaec673316dd", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000252-addr_0x0000009c3c790000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000001-region_00000252-addr_0x0000009c3c790000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_551", "md5_hash": "8f4a4b4f4164b296bbe013344ebbe2f9", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "cbf5f576bc3b172fb41e8f0a39bcaf6aa41343ff", "sha256_hash": "92e3895c70fdcc527f1b35eda4a4c52ab576c68bf6a95b992df776c5408a7ee7", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000253-addr_0x0000009c3c7a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000001-region_00000253-addr_0x0000009c3c7a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_552", "md5_hash": "baa095d0f424ded37169dccfabe2a48b", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "13de5554742b8bdbbac3f1dd140af759f9f055a4", "sha256_hash": "556d13cdbbe748d7480e2434b1f1d58ff20c3c4211c0491da0abbd118c4e58cc", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000260-addr_0x0000009c3ca70000-size_0x00000000000b0000-perm_rw.bin", "filename": "process_00000001-region_00000260-addr_0x0000009c3ca70000-size_0x00000000000b0000-perm_rw.bin", "id": "proc_dump_553", "md5_hash": "63e90f70700e1640426f351176646116", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "6810c338b6591109e76470ce61e634d4c97f503e", "sha256_hash": "9d9630caf0f60c4ceea78774c62d25e87b03af5effdde858029b61a09d48210a", "size": 720896, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000263-addr_0x0000009c3cb10000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000001-region_00000263-addr_0x0000009c3cb10000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_554", "md5_hash": "d5f0c6e7edd735e45c9410cf9f8d277c", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "968d95a4d73864496365fd4ede465bdaf9ff048b", "sha256_hash": "27a21f9679201ab380dd165c3a233762c136b4e01132ed6eb2363352d4e20af1", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000265-addr_0x0000009c3e590000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000265-addr_0x0000009c3e590000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_555", "md5_hash": "1e60b9b4564480f25b9e04be7a8224b9", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "721a94fcd0d185ab08e5dea0919e395acb610e5a", "sha256_hash": "b59b4988d060c3657189468acf625d7009ae8aece63d5549f10b2be2e125bcf2", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000266-addr_0x00007ff7cb698000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000266-addr_0x00007ff7cb698000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_556", "md5_hash": "5d5c58b86efe36f0857795437617142d", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "9ace136819bbe5b2134011252ad9c4e266869903", "sha256_hash": "9fe53b9a9b72eb6febc93bb4af45a9a3f06d4a976683a2b5b0a0235a8e790717", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000280-addr_0x0000009c3e750000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000280-addr_0x0000009c3e750000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_557", "md5_hash": "e14b11d89cf2f84eb9c0e78da244f85b", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "f207b6493b8f8f0037e3c7515333ea30cef62750", "sha256_hash": "f7aaf0194a5cdd600a7a6dbeee63fcbc4f4e016c495108868886e64208a4b8b8", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000290-addr_0x0000009c3e850000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000290-addr_0x0000009c3e850000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_558", "md5_hash": "ce48ddef5e648a364c0ec7c67ac8dc90", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "eb7e99a315e97f8fa50aaa58e0d680420d6d59c9", "sha256_hash": "785a228f9a489895c11b487c6e867a8e8683b9598720cfd86ae3defdd2ae4e4c", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000291-addr_0x00007ff7cb696000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000291-addr_0x00007ff7cb696000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_559", "md5_hash": "852c4f53559e2dde3d6af69090914d0d", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "434c6c2ef6b038beb326cec97af3e0a90e9a1784", "sha256_hash": "aa5596e05012a142bdd4a06590efff81a7d3bfb8fbe628415535db6f8179132a", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000296-addr_0x0000009c3e950000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000296-addr_0x0000009c3e950000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_560", "md5_hash": "fb982e083096a2080fc840ca67d6225d", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1ead9f28b7c508ee5f60569271d29b31b73d5d6c", "sha256_hash": "bc478991579f9792ba073618915ad3da3974c1268973fd49c6b091db66adcc93", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000297-addr_0x00007ff7cb694000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000297-addr_0x00007ff7cb694000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_561", "md5_hash": "ba34e3f622759f5cb1cf576e33196fae", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "d4733f73c976c1a88bddc485039e0e1b12fc11e7", "sha256_hash": "9e6282b9ac25d891c6cc5e1b1e6869d00f8dc37cca6438a2c9c23134cf5ebb59", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000304-addr_0x0000009c3ea50000-size_0x0000000000110000-perm_rw.bin", "filename": "process_00000001-region_00000304-addr_0x0000009c3ea50000-size_0x0000000000110000-perm_rw.bin", "id": "proc_dump_562", "md5_hash": "28aacf06daa8e9db9452491d6c489f61", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "8006c2f2b6fd44bf3833200eb50426f4a769ab9b", "sha256_hash": "9362e0447e333bcc77fddf6663d4006e040c874bb1e3c056f2420d526323dcad", "size": 1114112, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000305-addr_0x0000009c3cad0000-size_0x0000000000007000-perm_rw.bin", "filename": "process_00000001-region_00000305-addr_0x0000009c3cad0000-size_0x0000000000007000-perm_rw.bin", "id": "proc_dump_563", "md5_hash": "fe1fc4a0f702ebcbbe6bb00cd82a71a2", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "2ff7e1c73be006cb5f87cb152ac2968f2fae319c", "sha256_hash": "185d73c5c4ed071ead40fe41f3980c72373352a82a7c3b8557d4cba3da40dfbf", "size": 28672, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000306-addr_0x0000009c3eb60000-size_0x0000000000200000-perm_rw.bin", "filename": "process_00000001-region_00000306-addr_0x0000009c3eb60000-size_0x0000000000200000-perm_rw.bin", "id": "proc_dump_564", "md5_hash": "0e87414e9e7f196059b8013fe6c59505", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1688e16b0764fb64a9e8a0b931621f9f7f9c8afa", "sha256_hash": "90b6695a0f6a1b2faee891cab919da0923eab8ec36d429b207b6eec3d6c89d60", "size": 2097152, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000307-addr_0x0000009c3cab0000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000001-region_00000307-addr_0x0000009c3cab0000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_565", "md5_hash": "d5d74d4b4de7268c2322909c0fe05b27", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "fd59ae9a095dd63b2de2dc94f6d7adab95cd7d68", "sha256_hash": "922ca5e98ccc811cbd33a53db003fe7a03120a1ee056fdc8e1c9ff15933977d5", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000311-addr_0x0000009c3ea50000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000311-addr_0x0000009c3ea50000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_566", "md5_hash": "beb9e7dba0e5a6e739863f94794e93e0", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "e61d82d2976c3c90bdd556e582c8b4e1748f3e2c", "sha256_hash": "c10e7721b11783ade89fce12209d238033d373e4f96291a85bcc0d388ff6a5cc", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000312-addr_0x0000009c3eb50000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000001-region_00000312-addr_0x0000009c3eb50000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_567", "md5_hash": "0a13bcd3270ee8d2fd5a40b9f59df0ee", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "f5083e191b99720ed86b59f958e2246cb5c2e837", "sha256_hash": "b08d3d293e8b67e7a2124c33ed4944d77da55d84481bf11c9f34be92388a75b8", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000313-addr_0x0000009c3ed60000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000313-addr_0x0000009c3ed60000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_568", "md5_hash": "16e18b0277292a536209b80743e43e4e", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "d8e68f147740a645154cc1b1002f6d5b07d68b17", "sha256_hash": "abc640094cf872d14abdd14146bce0c2d00a8fd6a1db7cbfc0aac4a43e8f6404", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000314-addr_0x0000009c3ee60000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000314-addr_0x0000009c3ee60000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_569", "md5_hash": "cc06b80858b870e6bff7873f3cc56290", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "a76defb44e359ac9cfba754d8b6ed26ccd7b4c39", "sha256_hash": "d1f9ed9f5c0119d9db28cfda4c60160d4c8e178de1feaadf2e0cd22c4339ad8d", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000315-addr_0x00007ff7cb56a000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000315-addr_0x00007ff7cb56a000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_570", "md5_hash": "39c8e9dc6e5b248da2c80016e78e2b48", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "2720bb8638d1762532fd5e12e5d0e0485abe44a6", "sha256_hash": "f96272805a73e653079632efdc0858e6b0b86276873462989f5b24b736a2e344", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000316-addr_0x00007ff7cb56c000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000316-addr_0x00007ff7cb56c000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_571", "md5_hash": "a587680dfe23934becd69a6db744540e", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "2fb90daf908e380f8b67f91bb6610541525aff1f", "sha256_hash": "5deb93c2de09e63b0325e829a65103378bc9e53a26f1148b9aae94b02eb41a12", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000317-addr_0x00007ff7cb56e000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000317-addr_0x00007ff7cb56e000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_572", "md5_hash": "d936ace386c96ea25b6aca54fe27f80d", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "39061ca9406789204e2797804080e9e0bf31eb4d", "sha256_hash": "e89a1f182bb54e4cdf5440297cc2dc35085a89edcf9a286cf2bab1542953a26c", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000322-addr_0x0000009c3ef60000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000322-addr_0x0000009c3ef60000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_573", "md5_hash": "18842ecadfa1cac7157291b26ad91884", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "91df63be9c76b0710427feb658c9690fe8b7ba08", "sha256_hash": "deae16fdde02c4c4572b72a4f4991ace27c237cd280a97084e77f5847f345e2f", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000323-addr_0x0000009c3f060000-size_0x0000000000400000-perm_rw.bin", "filename": "process_00000001-region_00000323-addr_0x0000009c3f060000-size_0x0000000000400000-perm_rw.bin", "id": "proc_dump_574", "md5_hash": "f94131f1dbc9f0ea6cbf4480aaf17a32", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "dcf9ec4d815510f16342931b515cc2b9259b6163", "sha256_hash": "e563a3fc36b7bc772821d361db76e140b52379ccc94e2e8ef2593fb8b6138d35", "size": 4194304, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000324-addr_0x0000009c3f5b0000-size_0x0000000000200000-perm_rw.bin", "filename": "process_00000001-region_00000324-addr_0x0000009c3f5b0000-size_0x0000000000200000-perm_rw.bin", "id": "proc_dump_575", "md5_hash": "f377b453cb2496ab5daad67e4627182c", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "50970ebcb47ed1447584ae38ea57f4b8215578bd", "sha256_hash": "60ad1ed32f33d33bd00f344051c9a48ccfd4f99901f23498792d890abc54c255", "size": 2097152, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000325-addr_0x0000009c3f7b0000-size_0x0000000000800000-perm_rw.bin", "filename": "process_00000001-region_00000325-addr_0x0000009c3f7b0000-size_0x0000000000800000-perm_rw.bin", "id": "proc_dump_576", "md5_hash": "53456edcadcc5e0a4ac7be1e93963e95", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "099624f7a2f05271d2168dca28778ae45d1f27b4", "sha256_hash": "de23fd301ca617cbbcafe183c380c71285fa5fdfd6ed5822d81157eaef780a23", "size": 8388608, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000326-addr_0x0000009c3ffb0000-size_0x0000000000400000-perm_rw.bin", "filename": "process_00000001-region_00000326-addr_0x0000009c3ffb0000-size_0x0000000000400000-perm_rw.bin", "id": "proc_dump_577", "md5_hash": "6673ad410160c45ca163432a68880052", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "964b33c9dc3696c413101b45fe298011d4539213", "sha256_hash": "3506baca19da019a3cf00a2a23c324afcb9fa773afee0892f39b528cc06cd987", "size": 4194304, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000336-addr_0x0000009c3f460000-size_0x0000000000050000-perm_rw.bin", "filename": "process_00000001-region_00000336-addr_0x0000009c3f460000-size_0x0000000000050000-perm_rw.bin", "id": "proc_dump_578", "md5_hash": "f9a70fbb470e8ee722a6a861f92e77fd", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1fe9b15888b611ac2daf72ed05d3eb9596355d21", "sha256_hash": "94a8ae99fbdd545a4574c96197929edb8913a9f5921e90cb543ca9e13ee5e22a", "size": 327680, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000337-addr_0x0000009c403b0000-size_0x0000000000140000-perm_rw.bin", "filename": "process_00000001-region_00000337-addr_0x0000009c403b0000-size_0x0000000000140000-perm_rw.bin", "id": "proc_dump_579", "md5_hash": "aa9a79f5d493768139d70f134065c2ab", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "57e171aa5a33024f9adee2007d75eb7811f78c1e", "sha256_hash": "94f949772fb65b5a89d807945c27985771aab4eee1c4a8e3c0652992c0e02130", "size": 1310720, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000338-addr_0x0000009c3f4b0000-size_0x0000000000060000-perm_rw.bin", "filename": "process_00000001-region_00000338-addr_0x0000009c3f4b0000-size_0x0000000000060000-perm_rw.bin", "id": "proc_dump_580", "md5_hash": "84f0ecc93d83006e47578f97b8a5be56", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "6c6ab14476089ec67a45d46ed1d7c6f1e1768fd3", "sha256_hash": "b41de681c1e4c840300169e0c0310716fb194ee31afa6c57aac19b373716cc0f", "size": 393216, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000339-addr_0x0000009c404f0000-size_0x00000000001e0000-perm_rw.bin", "filename": "process_00000001-region_00000339-addr_0x0000009c404f0000-size_0x00000000001e0000-perm_rw.bin", "id": "proc_dump_581", "md5_hash": "c3804cc4549ffd863be87aa531587dd6", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "5b6a80d077b1efc40ebbbca19cabdb0c50bfe006", "sha256_hash": "11892077d1227b1372cb1cd5317621d49ccd31582be94dddd83ef43bbc1e2ea8", "size": 1966080, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000340-addr_0x0000009c406d0000-size_0x00000000001f0000-perm_rw.bin", "filename": "process_00000001-region_00000340-addr_0x0000009c406d0000-size_0x00000000001f0000-perm_rw.bin", "id": "proc_dump_582", "md5_hash": "be3104ab7e9859631658349e4304a35e", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "14af18bf4584f850799288969d7fa8ee1d7a8c58", "sha256_hash": "b5afa04785a6d75fbd6e8a877e20aa772562f22fdbbcc126b9e5fe8156d8af05", "size": 2031616, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000342-addr_0x0000009c404e0000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000001-region_00000342-addr_0x0000009c404e0000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_583", "md5_hash": "b3283aba7d69ed245328130695ac29c3", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "3de7d290d39a31311963a7a567ff77ec83ae65a9", "sha256_hash": "d3b9dd0c207c40b81ffdb2ce38b590934467bd174631b231e2ba62c07e1a9e38", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000343-addr_0x0000009c408c0000-size_0x0000000000400000-perm_rw.bin", "filename": "process_00000001-region_00000343-addr_0x0000009c408c0000-size_0x0000000000400000-perm_rw.bin", "id": "proc_dump_584", "md5_hash": "18fe5c2b9712af0214c9c72f2d9cbfdf", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "098eed4ce1068be80e735f3a22fdc295c78a533c", "sha256_hash": "802e69fd850f5000506c3d9fd46531057105fd8bd12d04bcbc89aa11ca732cf0", "size": 4194304, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000349-addr_0x0000009c3f460000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000001-region_00000349-addr_0x0000009c3f460000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_585", "md5_hash": "19039e05bf3b22409e47bf9d71319a59", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "487dde8ae1f7eeab001897df244ccdd4fd385d67", "sha256_hash": "541a4cc5d36669c5951bdde2f0d6512d2e8b641702f6f41243901f800716991f", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000350-addr_0x0000009c3f4a0000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000001-region_00000350-addr_0x0000009c3f4a0000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_586", "md5_hash": "762c588654310453dd43e6c726f8f2e7", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "7e79eeb1696599961e275ff046d9a9af5c85639a", "sha256_hash": "36e42676d74c0cbf7532e3259484d9f4edb9cb2f817506dc3267d347d9ade935", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000368-addr_0x0000009c3f500000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000001-region_00000368-addr_0x0000009c3f500000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_587", "md5_hash": "a185bcb26268e41a69286c6b74ecfc33", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "f3ec99fbbde2aa822cb2d33e77cb0113dc6b7ac2", "sha256_hash": "ad3da8faab4cf778f1f091317c386255f6a8df2202d8f27b0504455c2e4faba8", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000370-addr_0x0000009c3f4d0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000001-region_00000370-addr_0x0000009c3f4d0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_588", "md5_hash": "ea556faf7c7f691dfa427eced1d9db59", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "ee05d2abce54980bc091a4e95a7f328e62da949b", "sha256_hash": "369f675e5bc08c6c1e0ac11a391e13d9ef38d59c97a6bb7015f129cbc7282173", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000378-addr_0x0000009c404f0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000378-addr_0x0000009c404f0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_589", "md5_hash": "a0016ecfb8db7cd37e3b6e56d9c62556", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "73491d2f7c77d3bad1b39b08e4d0d8edc53ddb80", "sha256_hash": "00615af1ec18c87240208071f92e08f3584084c939516c443bdb8183f5b940f4", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000379-addr_0x0000009c406c0000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000001-region_00000379-addr_0x0000009c406c0000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_590", "md5_hash": "5e73612672363dc726effdc4788e963b", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "648da4a3758db09d5c539ca1a612de9fea029cbb", "sha256_hash": "3f6b785baa1907dd14f8d8b103fff65d41549a9b83ca573d4f0768cef428f362", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000380-addr_0x00007ff7cb568000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000380-addr_0x00007ff7cb568000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_591", "md5_hash": "f8abb0fb24e9e4715498b529c37536fd", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "0927852d79a1907be0577c4ebbb63369f6b031c1", "sha256_hash": "565c1d1cb1fac735498a02d1715fb29e36aa6a3ffbfded9753e2cb215d3dc378", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000386-addr_0x0000009c406d0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000386-addr_0x0000009c406d0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_592", "md5_hash": "2fe53fd6a97ba5201ed7085c2ae4816f", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "b7239a123ebc0d9bb66d5839e6797c51654d3945", "sha256_hash": "7005c15d6dddf3d68e583d8a346da38f5168b262cc1402aeccb4ed9a51ffc731", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000387-addr_0x0000009c408b0000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000001-region_00000387-addr_0x0000009c408b0000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_593", "md5_hash": "ef71efc5b6dcc5442043bf416c8bc040", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "592ea04de606458a02a34f19ff55ffc2e0beb453", "sha256_hash": "a03a50172c464a77788629942225d41fc6844c56825e55ade2b85f87040fc9ae", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000388-addr_0x0000009c40cc0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000388-addr_0x0000009c40cc0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_594", "md5_hash": "7cc7ae358017d9f6a6086166b0843618", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "7d4cd1000e52f4bf78d2a0bafa87a1656b46171a", "sha256_hash": "3c944e05be254b505846227ab2bbdbe4126adf2d47a896328c21f0aed518dabb", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000389-addr_0x0000009c40dc0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000389-addr_0x0000009c40dc0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_595", "md5_hash": "0c21542e6b54e8ada1524645a35316f6", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "778016507c88780299116d1f78eb24b48c25863a", "sha256_hash": "ea2e40813031f7aa9707277dcb5937d4581ba0191e25e9c525145cc4ff9865ec", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000390-addr_0x00007ff7cb562000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000390-addr_0x00007ff7cb562000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_596", "md5_hash": "688cdf7b8b359f266aa7cccb84d876b4", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "bcedd88467b71b71965c9150d3b1bb9d8c58fccf", "sha256_hash": "25068d6db793f4cbc91db36b7a77c5b02470b70eabf108b095f131840f4bed14", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000391-addr_0x00007ff7cb564000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000391-addr_0x00007ff7cb564000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_597", "md5_hash": "509b1e8876b6894e66905604319bb11b", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "fdd449123eaa2fc57e1e2daceb72ed1b2ad60c35", "sha256_hash": "defbe5664802958b727bdf76fe466db88daac3c8abd70bde32a4e2043989ab9d", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000392-addr_0x00007ff7cb566000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000392-addr_0x00007ff7cb566000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_598", "md5_hash": "849d85c24fcbbafc41af45ef2a2b98a9", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "9998bc714771781741da695bae378360fb8db142", "sha256_hash": "a32744830881f00d132ed0edc94d688b8557f4de893131cb1a5f4b797c824acd", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000395-addr_0x0000009c404f0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000395-addr_0x0000009c404f0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_599", "md5_hash": "f91b514e56f2fa80b62bff4535e050f7", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "84708b4f4e93ea9c48932e8938cf673df9004ce6", "sha256_hash": "6dbced37378149f4d49b9cd66093e041db5b00aa3c280abad649cf16dc96097e", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000398-addr_0x0000009c40dc0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000001-region_00000398-addr_0x0000009c40dc0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_600", "md5_hash": "93b4affd44f3173a8653fb38149cb55f", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "b2c99ce07b77c21bdead4f0dc398b7c11a963f3a", "sha256_hash": "461eabb58777d5591b8f09dde072282cbeb43046fc37c20a81039a9d24e2a66d", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000001-region_00000399-addr_0x00007ff7cb568000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000001-region_00000399-addr_0x00007ff7cb568000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_601", "md5_hash": "1863ecfab4cfa06b02b77fae7de2f020", "ref_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "f6d9e0d5fa0a14bf3962ba0cfc8ec0a47ad92f4a", "sha256_hash": "50a09ded01a5eb60e5b1463452da8536d0b7cb0097d900b62687c5acd841caaa", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000410-addr_0x0000000000010000-size_0x0000000000020000-perm_rw.bin", "filename": "process_00000003-region_00000410-addr_0x0000000000010000-size_0x0000000000020000-perm_rw.bin", "id": "proc_dump_602", "md5_hash": "5a5dd02f4f14d08701859625c90ad566", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "506aafeed845327b40d9f8eba84037acae3e692a", "sha256_hash": "caa14ca6480b2dc5b2000d1e0bd576a7ba06878761c0b76a9d7560b4f5d1a816", "size": 131072, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000411-addr_0x0000000000030000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000003-region_00000411-addr_0x0000000000030000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_603", "md5_hash": "5c6a1395a2d987e5debd706dbd6b0d1a", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "c8fce3b14cd60bce680907ce083b515ac61e399e", "sha256_hash": "05df36442bd0da6737e4631dd057f3c86449311852dae1645fa963b1c03384a1", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000413-addr_0x0000000000060000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000003-region_00000413-addr_0x0000000000060000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_604", "md5_hash": "3806fddeb83d040b99d55a05dd19a321", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "dd74972fe9c136910b9b24267ba358da92396053", "sha256_hash": "b5101241ea911ffe1609d5a2cc3e45d9e295b2e01be314519a23f0cbe45da659", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000414-addr_0x00000000000a0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000003-region_00000414-addr_0x00000000000a0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_605", "md5_hash": "6cc08519494e2ed60780cddeacfc48f4", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "dd49bb2f13901a72098d497848fd51966ca57840", "sha256_hash": "1294cc72f0d6d64892d42cea179135cd1020e0981e95f162f557b9a9b280beb5", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000417-addr_0x00000000001c0000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000003-region_00000417-addr_0x00000000001c0000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_606", "md5_hash": "d252f3f0401b8c317cb054c4b35f7939", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "c1826f2d02b158915ef73a1f6fc60a0c6dd97e4c", "sha256_hash": "f57f6f97e1840ef149534a78db51a61d5535bf4bf91390ca36d77523f6601df3", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000418-addr_0x0000000000400000-size_0x00000000000a2000-perm_rwx.bin", "filename": "process_00000003-region_00000418-addr_0x0000000000400000-size_0x00000000000a2000-perm_rwx.bin", "id": "proc_dump_607", "md5_hash": "011e0e6e6f0e8bf84a2facd0526b84b6", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "be81e5726a3661066957d1d23fb8cde7b47253e0", "sha256_hash": "7dc30378a0fce9df9bd6f7d16e4ffafb27b48a93ecf17cc32927e104c91ec57a", "size": 233472, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000421-addr_0x000000007ffdb000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000003-region_00000421-addr_0x000000007ffdb000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_608", "md5_hash": "503bc0ff0942e6096568850063f0004d", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "63154966de7fbaa9ce9a3d12ab3bd85a86ebdb63", "sha256_hash": "048816518ca18d7cecfa6f3d566d5009a33a58b763442dafd47658138dc331a8", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000422-addr_0x000000007ffde000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000422-addr_0x000000007ffde000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_609", "md5_hash": "6b907209f5e06c286c3d911199e683fc", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "8cae8442f3e957f79f50df8cd163768f46e940af", "sha256_hash": "9904cf511ff8849199871dca972cec322dd07264e79f209a8dbab54aa524763f", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000423-addr_0x000000007ffdf000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000423-addr_0x000000007ffdf000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_610", "md5_hash": "fdc6a804a390eb9094cc988adcae8d98", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "65b7548e5083ef3a6f57e7312e5dc5009c506610", "sha256_hash": "7facbb38098a4e5471b337e8da9611214bf3b1d2ee087b01f31de66782eefb7a", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000424-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "filename": "process_00000003-region_00000424-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "id": "proc_dump_611", "md5_hash": "a2f4549f501f518c34dc6d34ba6f1760", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "c5dc18a4ef2f7190b845fe0fd9d51d79b16ff543", "sha256_hash": "81e651f57c9f7fa7b29fb0ecc11e5659246a95e5cef690a3bea5f81c248cdf44", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000428-addr_0x0000000000210000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000003-region_00000428-addr_0x0000000000210000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_612", "md5_hash": "0aac9ea3cc188a6c98cbb6544db4b904", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "5c6b25c540d175b1cea45ad3fac2d89b7fd50f33", "sha256_hash": "b65af26978311ba30a88c369b72bec27882185eb6de771362bafce2217d56d5b", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000432-addr_0x00000000002c0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000003-region_00000432-addr_0x00000000002c0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_613", "md5_hash": "dd3bae2cd2a8f3368e008095cbe7c21f", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "ca6300f6283830fc8f314060f0d8265e2760007a", "sha256_hash": "0de418c98480a3b97ef293f95acd994ec4c0b1daaf42f746b8a8da6c59038f50", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000439-addr_0x0000000000020000-size_0x0000000000004000-perm_rw.bin", "filename": "process_00000003-region_00000439-addr_0x0000000000020000-size_0x0000000000004000-perm_rw.bin", "id": "proc_dump_614", "md5_hash": "023b316a2a9454ef7253648b37562f98", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "81a619b4f1511719be62adb71bcc7b2fad50bac7", "sha256_hash": "b3c7aeedb27a7c6e900a827faa25c335ca1acb38d11391b66a90138c828ba65c", "size": 16384, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000440-addr_0x00000000001d0000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000003-region_00000440-addr_0x00000000001d0000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_615", "md5_hash": "4fbf4370408b7ef0ad611b1db43c052b", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "6be3ba6950ed5b0b60e710393a2c6b8ecf1f00c4", "sha256_hash": "08bec8775eab6a007d3968fb890f51d44692c16e0bab6c3c82a1c2b0371c4201", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000441-addr_0x0000000000570000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000003-region_00000441-addr_0x0000000000570000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_616", "md5_hash": "a0593b30511ee32cbb9a85b48a10b62d", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "e2ef69d0ea48e9bf73fd4edbd2e52c921d36ad6f", "sha256_hash": "a42b095d9b399f0d840b1c28b07e756846358d51b8c8d083db5e5af2587c2d03", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000444-addr_0x000000007ffd8000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000003-region_00000444-addr_0x000000007ffd8000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_617", "md5_hash": "8327763633196f3bc16fdba458df8413", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "e59e163a8d4421a4832319fd7a2b9f16e7f675a3", "sha256_hash": "36c00f6255fc3425a5369492a036eb851592ccf6beca8235e217a52ea4d66506", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000449-addr_0x0000000000030000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000449-addr_0x0000000000030000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_618", "md5_hash": "da9adb0edff6b1288bb306a461ced314", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "7998f849a970a20fa4f1f914856f34aee7b77ad0", "sha256_hash": "b0497522164234977a6922b917cf9bc4d3b87a6ec589bd936c1b63b108f7479d", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000450-addr_0x0000000000220000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000450-addr_0x0000000000220000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_619", "md5_hash": "620f0b67a91f7f74151bc5be745b7110", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d", "sha256_hash": "ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000451-addr_0x0000000000800000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000003-region_00000451-addr_0x0000000000800000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_620", "md5_hash": "135f7f7045df4d74fabd26d021f70f8c", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "030c66cd89f1e3ffdcd7e12e2736a66da1fc603c", "sha256_hash": "c82dafe4f5fe2e40007d684f5732e816cfc5c7ae163961123df2894814821a53", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000452-addr_0x0000000000980000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000003-region_00000452-addr_0x0000000000980000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_621", "md5_hash": "e18eba3886f4225a23c1642ca1010c4e", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "e5950e2306c264dad7f4ee82113cdb37b28eeb6d", "sha256_hash": "7be434017a6072e2fac3334d5ef97d2f3e3337e785d0c6c90405a47bfa5a8ede", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000455-addr_0x0000000000230000-size_0x000000000005d000-perm_rwx.bin", "filename": "process_00000003-region_00000455-addr_0x0000000000230000-size_0x000000000005d000-perm_rwx.bin", "id": "proc_dump_622", "md5_hash": "fe6fcb2a6d658c365af8fa87749e1a70", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "b47d3a3a0b473ff4ffcf1d8fc0e492ba0e598046", "sha256_hash": "36e7aec3b4f772eaf4af21df11763a721a86c6b0f5a9999198ef3da754066b31", "size": 380928, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000456-addr_0x00000000003c0000-size_0x0000000000039000-perm_rwx.bin", "filename": "process_00000003-region_00000456-addr_0x00000000003c0000-size_0x0000000000039000-perm_rwx.bin", "id": "proc_dump_623", "md5_hash": "9027f44e1381c39896007f837bc6b9fd", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "2a601ac81865af4849c6d637395b01e2f4d793e7", "sha256_hash": "b974e1341550d6982c9f046d0f8231cd5f872cf20d07f6f0ad9da3dd6082a4be", "size": 233472, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000457-addr_0x0000000000290000-size_0x0000000000001000-perm_rwx.bin", "filename": "process_00000003-region_00000457-addr_0x0000000000290000-size_0x0000000000001000-perm_rwx.bin", "id": "proc_dump_624", "md5_hash": "984f3c47e8c6b0e234c22be619a61719", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "38e28923bb389804af8465e4976a0ef27c4d3bef", "sha256_hash": "e57bc3567e07d3f0d15edcec830e0bdcab60d6455b1a7b37d5be8d5b328849fc", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000458-addr_0x0000000000800000-size_0x0000000000039000-perm_rw.bin", "filename": "process_00000003-region_00000458-addr_0x0000000000800000-size_0x0000000000039000-perm_rw.bin", "id": "proc_dump_625", "md5_hash": "9027f44e1381c39896007f837bc6b9fd", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "2a601ac81865af4849c6d637395b01e2f4d793e7", "sha256_hash": "b974e1341550d6982c9f046d0f8231cd5f872cf20d07f6f0ad9da3dd6082a4be", "size": 233472, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000459-addr_0x00000000008f0000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000003-region_00000459-addr_0x00000000008f0000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_626", "md5_hash": "deef0c723ec516d301944261bb997943", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "4416bee1287ccafa4734906541dd44f617cebbe9", "sha256_hash": "a1454b62ae953a8b4a7f9d78935af005494d98065daccca01e5609d64f5954da", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000476-addr_0x0000000001f20000-size_0x0000000000410000-perm_rw.bin", "filename": "process_00000003-region_00000476-addr_0x0000000001f20000-size_0x0000000000410000-perm_rw.bin", "id": "proc_dump_627", "md5_hash": "a3638efffd2d7db2e9891a41676ba3ff", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "a6ce5ad99c19a210c1f5dced71f35be0bef7dbd0", "sha256_hash": "94925747672466999c0e42a49b2aef3d1488d91a8d1903c5308f2df1a178971e", "size": 4259840, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000477-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000477-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_628", "md5_hash": "75af9045d90646602f1e488bae312a91", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "d153fec9f24d308bb08622e1a1538d605bbb8f89", "sha256_hash": "46a85f4906ef1b6521f9194a58794c5b91935c9ee644f930bdc218aaf6a98d82", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000479-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000479-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_630", "md5_hash": "5461c3879bb7f90493dcadba1b747922", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "0d4c8902eaed507e07abbf5b861cfa68e9f91e20", "sha256_hash": "d07d54973aad120bf8a419c9a4512ac4bc75117f37a2193db5a93bd105d170d3", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000480-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000480-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_631", "md5_hash": "e4ccf9bf3a9fd70279c203ecc1358ae4", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "f348c005208526007e0537264ad44c7613588332", "sha256_hash": "4249b3baab1a1ea6429ca42f6ff5f5e227baefda779a24cd725519bc193b0e83", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000484-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000484-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_635", "md5_hash": "505042dcd4e809535d9ddc5552911b84", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "6bc302b2d5e301dcd916c3cb1464044221a53907", "sha256_hash": "124de69a46371225c2ad1f436cd9c2b5a84141b27d4f04d8cd5810790d380750", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000485-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000485-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_636", "md5_hash": "83372ca211ba206228f12d40d4610374", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "241c322fb59082af375c8229f369bb04d41fa276", "sha256_hash": "d2ec0af6c68c946ecf4bf52d3f7bc0f757ead1a9bc329465c158e35f52a212ee", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000489-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000489-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_640", "md5_hash": "ca9e68bf2fb84fa0399306cd2f7286ea", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "bf355e4ec013c91977128ebd15473b5ac4e1981e", "sha256_hash": "32893236202fbbe40aacf4cfae253a045b4c7a670d19e71a568f3f68cc6ca9f7", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000491-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000491-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_642", "md5_hash": "1069c146e325ead6a7622be3391cde72", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "7bcd48bc7ef331cce2047ce1859f1a41e6eb058b", "sha256_hash": "086de94947958a1de1be7898c57ef2664e04f6becfe408a6cb5a5e374b4b80a6", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000496-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000496-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_647", "md5_hash": "f6c24555390716ede2f6489a7d61e3e8", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "0fd7c3bfa9b8ceb4b7039346d33dba93b859a9f2", "sha256_hash": "4c6afd8df1aedfe1c6d395fd238942b93deb6c665f77a10441c8bb9b9cd22608", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000501-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000501-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_652", "md5_hash": "f73fe889cfe0f3d4c9078058a09f2dd0", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "c7904e268f3e686bce6c701df2946ff1c7d98261", "sha256_hash": "20e31f6539a987f78faab9cbdaec8963f05028311e38f38b487e5cd5b561aeaa", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000503-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000503-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_654", "md5_hash": "92c285d91ee63d8fd2370ff6aa24fc18", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "3829e5b735cd2c2bd0f3ff8fe39023c8517df39e", "sha256_hash": "7fc47508891dc375c8164fb949d89556b0fe33ac6d0fbf07969a20b0774817d2", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000506-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000506-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_657", "md5_hash": "824118025bb82c4467c2e0e13c1dc3b1", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "7c613dd177f058ee5ff2d6d9a5beb4c14ef07ec3", "sha256_hash": "174558ce52d9ea539051ab843d837d37cca864da7de85a33a22f65b3cbadd856", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000507-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000507-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_658", "md5_hash": "934f749afbe8f0d8b38e4eac86d72918", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "8db3aed05e310737de7ae9f9cd7a0b7a1f431fbf", "sha256_hash": "afaa71e48c2f4cc1649a943111e94f5703cd5b44bd2cddfddee77910b1e7e6a2", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000508-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000508-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_659", "md5_hash": "72a0e63c310608244d4ff3295ee3ff92", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "ff530045fcfbfd1c679a8ee357fa03bbac46fe71", "sha256_hash": "e67c11d021652fee5ebf9528558c10b26097059f7a6e83fca8a665446d26a93e", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000511-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000511-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_662", "md5_hash": "f723f367b71d71a4e3255a9bdfef9d61", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "84ce58ee4ab88cb72a9299793f9194770bdbf05e", "sha256_hash": "6e8d76bfdbb7e49739b0847f8ea155fd9f05fbb53f2deeeb5afc110d669fa485", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000513-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000513-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_664", "md5_hash": "b40ff9cd040b059926c683e7a175195c", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "41bae490bb292f2a34d87f3c24003fa3b6d0a372", "sha256_hash": "d6a03dba5b55f55151002f511d8992c9780cf029d34a222a4646daecebd50960", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000517-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000517-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_668", "md5_hash": "3a3fa3d8983e9a2be4ae43b02282a7c6", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "29aceae00fe720eeb54e8e24cd88eab20c3d1279", "sha256_hash": "81d7ffa881d9a2c6512a3b0e3ef32c459a18a5c9c48a4487ed79536827facd68", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000521-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000521-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_672", "md5_hash": "e41b8c76f67d6c58650facc3fdb05a23", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "141bb093c4a8094b6bb4816e22c55365cfdabd95", "sha256_hash": "5dd1e245cb319e9bc8d3d2baaa704bd7e70e1588dda549b8588091e89960a83c", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000522-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000522-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_673", "md5_hash": "7f0ff6fcc4149c2de849a58412323a5b", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "4dd0f8abbb2210728ef69ffbf0e2b8c1a05926b9", "sha256_hash": "f78c17c4aefd0b7feccd3322994c9d236648514bf29a77b7b8f56830573f29e0", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000525-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000525-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_676", "md5_hash": "5b6512b820bc04a9a1902a0949377510", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "344a23ff5d15ea58901016d28d3aca52d98d4ba2", "sha256_hash": "936855e4f10e26313b7884d0c1407990eb38c22c34d781ddf6f49888040cef75", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000529-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000529-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_680", "md5_hash": "ca7893f6908d7898a56ca5e585cdda98", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "52595871c3e302238255c693a85f7f929e613394", "sha256_hash": "638d44a783ff67dd72df03e6314f7d685ff88eec70e511683cea2d2de99b55f3", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000531-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000531-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_682", "md5_hash": "cea8cd5e9b216afe3b690821eaf7aa8e", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "823051bd073ea68388e04682685f8e569f01cbf1", "sha256_hash": "f484434926144b6a73907a5e66d65a42258ea5d0a130fcfb33728dfece330a79", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000536-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000536-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_687", "md5_hash": "77e573a48869765142f9523d9e8c7115", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "3ed0ba00fc4a9ae0c32e65aeb7a4b3e2e9fdebfa", "sha256_hash": "672457699cbdb57c072b8bd557004409aa21b87e5b14b17d9b4547521601d046", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000541-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000541-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_692", "md5_hash": "5579e0a53fc8c98e318225b21fc0b96e", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "47a93fbd26c06b31777373664265d67b425ca0d7", "sha256_hash": "45e7613a56acfaaf0adf5926e620a7a9dd671dabf45c8f2133154116ec19eebc", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000544-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000544-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_695", "md5_hash": "0df6da33f0e7daf6a12c36066c61fd89", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "bc87951b81ef506fc187aeab0934b437b1cd4231", "sha256_hash": "682eb6abdf58cf5404aba5424ae7632c4136d7c4aea63994df94c5dc19904d9d", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000549-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000549-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_700", "md5_hash": "0718f1278a7bab32b17800486b6fd89a", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "02b3b6bce9a635701f9188d3302384d8ce6470fb", "sha256_hash": "52fcdd24729285df30889cde67278beb8f849663c6f5b18319971607c2ed0611", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000553-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000553-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_704", "md5_hash": "0a86cc40ce1e52155ddd112ac9d62d04", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "2d7aba0ef9fe4c660ebc8f9b21b43bcf93302679", "sha256_hash": "67b03e15a440e80d8486531c1706de238b6506239ee829bad771e6d856641a0f", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000558-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000558-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_709", "md5_hash": "5171d6fbfa15f0b61c9be2ec144866c9", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "d2c3841f27a0d1bbd32a907d103c6188b936d7d6", "sha256_hash": "3f30f3e06267effe34e16c44eac0d6cb82455009a007a61d8775c08256167585", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000562-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000562-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_713", "md5_hash": "32b5442ec0c9b8097fb4a29d3e53e5d6", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "29737b055d9ea86d1638ee0b8bd9552564ddff99", "sha256_hash": "53a9335020e19c2516ee8f0cb0427cdfef52c5c3771aca4d7cd6adf2dc6e7c43", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000566-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000566-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_717", "md5_hash": "f0cb9c40a0e44dc6f9ff30dc0f916258", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "2a9e152fc2c15abccc8f2487bd91eb7134a18063", "sha256_hash": "4c070f6428ee62e7d7e5878cb77d19f227369974715ec163a4664f5c3972bec9", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000569-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000569-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_720", "md5_hash": "6b765b78fab624e0617b45ae9b8b5278", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "c81d7b5e38a3b340726ca48716048142455ecff0", "sha256_hash": "c123ad004e28372942eb625431aeb293d6013c2f76d209a03a19eb27a6e4f152", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000572-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000572-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_723", "md5_hash": "01949cd198b7f106fa5dc4dfbbd1431f", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "c6c3150523c297df24a36efef922b15f85a3554c", "sha256_hash": "fd47c30f79129206eaea6b948a13dcaaad3be595ba45eab5721893f462101578", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000575-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000575-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_726", "md5_hash": "68255c3e192a25ee33505744a98e923a", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "a6e4cad75392e096fa826d0edf3e5de6fa7edb2b", "sha256_hash": "7bd558f7a5254ea0e82f811f6da0accdb968d43b0be79b513d40a9104be2285e", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000576-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000576-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_727", "md5_hash": "9eb048b8dbdf4e2580366d7f3be6ba7c", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "9dc62809de23ced1bc14557cc54b2912737e9de5", "sha256_hash": "4dc27334e7f49b5f9f2a486e8cc4e4471a43dc5beee4e919b903851953426f6f", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000578-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000578-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_729", "md5_hash": "071f559f47ced1bc5d9e93873167f5ae", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "dd5d7218d27c3f811631dcb00abfe7832dfa8541", "sha256_hash": "a9c20f1605010cf7b4086232ee790ab65fdd2118516dd930bfca2866783777df", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000581-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000581-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_732", "md5_hash": "9f527992e24a8d3967306f2dbfad5d5a", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "b1dc441c79ba4fc44a56d35a6f7b0ba682bb38f7", "sha256_hash": "e09efc771b744269eedebed0a58e27d046d7e28f9ca711a25c43d21652108f9c", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000585-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000585-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_736", "md5_hash": "d8be424cb0f8a70f5acc5caa5223492c", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "3fa1328835a18c1eb3c6a6a7475a3c10b45817b9", "sha256_hash": "741f939cc4c292e799a2da0501d28501ea1785bddc9c619c29ba4f09f03c7f8f", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000588-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000588-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_739", "md5_hash": "e67c6f14efb91cbdd81f1c7d1b61a2f2", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "f66a6ee4134835cbe3a02012d6b09f92a831b0f2", "sha256_hash": "e1555fd2924e6e859017258947582341c40b72302ba6e2857de6f45ca67e50c6", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000591-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000591-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_742", "md5_hash": "c36dbd4478582db7a20e6a7fd38c6a25", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "2c864258e628c26b72f6edc807e64edfba39a6c4", "sha256_hash": "c500937b5513dfad803d5ad4e3c93b1288f6e5c4ff4b5374f28b64c027e56e76", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000595-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000595-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_746", "md5_hash": "8a019a471c8338a42e0b43dff08b15af", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "34645974bf1dc164076c673ad668590bd55ee04b", "sha256_hash": "7b9c6959b611c16fed919e6b7f2d4a8b877421381ed08a42d8ca8cedf47894ee", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000596-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000596-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_747", "md5_hash": "02b5caac4c125c40284ae55625423fb4", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "58ec4a15662b6ae0eec1b4d1357bec09e395cdf7", "sha256_hash": "02368a1cfc2b723e4d3bcbe2aff584885c849385be043e70bceb47596e0f70a9", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000598-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000598-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_749", "md5_hash": "840d1bdf4ad62c91039057bc186ace79", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "44741cebd8221fc5afeb870eac43ff46bd725f1a", "sha256_hash": "edd8c2d72e8430890b01280ea1cd6d50dba78236c56f87fbd58f93a2040de1a4", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000601-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000601-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_752", "md5_hash": "0be943f5a6d968329192a97601e01b33", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "b1bd757159acf467a1a89f4ef8df0315dea55ec0", "sha256_hash": "db992f4c1476d98ffd1d2fc7fef80ba83c47f1adbc15d6a49d521c20b6efb349", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000603-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000603-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_754", "md5_hash": "ce50f2210cb1f72eb3c7691ee383cb22", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "7b0d85288aa64a24685112b9c54d14a6879f357b", "sha256_hash": "13bd6d68233cb1db9aff3e9fdf8b79837c7903d190718561d117776d2c8f437e", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000606-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000606-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_757", "md5_hash": "dae4cfc802874f181dc8ad9a8f18e997", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "10d22711901b15e24c40253cd9736d80dccea7ee", "sha256_hash": "7e37e6bd2458831885332162a8138d9969c8e5e5444787bf8afef85fa0f00eb8", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000608-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000608-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_759", "md5_hash": "383192e5bcf45bfe02525bdfcc62ed0e", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "4a86c824ae91bce47789decdf5fcd58b08c7d592", "sha256_hash": "87a0b316a4e3a3694443571185782faf9725125b584e68b6b717696da5a9f4a5", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000612-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000612-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_763", "md5_hash": "ddf09f74ea0ea84cb16fbb574f998a57", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "653095e02136e732fcca8f03afab226f30106898", "sha256_hash": "65abddd494385fd6c1c83b1d3df75cf056e2f2ad489bc6421efd3296c4946cf6", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000615-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000615-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_766", "md5_hash": "398b05964484f7c263b7c8fc90d2847a", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "c1144ca31eb79f2756a9980932c9114efc8f794d", "sha256_hash": "d4e93b1d17f946ca76137b2f5f31204ad96eb077b1f2939aeeaf6cc43d514114", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000617-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000617-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_768", "md5_hash": "084d718c6fedd789df7f040ba6a0cf83", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "d947b565afb46faaf4339cd85b7bdc4a9418d176", "sha256_hash": "54de23174112929d243a571010185a131d29fd20580b7a7bb3143d2997218f04", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000620-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000620-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_771", "md5_hash": "17b568e89ed76a23317c38ab1adea5f0", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "df64686a474da9d9bc6174b06f042d24a83483a5", "sha256_hash": "2886f8a7d08172615ce607d66353379c250a33b1a142e29274ff54bf1dad51ff", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000622-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000622-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_773", "md5_hash": "8ed4b7a7115182a30a6f9bd093d7a063", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "cf51b83ae885a6b7d0304fff2d8b0560b8d0eff4", "sha256_hash": "9948c107b0cc4ad3bff0d7de8674af311e03aeb5b098d235b5b96b6dcb4e15ee", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000625-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000625-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_776", "md5_hash": "bb1639bfe3a5881cbdc443a5ba115b34", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "e5c246f02f1ff5e6c4669b2b4f357aeda23edd95", "sha256_hash": "e9fcd248be274987ef33b34122505dc3093b20b85ff084fe251aacf1712f1a48", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000627-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000627-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_778", "md5_hash": "fd13af69968e5529ec2c821c62d89d17", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "e770d1de3e35ea401aaa2b181ddd9e6e78884644", "sha256_hash": "fd2be861d6da75f6240f18c1d772c90a26d068d299e09763e20d37c85abee282", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000629-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000629-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_780", "md5_hash": "5f841e1b432ab6f4db5617a6fcb9b19c", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "c64c15ae399072b7de7e3b6c130e965f351b8e82", "sha256_hash": "6ad550391e0d9aaaf7fdc8aaf11627b55504531266dd16070796387abfd2d37a", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000631-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000631-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_782", "md5_hash": "8e23f0b7df8b9f14baed27056b7359cd", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "7571338bd5a7c2064b891cbbde4b3bb47de7d73f", "sha256_hash": "178767b54ee992759f61390be6613a3359741fe46e9896098c9c5e42747b154e", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000632-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000632-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_783", "md5_hash": "445163fa3239a2e72bca6e025b04dc88", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "420504f7726a2d7c531faa15473198cdff94a0b3", "sha256_hash": "a21ac5254f55e4f31beb6c04cda2ea143d90ad1e11c33cff17efdd9eda7190cf", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000633-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000633-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_784", "md5_hash": "630c24b60801012f7bed5e9c1dc4bf7f", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "0278377d6db76445ec5841265a497746633737ff", "sha256_hash": "a5ae235cdccbc66082a6f038a262cf658b6b5f5a41477dec03f598669162e651", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000634-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000634-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_785", "md5_hash": "dd6447271c13d0a5193d450c9f32f530", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "c1cd0fc0a1f8313d3651dfddce2cd38816df9b3a", "sha256_hash": "e4dd42cbf21a59a59a40290dbe006634dd92078c51a432650fd7abb8903e0acc", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000635-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000635-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_786", "md5_hash": "be80295073f28618b87fd8090ccaee27", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "8b3e28183c05ae015cb0d1edf8ff33984cb8fd47", "sha256_hash": "25986b20eea5d9234dd1bd52978dad76c060e02d2c1c5756e9153de63facbb01", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000637-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000637-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_788", "md5_hash": "ed18c3b53e80fb3aa0ff8c954fdf8a82", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "18763f1d4f8ae70f7357897fffeaaa92842b130f", "sha256_hash": "38152281dccf182cb8e41d236b221cdf0a57df2dc535d5e70d19524585218978", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000640-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000640-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_791", "md5_hash": "d0465dbfa7aedcc3bbccc90c86b9c5fc", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "386c48811a875633f108dabd41f9ea1dec246067", "sha256_hash": "c00f79f4e98a212d7fc8cb88146b79ec97b131debbae0756f8c12693723a7c31", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000641-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000641-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_792", "md5_hash": "704180850eda7123c00e1e8926aef620", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "eee369d21ef1d78a9786e14e21d53b11c33f6a69", "sha256_hash": "766327da39f24e22a6f33f277cf787f6be6a497565a23e5486ca8271bb023208", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000645-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000645-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_796", "md5_hash": "13e22e654b13b9081571998f026ca71d", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "dd5a1c63dd411a91f82db98e07652f3eb901cc4f", "sha256_hash": "13c2d06283994c408ac7c39e5aa6bf412e415f9a580371836238edfd2c15261e", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000649-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000649-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_797", "md5_hash": "84aa40601f2ff0e4582f800bd1b85a09", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "0562d28c86484241006df32ed770240814784b6c", "sha256_hash": "05fdff9da419da2f7a59847c493f17cc1c56b07483fc027c3eeab8da50158e7e", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000650-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000650-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_798", "md5_hash": "ff6bd75a0208da040007981d712fee2a", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "c357cb8202b56c5855ce364fcdfd8c53701000bf", "sha256_hash": "acae2b26004bd82b52b0da62da1bcd0d99f543032dfc1e974cd4b5450404a051", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000651-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000651-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_799", "md5_hash": "1e5311236fcf1af10f0ad7118c6f0ccd", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "0e856d6fdbe3e3a06f873fa67a29ad486d8914e8", "sha256_hash": "938ea87fe8f0a841facdb401ba4eac27bdc789c7d2b1957285ca910dd49fe3c8", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000653-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000653-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_801", "md5_hash": "15652ca1a08fe2dd66b0de5c6ce45ef6", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "77c93f171b438771f18e198742425e7f5007e41d", "sha256_hash": "073b055ded084d30e82cf56075daa33cc15ef483539ae250343ab2366f531df4", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000655-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000655-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_803", "md5_hash": "a4c9a73ed127dd4e51a471855b1016ad", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "eb4bdd5da5612c05533dbd02161d9a2e2a54c2f4", "sha256_hash": "a16d36f679d90b2ca1f887a9f2477da8b18b3716bd245881c0a4c87ac37e97fc", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000658-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000658-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_806", "md5_hash": "2c0aef27f68b843a1a6642c245701a54", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "48e453dd49525fbd91b45068723243c615ccfc85", "sha256_hash": "59b4b83dc1c97ef64cf15f258be8b12ff63c0d1103c7411558ac7cc4edab5754", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000661-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000661-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_809", "md5_hash": "fff9a2f90769d7dfcad3f30e6617a311", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "493b403bde3d78f978df2c03dd27e6e11b63c0dc", "sha256_hash": "a3cbcdb6f879e8c88d67bd4bdd2034c426727f29d36f7ad8c93d0560c82f2d41", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000663-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000663-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_811", "md5_hash": "3809d0f6827a0d0dd1aff26b8544442b", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "6109da5ac10924c86ee671ebb9d35ad54df1094a", "sha256_hash": "c48bd7871cac9d79f35e2318d314cfb65ec0cb124a9bc1bd65acbf32e12913c3", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000664-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000664-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_812", "md5_hash": "35f4ccba8b9ddbcdae942c9d823824e0", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "c1962bef735b10186545ea8bffc367d8589841ac", "sha256_hash": "43860bc1bd8fd3de80b8eaff17b0c3c922129ebc3a771d2b3d436556ccaada53", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000667-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000667-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_815", "md5_hash": "b7e2b75e81a83ce417cf8fead5679b37", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "370bd11860e9825bb603a1ea97c24b3a9f7fe84c", "sha256_hash": "9643c35c8b5d724c84ea2dd94b06efd2948105b4e4950a55cd59552888b7d44c", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000669-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000669-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_817", "md5_hash": "cbec523f2c8713ad56a6cd81b42ef0b9", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "20bd784d984d5219b5ac22c49b334d184a1a5c22", "sha256_hash": "d0ac9ad986e57fc3a0c4159035f345f30b3712c40986d6eafc17507afecb4f85", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000674-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000674-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_822", "md5_hash": "0da2090a16a260b8890b4f7c18410bfc", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "9116baf3018451cb46aefe0ef1375b098252eb87", "sha256_hash": "1cc1f40a904096912eb4c550c7c80e91baa313ded89a0a42504b238ee02c73f3", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000677-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000677-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_825", "md5_hash": "2c50a8176b6a43cabe37d147c621fd46", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "31353e2e3cec45916541670669dd3545c2a74503", "sha256_hash": "952f0085fe19a714ac19624f1d81bf8c0c6135284a93235ac998066d0888e340", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000679-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000679-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_827", "md5_hash": "db9c7c257996d7d1b13812d7ab830e13", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "04b845861ae41f4c87c2982964ad01e6ced42645", "sha256_hash": "cda507f1921434cae0e64b006d8607b5ad836328252ade016306680f22fd2f25", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000680-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000680-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_828", "md5_hash": "997698fdfbcf61dbb32f035ccd7fb452", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1214546b96ce6adb3191724ea26d5d76b4dab03a", "sha256_hash": "7a948e81fb631e859f5da89526e72c95899cb1c58588ee7ee279b5ebcce87da9", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000688-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000688-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_836", "md5_hash": "7627f8622783d271859f3ea2bdab0c27", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "bb3f10118f14d15373bfc100ab110b02648ab763", "sha256_hash": "ae18dabd516b30c774a23541c0f63a3dcdbc8945c916713d0f1a966e9dd72365", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000692-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000692-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_840", "md5_hash": "78b98b1b099570735a47f75d06834442", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "b143a826e49bc3d13dbafa793639cb9f629d616c", "sha256_hash": "185dc64a5ceebad66dc3cf580401b7593a308d3ce6261fe13d21043b7e9e1b77", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000695-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000695-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_843", "md5_hash": "7418ae76747684400ac97f8e3b3cffc0", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "7b48a423a3ace584c342aec3dd4689d150ac868e", "sha256_hash": "d20523cf26bc1314371cf5886e87b8ab7e3fef07fdaa9723269270d7ba75c50d", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000696-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000696-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_844", "md5_hash": "aeb096fe1ae202a190e23b0c70b5a75d", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "16a13f6546fa2d49fa771ebd7dd9d7a39c77941a", "sha256_hash": "550d90d150f2f0d8cb5a8e2fd3193e60b7d67d880129c543ee8ff286862cbb38", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000698-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000698-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_846", "md5_hash": "502191c34ec9cfcf25b245143d9b065b", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "84ab4c00b1d30de7afb6d137007872566552ba45", "sha256_hash": "55ca14067abd4afa750607719bcf7c70177314b9f2227f97cda9f3968138626c", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000707-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000707-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_855", "md5_hash": "fea7620aa5aa78f0aa89cdb50493e18c", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "444d0128122d8a81fcebdfbf3d681a32651bbfe7", "sha256_hash": "9099057382e0c829312a7e0be3e13e12402f82b1ce3f0c5b9c7143c066a24f8c", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000708-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000708-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_856", "md5_hash": "7d51ef0d761bbd66e054316a4d5f47bc", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "68f6a583a3be57ecbfef4ac0795bd9943a5762aa", "sha256_hash": "c514fa6b74515a9b95bce4d39e3624a8186d235607bb9689e2ac583aa1baa8db", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000713-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000713-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_861", "md5_hash": "62c539f7bd646a3539a720bd8afdfddf", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "61faedd5a9dfaa3477cd492b8d15d0d8ebaba346", "sha256_hash": "e5d7a29ca5075b66a3260a615766fa1bfe5f4cc7a4530f6cf8c6289257e9e610", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000715-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000715-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_863", "md5_hash": "28c4ec49674cf5b40a750afda9f16672", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "a1988866ffdb4a68522bd10b2fd735019b6e4c44", "sha256_hash": "e8740e7832e913d5276ac6e0b576d7cfebfede3f67452521bdcc6abe306a9f88", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000734-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000734-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_882", "md5_hash": "a638ab36303658fa9f83df8c1a2eb98e", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "4859a47b1bbb3446887fb0b2f11ca23dde338a7c", "sha256_hash": "b47491075e6911de699d45d8169d3762b8585d2426a18e1e7f02d8c3a8e7d44b", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000742-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000742-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_890", "md5_hash": "a62449e247477139c0852505a8c7857c", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "9d2013e02560e55fc31ed8544acc437bd1f0379a", "sha256_hash": "5b658a8ffdf719f5d257d8cf0a6d1144ec0e9db427aafadedbc347a99ae0a2ca", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000761-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000003-region_00000761-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_909", "md5_hash": "b9b18c78534a25719516e7178817787b", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "279eecd3fd50d7e3ea2c68ac647d06f19f671ad7", "sha256_hash": "c70e435e12129f04ef873ddaab7b41934fd5a260058be7f1527b881bc7af2bd5", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000765-addr_0x0000000002670000-size_0x0000000000110000-perm_rw.bin", "filename": "process_00000003-region_00000765-addr_0x0000000002670000-size_0x0000000000110000-perm_rw.bin", "id": "proc_dump_910", "md5_hash": "28aacf06daa8e9db9452491d6c489f61", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "8006c2f2b6fd44bf3833200eb50426f4a769ab9b", "sha256_hash": "9362e0447e333bcc77fddf6663d4006e040c874bb1e3c056f2420d526323dcad", "size": 1114112, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000775-addr_0x0000000002770000-size_0x0000000000010000-perm_rw.bin", "filename": "process_00000003-region_00000775-addr_0x0000000002770000-size_0x0000000000010000-perm_rw.bin", "id": "proc_dump_911", "md5_hash": "381f1847d0cb975a3e3f75af2787ccfc", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "6b56a47a9408fb75ff4c08709b33c9008e76d493", "sha256_hash": "8844bf40fd3c08d67cfbf868e6e0158eb1b11b9593f4ff06eb730cda01006e65", "size": 65536, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000780-addr_0x0000000000940000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000003-region_00000780-addr_0x0000000000940000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_912", "md5_hash": "43eb8462981b1ae6e296531d97241477", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "4082fb6972051354d03c5c2a48ff5c94219d5d2c", "sha256_hash": "5f2196cc423338696a0fed17230a6b13e51f1ca0475524f2ffc8340999b0eb90", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000781-addr_0x0000000002780000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000003-region_00000781-addr_0x0000000002780000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_913", "md5_hash": "8e8f6d43582e1504b68387a68ce92259", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "3005eb36ddb7fbeaa6b870a6c74b59467ef0c063", "sha256_hash": "4a54cd34489a7bce035d030c273226d872ca0f0f8590d1f74c3dbff2cc8424cc", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000783-addr_0x000000007ffd5000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000003-region_00000783-addr_0x000000007ffd5000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_914", "md5_hash": "9ddf052a5430eae7e3638145babc190a", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "1ee37b3ea8d9d50576719e335d9d0309c7976465", "sha256_hash": "04fd2afd920228cfa78cb063ca571da42c2821074829aa1c9fabd2642d50d760", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000784-addr_0x0000000002700000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000003-region_00000784-addr_0x0000000002700000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_915", "md5_hash": "481bd60e9487c46b1b29b357d224edee", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "c977bb6c270f7a4cc051749a3fb1301da9287327", "sha256_hash": "c02c82124bc3353a833d61ea93e8283d2bfead260558c9264d85f6e18f1e72b3", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000785-addr_0x0000000002880000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000003-region_00000785-addr_0x0000000002880000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_916", "md5_hash": "c3a4e2815e18f090bdab6c208373f979", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "bd02d9c19abd366f73d20b7567f514f25fad5c34", "sha256_hash": "3d51f26da4ad956e3815d7b762ee331f4b03339f903522c3037fdd84f636aaff", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000786-addr_0x000000007fead000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000003-region_00000786-addr_0x000000007fead000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_917", "md5_hash": "389ff9758d51f1ab7f9d6f4381538b48", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "e4d004b78dc8a18537d0ed5db1e15241b6093473", "sha256_hash": "e703b788d4925392b05a89e90746ece94f8a8c2c629a8d7599f3226afc70cb03", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000790-addr_0x0000000002980000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000003-region_00000790-addr_0x0000000002980000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_918", "md5_hash": "f027f5a4f8bcbe030b501b664db2badb", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "907b29f7a8d6f5928dbebdd0242adc37c08fa556", "sha256_hash": "5055c77c9b3056fd14c500681b3f94e29f614a855fb34f029a5d51eeab61abfd", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000791-addr_0x00000000029c0000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000003-region_00000791-addr_0x00000000029c0000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_919", "md5_hash": "3c121d6c9b7d6c8305be30bb4b63cd64", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "ab294c6083d13758ffb6927f6eec2c5b80fb05a2", "sha256_hash": "767d9ed786b820d0aa6e49e87aab6d5cbf69b78f0f8dfe6e051642fdb8d51907", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000792-addr_0x0000000002ac0000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000003-region_00000792-addr_0x0000000002ac0000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_920", "md5_hash": "fa90fbcbf3877797e26e5abfe251cfbb", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "25ce6940f20b32cabd366911896b7d5593a9adff", "sha256_hash": "d3b6fe631b82bc2717c0bbb1811f564bdaf62bc0f5a68aa80df342c315cf6e95", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000793-addr_0x0000000002b00000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000003-region_00000793-addr_0x0000000002b00000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_921", "md5_hash": "90c2bfb3b5f3e386ca4e37ed16a75e82", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "b54fb0373bad42ac31cb5278101e87aa21cf5fdb", "sha256_hash": "d488fa8631a05b03228786fea0b9e3913c0340fc02ee2b828f23c57e4c896ec3", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000794-addr_0x0000000002c00000-size_0x0000000000040000-perm_rw.bin", "filename": "process_00000003-region_00000794-addr_0x0000000002c00000-size_0x0000000000040000-perm_rw.bin", "id": "proc_dump_922", "md5_hash": "ab1a8f91058fb9e5b46955d2ef5b6f6a", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "fdb775fb078f1961e15e68152efab50b208657f9", "sha256_hash": "f91f87bb5dcd0dec33b0b29bd8564fa5cd651e6f4e0c4209016ec1e7d1c2bf5b", "size": 262144, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000795-addr_0x0000000002c40000-size_0x0000000000100000-perm_rw.bin", "filename": "process_00000003-region_00000795-addr_0x0000000002c40000-size_0x0000000000100000-perm_rw.bin", "id": "proc_dump_923", "md5_hash": "e9f100753daa816ded63ae503308e6a3", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "bb8f1066efef2a170a543072f2de20bd6432d4d5", "sha256_hash": "32343c285f5a80857884fe477013914493b17c86ab5559df48fdcf8694aaa7e5", "size": 1048576, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000796-addr_0x000000007fea4000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000003-region_00000796-addr_0x000000007fea4000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_924", "md5_hash": "b7574d26b58f962efabd33b96c52c909", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "a193c860aedbe64e445909410d6f2e3e35f3b400", "sha256_hash": "effe7f1d451e60f29119fa6bd25e966aaaa30df3fc4a591b3fe8a802f6e657e1", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000797-addr_0x000000007fea7000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000003-region_00000797-addr_0x000000007fea7000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_925", "md5_hash": "ed040d0a6bd83120629f201c39ed7a16", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "3de37914503bd441ecdb1ae2fbd8391b498d0890", "sha256_hash": "3ba5d85fe642c4caa388acc286da0fb76ddb1b2d89a03917c211be5438d2ce08", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000003-region_00000798-addr_0x000000007feaa000-size_0x0000000000003000-perm_rw.bin", "filename": "process_00000003-region_00000798-addr_0x000000007feaa000-size_0x0000000000003000-perm_rw.bin", "id": "proc_dump_926", "md5_hash": "0f06ed417c0b965757c6ed7a42efef78", "ref_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "c7cf4c890a8b4a58723bb4df3a761d3a70d9a56c", "sha256_hash": "5949e084b69a26bcf77a88462ac83a919660f348e31582447a93ec3c728cd778", "size": 12288, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000004-region_00000802-addr_0x0000000000420000-size_0x0000000000020000-perm_rw.bin", "filename": "process_00000004-region_00000802-addr_0x0000000000420000-size_0x0000000000020000-perm_rw.bin", "id": "proc_dump_927", "md5_hash": "c68c90c57a20c7ac60134714a83ef24e", "ref_process": { "ref_id": "proc_4", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "552cd9f84db42a1d2d990320f5ed20bedf7e5d84", "sha256_hash": "b547143587f70f644d1334f51d42bf9d1f30a33fb4691824f60a561c67475e95", "size": 131072, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000004-region_00000803-addr_0x0000000000440000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000004-region_00000803-addr_0x0000000000440000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_928", "md5_hash": "c2dbf70e7ee2cacd967471bddc9ea498", "ref_process": { "ref_id": "proc_4", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "8729b5694cf61d609d7fdc291eeb8dd04848c060", "sha256_hash": "3341458e976ce0372c250ffff4ad0c391e722c2d720f42132888e8ba679d56ef", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000888-addr_0x0000000000f30000-size_0x0000000000020000-perm_rw.bin", "filename": "process_00000006-region_00000888-addr_0x0000000000f30000-size_0x0000000000020000-perm_rw.bin", "id": "proc_dump_932", "md5_hash": "5570fcbfe2b4a61bd67d3d6b601932fd", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "aacbbb3baf352616ab1933127025ce94d0af6e3d", "sha256_hash": "ffb0717b0c1314e7bc1dbaec26184fc6832a5e36146f546ccb8ff0e2310112d4", "size": 131072, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000006-region_00000889-addr_0x0000000000f50000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000006-region_00000889-addr_0x0000000000f50000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_933", "md5_hash": "a1b4cc6772a98ea3bf075b3154a6821a", "ref_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "381696192489412b0957ce0d51a9732f03d617a6", "sha256_hash": "6b23dd86fd70bce35c096ec46d07eb09aafeb396d71fdffca1744d067981697d", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000928-addr_0x0000000000010000-size_0x0000000000020000-perm_rw.bin", "filename": "process_00000007-region_00000928-addr_0x0000000000010000-size_0x0000000000020000-perm_rw.bin", "id": "proc_dump_934", "md5_hash": "491b26caa0ff031367025f77a5b8212c", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "d422ad10a678e89fad5d5535cc9256c1999d59cc", "sha256_hash": "88316c650886ab2eb6f1c7cc4723ff7b8f14a0e457e50d3214c96aa219c13dbd", "size": 131072, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000929-addr_0x0000000000030000-size_0x0000000000002000-perm_rw.bin", "filename": "process_00000007-region_00000929-addr_0x0000000000030000-size_0x0000000000002000-perm_rw.bin", "id": "proc_dump_935", "md5_hash": "e8eca70599b0ea8dfe4b0c54bbb509a1", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "d66e0275f32f22e28fa7b7a6ba0e834313092dc7", "sha256_hash": "bfdf1e70667db834492c912f5d186a603addef6896c5f9f13df834aaaeb68cc4", "size": 8192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000969-addr_0x0000000001cd0000-size_0x0000000000160000-perm_rw.bin", "filename": "process_00000007-region_00000969-addr_0x0000000001cd0000-size_0x0000000000160000-perm_rw.bin", "id": "proc_dump_936", "md5_hash": "6137dd4d25736229153eed1eccc9a2a4", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "0637733e340d09eb8ab0f7ea642643c6795d047c", "sha256_hash": "15c39f3dc57e89550f016d8d8e7d2a3b2ca00a26c55d6260f32ab331169ff0b4", "size": 1441792, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000994-addr_0x0000000001e30000-size_0x00000000004a0000-perm_rw.bin", "filename": "process_00000007-region_00000994-addr_0x0000000001e30000-size_0x00000000004a0000-perm_rw.bin", "id": "proc_dump_937", "md5_hash": "4da3dc5455dd12a5060fa10452aa3e26", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "5c2959e258ebd42c075e7dcfe4c362c0f353cfb4", "sha256_hash": "e9fad8c1bf2846be1db313fded5d087eac77600067bbdc62782eabcf490cd0a1", "size": 3592192, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000995-addr_0x0000000001dc0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000007-region_00000995-addr_0x0000000001dc0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_938", "md5_hash": "a4c9a73ed127dd4e51a471855b1016ad", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "eb4bdd5da5612c05533dbd02161d9a2e2a54c2f4", "sha256_hash": "a16d36f679d90b2ca1f887a9f2477da8b18b3716bd245881c0a4c87ac37e97fc", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00000999-addr_0x0000000001dc0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000007-region_00000999-addr_0x0000000001dc0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_942", "md5_hash": "35f4ccba8b9ddbcdae942c9d823824e0", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "c1962bef735b10186545ea8bffc367d8589841ac", "sha256_hash": "43860bc1bd8fd3de80b8eaff17b0c3c922129ebc3a771d2b3d436556ccaada53", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00001003-addr_0x0000000001dc0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000007-region_00001003-addr_0x0000000001dc0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_946", "md5_hash": "7c0e463d7cd44103922fa86bad553db2", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "701fd553e75063243423d39fa717f03798ce812a", "sha256_hash": "61c56992f49d55dc0d11057c1241355cd03ec241e37d9c1b5b67740a22f9c3e6", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00001006-addr_0x0000000001dc0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000007-region_00001006-addr_0x0000000001dc0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_949", "md5_hash": "3809d0f6827a0d0dd1aff26b8544442b", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "6109da5ac10924c86ee671ebb9d35ad54df1094a", "sha256_hash": "c48bd7871cac9d79f35e2318d314cfb65ec0cb124a9bc1bd65acbf32e12913c3", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00001007-addr_0x0000000001dc0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000007-region_00001007-addr_0x0000000001dc0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_950", "md5_hash": "2c0aef27f68b843a1a6642c245701a54", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "48e453dd49525fbd91b45068723243c615ccfc85", "sha256_hash": "59b4b83dc1c97ef64cf15f258be8b12ff63c0d1103c7411558ac7cc4edab5754", "size": 4096, "type": "process_dump", "version": 1 }, { "archive_path": "process_dumps/process_00000007-region_00001011-addr_0x0000000001dc0000-size_0x0000000000001000-perm_rw.bin", "filename": "process_00000007-region_00001011-addr_0x0000000001dc0000-size_0x0000000000001000-perm_rw.bin", "id": "proc_dump_954", "md5_hash": "fff9a2f90769d7dfcad3f30e6617a311", "ref_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "process", "type": "reference", "version": 1 }, "sha1_hash": "493b403bde3d78f978df2c03dd27e6e11b63c0dc", "sha256_hash": "a3cbcdb6f879e8c88d67bd4bdd2034c426727f29d36f7ad8c93d0560c82f2d41", "size": 4096, "type": "process_dump", "version": 1 } ], "processes": [ { "cmd_line": "\"C:\\Windows\\System32\\CScript.exe\" \"C:\\Users\\CIIHMN~1\\Desktop\\2999BA~1.WSF\" ", "filename": "c:\\windows\\system32\\cscript.exe", "id": "proc_1", "image_name": "cscript.exe", "monitor_reason": "analysis_target", "monitored_id": 1, "origin_monitor_id": 0, "ref_parent_process": null, "regions": [ { "dump": { "filename": "process_00000001-region_00000001-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable" ], "ref_process_dump": { "ref_id": "proc_dump_514", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_1", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:00:20.704", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000002-addr_0x0000009c3c600000-size_0x0000000000020000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_515", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 131072, "start_va": 671027822592, "type": "region", "version": 1 }, "end_va": 671027953663, "entry_point": 0, "filename": null, "id": "region_2", "name": "private_0x0000009c3c600000", "norm_filename": null, "region_type": "private_memory", "start_va": 671027822592, "timestamp": "00:00:20.705", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 671027953664, "type": "region", "version": 1 }, "end_va": 671028035583, "entry_point": 0, "filename": null, "id": "region_3", "name": "pagefile_0x0000009c3c620000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 671027953664, "timestamp": "00:00:20.705", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000004-addr_0x0000009c3c640000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_516", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 671028084736, "type": "region", "version": 1 }, "end_va": 671029133311, "entry_point": 0, "filename": null, "id": "region_4", "name": "private_0x0000009c3c640000", "norm_filename": null, "region_type": "private_memory", "start_va": 671028084736, "timestamp": "00:00:20.705", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 671029133312, "type": "region", "version": 1 }, "end_va": 671029149695, "entry_point": 0, "filename": null, "id": "region_5", "name": "pagefile_0x0000009c3c740000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 671029133312, "timestamp": "00:00:20.705", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 671029198848, "type": "region", "version": 1 }, "end_va": 671029202943, "entry_point": 0, "filename": null, "id": "region_6", "name": "pagefile_0x0000009c3c750000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 671029198848, "timestamp": "00:00:20.705", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000007-addr_0x0000009c3c760000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_517", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 671029264384, "type": "region", "version": 1 }, "end_va": 671029272575, "entry_point": 0, "filename": null, "id": "region_7", "name": "private_0x0000009c3c760000", "norm_filename": null, "region_type": "private_memory", "start_va": 671029264384, "timestamp": "00:00:20.705", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "" ], "ref_process_dump": null, "size": 2199023255552, "start_va": 138495510642688, "type": "region", "version": 1 }, "end_va": 140694533898239, "entry_point": 0, "filename": null, "id": "region_8", "name": "pagefile_0x00007df5ffb70000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 138495510642688, "timestamp": "00:00:20.705", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 140702246174720, "type": "region", "version": 1 }, "end_va": 140702246318079, "entry_point": 0, "filename": null, "id": "region_9", "name": "pagefile_0x00007ff7cb670000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140702246174720, "timestamp": "00:00:20.705", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000010-addr_0x00007ff7cb69c000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_518", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140702246354944, "type": "region", "version": 1 }, "end_va": 140702246363135, "entry_point": 0, "filename": null, "id": "region_10", "name": "private_0x00007ff7cb69c000", "norm_filename": null, "region_type": "private_memory", "start_va": 140702246354944, "timestamp": "00:00:20.706", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000011-addr_0x00007ff7cb69e000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_519", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 140702246363136, "type": "region", "version": 1 }, "end_va": 140702246367231, "entry_point": 0, "filename": null, "id": "region_11", "name": "private_0x00007ff7cb69e000", "norm_filename": null, "region_type": "private_memory", "start_va": 140702246363136, "timestamp": "00:00:20.706", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 192512, "start_va": 140702256005120, "type": "region", "version": 1 }, "end_va": 140702256197631, "entry_point": 140702256005120, "filename": "\\Windows\\System32\\cscript.exe", "id": "region_12", "name": "cscript.exe", "norm_filename": "c:\\windows\\system32\\cscript.exe", "region_type": "memory_mapped_file", "start_va": 140702256005120, "timestamp": "00:00:20.706", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140717040140288, "type": "region", "version": 1 }, "end_va": 140717041983487, "entry_point": 140717040140288, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_13", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140717040140288, "timestamp": "00:00:20.866", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000153-addr_0x0000009c3c7b0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_520", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 671029592064, "type": "region", "version": 1 }, "end_va": 671030640639, "entry_point": 0, "filename": null, "id": "region_153", "name": "private_0x0000009c3c7b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671029592064, "timestamp": "00:00:22.762", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1953792, "start_va": 140716994985984, "type": "region", "version": 1 }, "end_va": 140716996939775, "entry_point": 140716994985984, "filename": "\\Windows\\System32\\KernelBase.dll", "id": "region_154", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\system32\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 140716994985984, "timestamp": "00:00:22.762", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 708608, "start_va": 140717039419392, "type": "region", "version": 1 }, "end_va": 140717040127999, "entry_point": 140717039419392, "filename": "\\Windows\\System32\\kernel32.dll", "id": "region_155", "name": "kernel32.dll", "norm_filename": "c:\\windows\\system32\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 140717039419392, "timestamp": "00:00:23.512", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 671027822592, "type": "region", "version": 1 }, "end_va": 671027888127, "entry_point": 0, "filename": null, "id": "region_230", "name": "pagefile_0x0000009c3c600000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 671027822592, "timestamp": "00:00:27.051", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000231-addr_0x0000009c3c610000-size_0x0000000000007000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_546", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 28672, "start_va": 671027888128, "type": "region", "version": 1 }, "end_va": 671027916799, "entry_point": 0, "filename": null, "id": "region_231", "name": "private_0x0000009c3c610000", "norm_filename": null, "region_type": "private_memory", "start_va": 671027888128, "timestamp": "00:00:27.051", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 671030640640, "type": "region", "version": 1 }, "end_va": 671031418879, "entry_point": 671030640640, "filename": "\\Windows\\System32\\locale.nls", "id": "region_232", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 671030640640, "timestamp": "00:00:27.051", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000233-addr_0x0000009c3c970000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_547", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 671031427072, "type": "region", "version": 1 }, "end_va": 671032475647, "entry_point": 0, "filename": null, "id": "region_233", "name": "private_0x0000009c3c970000", "norm_filename": null, "region_type": "private_memory", "start_va": 671031427072, "timestamp": "00:00:27.052", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 140702245126144, "type": "region", "version": 1 }, "end_va": 140702246174719, "entry_point": 0, "filename": null, "id": "region_234", "name": "pagefile_0x00007ff7cb570000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140702245126144, "timestamp": "00:00:27.052", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000235-addr_0x00007ff7cb69a000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_548", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140702246346752, "type": "region", "version": 1 }, "end_va": 140702246354943, "entry_point": 0, "filename": null, "id": "region_235", "name": "private_0x00007ff7cb69a000", "norm_filename": null, "region_type": "private_memory", "start_va": 140702246346752, "timestamp": "00:00:27.052", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 140716844843008, "type": "region", "version": 1 }, "end_va": 140716844883967, "entry_point": 140716844843008, "filename": "\\Windows\\System32\\version.dll", "id": "region_236", "name": "version.dll", "norm_filename": "c:\\windows\\system32\\version.dll", "region_type": "memory_mapped_file", "start_va": 140716844843008, "timestamp": "00:00:27.052", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1204224, "start_va": 140717019627520, "type": "region", "version": 1 }, "end_va": 140717020831743, "entry_point": 140717019627520, "filename": "\\Windows\\System32\\rpcrt4.dll", "id": "region_237", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\system32\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 140717019627520, "timestamp": "00:00:27.053", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 679936, "start_va": 140717023100928, "type": "region", "version": 1 }, "end_va": 140717023780863, "entry_point": 140717023100928, "filename": "\\Windows\\System32\\advapi32.dll", "id": "region_238", "name": "advapi32.dll", "norm_filename": "c:\\windows\\system32\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 140717023100928, "timestamp": "00:00:27.053", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1593344, "start_va": 140717024215040, "type": "region", "version": 1 }, "end_va": 140717025808383, "entry_point": 140717024215040, "filename": "\\Windows\\System32\\gdi32.dll", "id": "region_239", "name": "gdi32.dll", "norm_filename": "c:\\windows\\system32\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 140717024215040, "timestamp": "00:00:27.053", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1368064, "start_va": 140717026770944, "type": "region", "version": 1 }, "end_va": 140717028139007, "entry_point": 140717026770944, "filename": "\\Windows\\System32\\user32.dll", "id": "region_240", "name": "user32.dll", "norm_filename": "c:\\windows\\system32\\user32.dll", "region_type": "memory_mapped_file", "start_va": 140717026770944, "timestamp": "00:00:27.053", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 372736, "start_va": 140717029916672, "type": "region", "version": 1 }, "end_va": 140717030289407, "entry_point": 140717029916672, "filename": "\\Windows\\System32\\sechost.dll", "id": "region_241", "name": "sechost.dll", "norm_filename": "c:\\windows\\system32\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 140717029916672, "timestamp": "00:00:27.053", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 140717030309888, "type": "region", "version": 1 }, "end_va": 140717031088127, "entry_point": 140717030309888, "filename": "\\Windows\\System32\\oleaut32.dll", "id": "region_242", "name": "oleaut32.dll", "norm_filename": "c:\\windows\\system32\\oleaut32.dll", "region_type": "memory_mapped_file", "start_va": 140717030309888, "timestamp": "00:00:27.053", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1314816, "start_va": 140717031817216, "type": "region", "version": 1 }, "end_va": 140717033132031, "entry_point": 140717031817216, "filename": "\\Windows\\System32\\ole32.dll", "id": "region_243", "name": "ole32.dll", "norm_filename": "c:\\windows\\system32\\ole32.dll", "region_type": "memory_mapped_file", "start_va": 140717031817216, "timestamp": "00:00:27.053", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2605056, "start_va": 140717033193472, "type": "region", "version": 1 }, "end_va": 140717035798527, "entry_point": 140717033193472, "filename": "\\Windows\\System32\\combase.dll", "id": "region_244", "name": "combase.dll", "norm_filename": "c:\\windows\\system32\\combase.dll", "region_type": "memory_mapped_file", "start_va": 140717033193472, "timestamp": "00:00:27.054", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 643072, "start_va": 140717035945984, "type": "region", "version": 1 }, "end_va": 140717036589055, "entry_point": 140717035945984, "filename": "\\Windows\\System32\\msvcrt.dll", "id": "region_245", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\system32\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 140717035945984, "timestamp": "00:00:27.054", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000246-addr_0x0000009c3c770000-size_0x0000000000007000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_549", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 28672, "start_va": 671029329920, "type": "region", "version": 1 }, "end_va": 671029358591, "entry_point": 0, "filename": null, "id": "region_246", "name": "private_0x0000009c3c770000", "norm_filename": null, "region_type": "private_memory", "start_va": 671029329920, "timestamp": "00:00:27.083", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000247-addr_0x0000009c3cb20000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_550", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 671033196544, "type": "region", "version": 1 }, "end_va": 671033262079, "entry_point": 0, "filename": null, "id": "region_247", "name": "private_0x0000009c3cb20000", "norm_filename": null, "region_type": "private_memory", "start_va": 671033196544, "timestamp": "00:00:27.084", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 671033262080, "type": "region", "version": 1 }, "end_va": 671034867711, "entry_point": 0, "filename": null, "id": "region_248", "name": "pagefile_0x0000009c3cb30000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 671033262080, "timestamp": "00:00:27.084", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 221184, "start_va": 140717022838784, "type": "region", "version": 1 }, "end_va": 140717023059967, "entry_point": 140717022838784, "filename": "\\Windows\\System32\\imm32.dll", "id": "region_249", "name": "imm32.dll", "norm_filename": "c:\\windows\\system32\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 140717022838784, "timestamp": "00:00:27.084", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1425408, "start_va": 140717037060096, "type": "region", "version": 1 }, "end_va": 140717038485503, "entry_point": 140717037060096, "filename": "\\Windows\\System32\\msctf.dll", "id": "region_250", "name": "msctf.dll", "norm_filename": "c:\\windows\\system32\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 140717037060096, "timestamp": "00:00:27.084", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 671029395456, "type": "region", "version": 1 }, "end_va": 671029407743, "entry_point": 671029395456, "filename": "\\Windows\\System32\\en-US\\cscript.exe.mui", "id": "region_251", "name": "cscript.exe.mui", "norm_filename": "c:\\windows\\system32\\en-us\\cscript.exe.mui", "region_type": "memory_mapped_file", "start_va": 671029395456, "timestamp": "00:00:27.092", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000252-addr_0x0000009c3c790000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_551", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 671029460992, "type": "region", "version": 1 }, "end_va": 671029465087, "entry_point": 0, "filename": null, "id": "region_252", "name": "private_0x0000009c3c790000", "norm_filename": null, "region_type": "private_memory", "start_va": 671029460992, "timestamp": "00:00:27.093", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000253-addr_0x0000009c3c7a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_552", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 671029526528, "type": "region", "version": 1 }, "end_va": 671029530623, "entry_point": 0, "filename": null, "id": "region_253", "name": "private_0x0000009c3c7a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671029526528, "timestamp": "00:00:27.093", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 671034900480, "type": "region", "version": 1 }, "end_va": 671036477439, "entry_point": 0, "filename": null, "id": "region_254", "name": "pagefile_0x0000009c3ccc0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 671034900480, "timestamp": "00:00:27.093", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 671036538880, "type": "region", "version": 1 }, "end_va": 671057510399, "entry_point": 0, "filename": null, "id": "region_255", "name": "pagefile_0x0000009c3ce50000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 671036538880, "timestamp": "00:00:27.094", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 876544, "start_va": 671057510400, "type": "region", "version": 1 }, "end_va": 671058386943, "entry_point": 671057510400, "filename": "\\Windows\\System32\\rpcss.dll", "id": "region_256", "name": "rpcss.dll", "norm_filename": "c:\\windows\\system32\\rpcss.dll", "region_type": "memory_mapped_file", "start_va": 671057510400, "timestamp": "00:00:27.115", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 61440, "start_va": 140716983844864, "type": "region", "version": 1 }, "end_va": 140716983906303, "entry_point": 140716983844864, "filename": "\\Windows\\System32\\kernel.appcore.dll", "id": "region_257", "name": "kernel.appcore.dll", "norm_filename": "c:\\windows\\system32\\kernel.appcore.dll", "region_type": "memory_mapped_file", "start_va": 140716983844864, "timestamp": "00:00:27.423", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 438272, "start_va": 140716981944320, "type": "region", "version": 1 }, "end_va": 140716982382591, "entry_point": 140716981944320, "filename": "\\Windows\\System32\\bcryptprimitives.dll", "id": "region_258", "name": "bcryptprimitives.dll", "norm_filename": "c:\\windows\\system32\\bcryptprimitives.dll", "region_type": "memory_mapped_file", "start_va": 140716981944320, "timestamp": "00:00:27.425", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 614400, "start_va": 140716959399936, "type": "region", "version": 1 }, "end_va": 140716960014335, "entry_point": 140716959399936, "filename": "\\Windows\\System32\\uxtheme.dll", "id": "region_259", "name": "uxtheme.dll", "norm_filename": "c:\\windows\\system32\\uxtheme.dll", "region_type": "memory_mapped_file", "start_va": 140716959399936, "timestamp": "00:00:27.428", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000260-addr_0x0000009c3ca70000-size_0x00000000000b0000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_553", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 720896, "start_va": 671032475648, "type": "region", "version": 1 }, "end_va": 671033196543, "entry_point": 0, "filename": null, "id": "region_260", "name": "private_0x0000009c3ca70000", "norm_filename": null, "region_type": "private_memory", "start_va": 671032475648, "timestamp": "00:00:27.437", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 671057510400, "type": "region", "version": 1 }, "end_va": 671060881407, "entry_point": 671057510400, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_261", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 671057510400, "timestamp": "00:00:27.577", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 36864, "start_va": 671032475648, "type": "region", "version": 1 }, "end_va": 671032512511, "entry_point": 671032475648, "filename": "\\Windows\\System32\\cscript.exe", "id": "region_262", "name": "cscript.exe", "norm_filename": "c:\\windows\\system32\\cscript.exe", "region_type": "memory_mapped_file", "start_va": 671032475648, "timestamp": "00:00:27.580", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000263-addr_0x0000009c3cb10000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_554", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 671033131008, "type": "region", "version": 1 }, "end_va": 671033196543, "entry_point": 0, "filename": null, "id": "region_263", "name": "private_0x0000009c3cb10000", "norm_filename": null, "region_type": "private_memory", "start_va": 671033131008, "timestamp": "00:00:27.580", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 622592, "start_va": 140716982403072, "type": "region", "version": 1 }, "end_va": 140716983025663, "entry_point": 140716982403072, "filename": "\\Windows\\System32\\sxs.dll", "id": "region_264", "name": "sxs.dll", "norm_filename": "c:\\windows\\system32\\sxs.dll", "region_type": "memory_mapped_file", "start_va": 140716982403072, "timestamp": "00:00:27.582", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000265-addr_0x0000009c3e590000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_555", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 671060918272, "type": "region", "version": 1 }, "end_va": 671061966847, "entry_point": 0, "filename": null, "id": "region_265", "name": "private_0x0000009c3e590000", "norm_filename": null, "region_type": "private_memory", "start_va": 671060918272, "timestamp": "00:00:27.756", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000266-addr_0x00007ff7cb698000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_556", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140702246338560, "type": "region", "version": 1 }, "end_va": 140702246346751, "entry_point": 0, "filename": null, "id": "region_266", "name": "private_0x00007ff7cb698000", "norm_filename": null, "region_type": "private_memory", "start_va": 140702246338560, "timestamp": "00:00:27.756", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 671032541184, "type": "region", "version": 1 }, "end_va": 671032545279, "entry_point": 0, "filename": null, "id": "region_267", "name": "pagefile_0x0000009c3ca80000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 671032541184, "timestamp": "00:00:27.761", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 753664, "start_va": 671061966848, "type": "region", "version": 1 }, "end_va": 671062720511, "entry_point": 0, "filename": null, "id": "region_268", "name": "pagefile_0x0000009c3e690000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 671061966848, "timestamp": "00:00:27.762", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 671032541184, "type": "region", "version": 1 }, "end_va": 671032557567, "entry_point": 0, "filename": null, "id": "region_269", "name": "pagefile_0x0000009c3ca80000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 671032541184, "timestamp": "00:00:27.762", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 139264, "start_va": 140716952256512, "type": "region", "version": 1 }, "end_va": 140716952395775, "entry_point": 140716952256512, "filename": "\\Windows\\System32\\dwmapi.dll", "id": "region_270", "name": "dwmapi.dll", "norm_filename": "c:\\windows\\system32\\dwmapi.dll", "region_type": "memory_mapped_file", "start_va": 140716952256512, "timestamp": "00:00:27.763", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1667072, "start_va": 140716796084224, "type": "region", "version": 1 }, "end_va": 140716797751295, "entry_point": 140716796084224, "filename": "\\Windows\\System32\\urlmon.dll", "id": "region_271", "name": "urlmon.dll", "norm_filename": "c:\\windows\\system32\\urlmon.dll", "region_type": "memory_mapped_file", "start_va": 140716796084224, "timestamp": "00:00:27.767", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 3629056, "start_va": 140716846743552, "type": "region", "version": 1 }, "end_va": 140716850372607, "entry_point": 140716846743552, "filename": "\\Windows\\System32\\iertutil.dll", "id": "region_272", "name": "iertutil.dll", "norm_filename": "c:\\windows\\system32\\iertutil.dll", "region_type": "memory_mapped_file", "start_va": 140716846743552, "timestamp": "00:00:28.173", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 45056, "start_va": 140716977684480, "type": "region", "version": 1 }, "end_va": 140716977729535, "entry_point": 140716977684480, "filename": "\\Windows\\System32\\cryptbase.dll", "id": "region_273", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\system32\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 140716977684480, "timestamp": "00:00:28.176", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 733184, "start_va": 140716992299008, "type": "region", "version": 1 }, "end_va": 140716993032191, "entry_point": 140716992299008, "filename": "\\Windows\\System32\\SHCore.dll", "id": "region_274", "name": "shcore.dll", "norm_filename": "c:\\windows\\system32\\shcore.dll", "region_type": "memory_mapped_file", "start_va": 140716992299008, "timestamp": "00:00:28.177", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 331776, "start_va": 140716997017600, "type": "region", "version": 1 }, "end_va": 140716997349375, "entry_point": 140716997017600, "filename": "\\Windows\\System32\\shlwapi.dll", "id": "region_275", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\system32\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 140716997017600, "timestamp": "00:00:28.177", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 671032606720, "type": "region", "version": 1 }, "end_va": 671032610815, "entry_point": 0, "filename": null, "id": "region_276", "name": "pagefile_0x0000009c3ca90000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 671032606720, "timestamp": "00:00:28.190", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 675840, "start_va": 140717031096320, "type": "region", "version": 1 }, "end_va": 140717031772159, "entry_point": 140717031096320, "filename": "\\Windows\\System32\\clbcatq.dll", "id": "region_277", "name": "clbcatq.dll", "norm_filename": "c:\\windows\\system32\\clbcatq.dll", "region_type": "memory_mapped_file", "start_va": 140717031096320, "timestamp": "00:00:28.190", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 671032672256, "type": "region", "version": 1 }, "end_va": 671032676351, "entry_point": 0, "filename": null, "id": "region_278", "name": "pagefile_0x0000009c3caa0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 671032672256, "timestamp": "00:00:28.408", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 140716618940416, "type": "region", "version": 1 }, "end_va": 140716619218943, "entry_point": 140716618940416, "filename": "\\Windows\\System32\\scrobj.dll", "id": "region_279", "name": "scrobj.dll", "norm_filename": "c:\\windows\\system32\\scrobj.dll", "region_type": "memory_mapped_file", "start_va": 140716618940416, "timestamp": "00:00:28.412", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000280-addr_0x0000009c3e750000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_557", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 671062753280, "type": "region", "version": 1 }, "end_va": 671063801855, "entry_point": 0, "filename": null, "id": "region_280", "name": "private_0x0000009c3e750000", "norm_filename": null, "region_type": "private_memory", "start_va": 671062753280, "timestamp": "00:00:28.536", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 65536, "start_va": 140716750274560, "type": "region", "version": 1 }, "end_va": 140716750340095, "entry_point": 140716750274560, "filename": "\\Windows\\System32\\wldp.dll", "id": "region_281", "name": "wldp.dll", "norm_filename": "c:\\windows\\system32\\wldp.dll", "region_type": "memory_mapped_file", "start_va": 140716750274560, "timestamp": "00:00:28.545", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1839104, "start_va": 140716993085440, "type": "region", "version": 1 }, "end_va": 140716994924543, "entry_point": 140716993085440, "filename": "\\Windows\\System32\\crypt32.dll", "id": "region_282", "name": "crypt32.dll", "norm_filename": "c:\\windows\\system32\\crypt32.dll", "region_type": "memory_mapped_file", "start_va": 140716993085440, "timestamp": "00:00:28.606", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 69632, "start_va": 140716983713792, "type": "region", "version": 1 }, "end_va": 140716983783423, "entry_point": 140716983713792, "filename": "\\Windows\\System32\\msasn1.dll", "id": "region_283", "name": "msasn1.dll", "norm_filename": "c:\\windows\\system32\\msasn1.dll", "region_type": "memory_mapped_file", "start_va": 140716983713792, "timestamp": "00:00:28.974", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 344064, "start_va": 140716991184896, "type": "region", "version": 1 }, "end_va": 140716991528959, "entry_point": 140716991184896, "filename": "\\Windows\\System32\\wintrust.dll", "id": "region_284", "name": "wintrust.dll", "norm_filename": "c:\\windows\\system32\\wintrust.dll", "region_type": "memory_mapped_file", "start_va": 140716991184896, "timestamp": "00:00:29.053", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 98304, "start_va": 671032737792, "type": "region", "version": 1 }, "end_va": 671032836095, "entry_point": 0, "filename": null, "id": "region_285", "name": "pagefile_0x0000009c3cab0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 671032737792, "timestamp": "00:00:29.300", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 94208, "start_va": 140716976177152, "type": "region", "version": 1 }, "end_va": 140716976271359, "entry_point": 140716976177152, "filename": "\\Windows\\System32\\cryptsp.dll", "id": "region_286", "name": "cryptsp.dll", "norm_filename": "c:\\windows\\system32\\cryptsp.dll", "region_type": "memory_mapped_file", "start_va": 140716976177152, "timestamp": "00:00:29.315", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 163840, "start_va": 140716981747712, "type": "region", "version": 1 }, "end_va": 140716981911551, "entry_point": 140716981747712, "filename": "\\Windows\\System32\\bcrypt.dll", "id": "region_287", "name": "bcrypt.dll", "norm_filename": "c:\\windows\\system32\\bcrypt.dll", "region_type": "memory_mapped_file", "start_va": 140716981747712, "timestamp": "00:00:29.409", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 208896, "start_va": 140716972310528, "type": "region", "version": 1 }, "end_va": 140716972519423, "entry_point": 140716972310528, "filename": "\\Windows\\System32\\rsaenh.dll", "id": "region_288", "name": "rsaenh.dll", "norm_filename": "c:\\windows\\system32\\rsaenh.dll", "region_type": "memory_mapped_file", "start_va": 140716972310528, "timestamp": "00:00:29.414", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000290-addr_0x0000009c3e850000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_558", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 671063801856, "type": "region", "version": 1 }, "end_va": 671064850431, "entry_point": 0, "filename": null, "id": "region_290", "name": "private_0x0000009c3e850000", "norm_filename": null, "region_type": "private_memory", "start_va": 671063801856, "timestamp": "00:00:29.598", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000291-addr_0x00007ff7cb696000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_559", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140702246330368, "type": "region", "version": 1 }, "end_va": 140702246338559, "entry_point": 0, "filename": null, "id": "region_291", "name": "private_0x00007ff7cb696000", "norm_filename": null, "region_type": "private_memory", "start_va": 140702246330368, "timestamp": "00:00:29.599", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 140716831997952, "type": "region", "version": 1 }, "end_va": 140716832047103, "entry_point": 140716831997952, "filename": "\\Windows\\System32\\msisip.dll", "id": "region_292", "name": "msisip.dll", "norm_filename": "c:\\windows\\system32\\msisip.dll", "region_type": "memory_mapped_file", "start_va": 140716831997952, "timestamp": "00:00:29.604", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 454656, "start_va": 140717026312192, "type": "region", "version": 1 }, "end_va": 140717026766847, "entry_point": 140717026312192, "filename": "\\Windows\\System32\\coml2.dll", "id": "region_293", "name": "coml2.dll", "norm_filename": "c:\\windows\\system32\\coml2.dll", "region_type": "memory_mapped_file", "start_va": 140717026312192, "timestamp": "00:00:29.666", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16777216, "start_va": 671064850432, "type": "region", "version": 1 }, "end_va": 671081627647, "entry_point": 0, "filename": null, "id": "region_294", "name": "pagefile_0x0000009c3e950000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 671064850432, "timestamp": "00:00:29.798", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 98304, "start_va": 671032868864, "type": "region", "version": 1 }, "end_va": 671032967167, "entry_point": 0, "filename": null, "id": "region_295", "name": "pagefile_0x0000009c3cad0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 671032868864, "timestamp": "00:00:29.799", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000296-addr_0x0000009c3e950000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_560", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 671064850432, "type": "region", "version": 1 }, "end_va": 671065899007, "entry_point": 0, "filename": null, "id": "region_296", "name": "private_0x0000009c3e950000", "norm_filename": null, "region_type": "private_memory", "start_va": 671064850432, "timestamp": "00:00:29.803", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000297-addr_0x00007ff7cb694000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_561", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140702246322176, "type": "region", "version": 1 }, "end_va": 140702246330367, "entry_point": 0, "filename": null, "id": "region_297", "name": "private_0x00007ff7cb694000", "norm_filename": null, "region_type": "private_memory", "start_va": 140702246322176, "timestamp": "00:00:29.804", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 118784, "start_va": 140716650070016, "type": "region", "version": 1 }, "end_va": 140716650188799, "entry_point": 140716650070016, "filename": "\\Windows\\System32\\wshext.dll", "id": "region_298", "name": "wshext.dll", "norm_filename": "c:\\windows\\system32\\wshext.dll", "region_type": "memory_mapped_file", "start_va": 140716650070016, "timestamp": "00:00:29.804", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 696320, "start_va": 140716618219520, "type": "region", "version": 1 }, "end_va": 140716618915839, "entry_point": 140716618219520, "filename": "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10240.16384_none_0212ec7eba871e86\\comctl32.dll", "id": "region_299", "name": "comctl32.dll", "norm_filename": "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10240.16384_none_0212ec7eba871e86\\comctl32.dll", "region_type": "memory_mapped_file", "start_va": 140716618219520, "timestamp": "00:00:30.096", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 22171648, "start_va": 140716997410816, "type": "region", "version": 1 }, "end_va": 140717019582463, "entry_point": 140716997410816, "filename": "\\Windows\\System32\\shell32.dll", "id": "region_300", "name": "shell32.dll", "norm_filename": "c:\\windows\\system32\\shell32.dll", "region_type": "memory_mapped_file", "start_va": 140716997410816, "timestamp": "00:00:30.166", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 6455296, "start_va": 140716984369152, "type": "region", "version": 1 }, "end_va": 140716990824447, "entry_point": 140716984369152, "filename": "\\Windows\\System32\\windows.storage.dll", "id": "region_301", "name": "windows.storage.dll", "norm_filename": "c:\\windows\\system32\\windows.storage.dll", "region_type": "memory_mapped_file", "start_va": 140716984369152, "timestamp": "00:00:30.173", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 303104, "start_va": 140716984041472, "type": "region", "version": 1 }, "end_va": 140716984344575, "entry_point": 140716984041472, "filename": "\\Windows\\System32\\powrprof.dll", "id": "region_302", "name": "powrprof.dll", "norm_filename": "c:\\windows\\system32\\powrprof.dll", "region_type": "memory_mapped_file", "start_va": 140716984041472, "timestamp": "00:00:30.174", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 77824, "start_va": 140716983910400, "type": "region", "version": 1 }, "end_va": 140716983988223, "entry_point": 140716983910400, "filename": "\\Windows\\System32\\profapi.dll", "id": "region_303", "name": "profapi.dll", "norm_filename": "c:\\windows\\system32\\profapi.dll", "region_type": "memory_mapped_file", "start_va": 140716983910400, "timestamp": "00:00:30.175", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000304-addr_0x0000009c3ea50000-size_0x0000000000110000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_562", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1114112, "start_va": 671065899008, "type": "region", "version": 1 }, "end_va": 671067013119, "entry_point": 0, "filename": null, "id": "region_304", "name": "private_0x0000009c3ea50000", "norm_filename": null, "region_type": "private_memory", "start_va": 671065899008, "timestamp": "00:00:30.180", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000305-addr_0x0000009c3cad0000-size_0x0000000000007000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_563", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 28672, "start_va": 671032868864, "type": "region", "version": 1 }, "end_va": 671032897535, "entry_point": 0, "filename": null, "id": "region_305", "name": "private_0x0000009c3cad0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671032868864, "timestamp": "00:00:30.184", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000306-addr_0x0000009c3eb60000-size_0x0000000000200000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_564", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 2097152, "start_va": 671067013120, "type": "region", "version": 1 }, "end_va": 671069110271, "entry_point": 0, "filename": null, "id": "region_306", "name": "private_0x0000009c3eb60000", "norm_filename": null, "region_type": "private_memory", "start_va": 671067013120, "timestamp": "00:00:30.208", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000307-addr_0x0000009c3cab0000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_565", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 671032737792, "type": "region", "version": 1 }, "end_va": 671032803327, "entry_point": 0, "filename": null, "id": "region_307", "name": "private_0x0000009c3cab0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671032737792, "timestamp": "00:00:30.228", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 843776, "start_va": 140716614221824, "type": "region", "version": 1 }, "end_va": 140716615065599, "entry_point": 140716614221824, "filename": "\\Windows\\System32\\jscript.dll", "id": "region_308", "name": "jscript.dll", "norm_filename": "c:\\windows\\system32\\jscript.dll", "region_type": "memory_mapped_file", "start_va": 140716614221824, "timestamp": "00:00:30.230", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 65536, "start_va": 140716771049472, "type": "region", "version": 1 }, "end_va": 140716771115007, "entry_point": 140716771049472, "filename": "\\Windows\\System32\\amsi.dll", "id": "region_309", "name": "amsi.dll", "norm_filename": "c:\\windows\\system32\\amsi.dll", "region_type": "memory_mapped_file", "start_va": 140716771049472, "timestamp": "00:00:30.451", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 118784, "start_va": 140716648693760, "type": "region", "version": 1 }, "end_va": 140716648812543, "entry_point": 140716648693760, "filename": "\\Program Files\\Windows Defender\\MpOAV.dll", "id": "region_310", "name": "mpoav.dll", "norm_filename": "c:\\program files\\windows defender\\mpoav.dll", "region_type": "memory_mapped_file", "start_va": 140716648693760, "timestamp": "00:00:30.606", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000311-addr_0x0000009c3ea50000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_566", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 671065899008, "type": "region", "version": 1 }, "end_va": 671066947583, "entry_point": 0, "filename": null, "id": "region_311", "name": "private_0x0000009c3ea50000", "norm_filename": null, "region_type": "private_memory", "start_va": 671065899008, "timestamp": "00:00:30.751", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000312-addr_0x0000009c3eb50000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_567", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 671066947584, "type": "region", "version": 1 }, "end_va": 671067013119, "entry_point": 0, "filename": null, "id": "region_312", "name": "private_0x0000009c3eb50000", "norm_filename": null, "region_type": "private_memory", "start_va": 671066947584, "timestamp": "00:00:30.755", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000313-addr_0x0000009c3ed60000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_568", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 671069110272, "type": "region", "version": 1 }, "end_va": 671070158847, "entry_point": 0, "filename": null, "id": "region_313", "name": "private_0x0000009c3ed60000", "norm_filename": null, "region_type": "private_memory", "start_va": 671069110272, "timestamp": "00:00:30.756", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000314-addr_0x0000009c3ee60000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_569", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 671070158848, "type": "region", "version": 1 }, "end_va": 671071207423, "entry_point": 0, "filename": null, "id": "region_314", "name": "private_0x0000009c3ee60000", "norm_filename": null, "region_type": "private_memory", "start_va": 671070158848, "timestamp": "00:00:30.757", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000315-addr_0x00007ff7cb56a000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_570", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140702245101568, "type": "region", "version": 1 }, "end_va": 140702245109759, "entry_point": 0, "filename": null, "id": "region_315", "name": "private_0x00007ff7cb56a000", "norm_filename": null, "region_type": "private_memory", "start_va": 140702245101568, "timestamp": "00:00:30.757", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000316-addr_0x00007ff7cb56c000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_571", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140702245109760, "type": "region", "version": 1 }, "end_va": 140702245117951, "entry_point": 0, "filename": null, "id": "region_316", "name": "private_0x00007ff7cb56c000", "norm_filename": null, "region_type": "private_memory", "start_va": 140702245109760, "timestamp": "00:00:30.762", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000317-addr_0x00007ff7cb56e000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_572", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140702245117952, "type": "region", "version": 1 }, "end_va": 140702245126143, "entry_point": 0, "filename": null, "id": "region_317", "name": "private_0x00007ff7cb56e000", "norm_filename": null, "region_type": "private_memory", "start_va": 140702245117952, "timestamp": "00:00:30.762", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 892928, "start_va": 140716613304320, "type": "region", "version": 1 }, "end_va": 140716614197247, "entry_point": 140716613304320, "filename": "\\Program Files\\Windows Defender\\MpClient.dll", "id": "region_318", "name": "mpclient.dll", "norm_filename": "c:\\program files\\windows defender\\mpclient.dll", "region_type": "memory_mapped_file", "start_va": 140716613304320, "timestamp": "00:00:30.821", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 126976, "start_va": 140716973293568, "type": "region", "version": 1 }, "end_va": 140716973420543, "entry_point": 140716973293568, "filename": "\\Windows\\System32\\userenv.dll", "id": "region_319", "name": "userenv.dll", "norm_filename": "c:\\windows\\system32\\userenv.dll", "region_type": "memory_mapped_file", "start_va": 140716973293568, "timestamp": "00:00:31.185", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 671032803328, "type": "region", "version": 1 }, "end_va": 671032811519, "entry_point": 671032803328, "filename": "\\Program Files\\Windows Defender\\MsMpLics.dll", "id": "region_320", "name": "msmplics.dll", "norm_filename": "c:\\program files\\windows defender\\msmplics.dll", "region_type": "memory_mapped_file", "start_va": 671032803328, "timestamp": "00:00:31.204", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 143360, "start_va": 140716966019072, "type": "region", "version": 1 }, "end_va": 140716966162431, "entry_point": 140716966019072, "filename": "\\Windows\\System32\\gpapi.dll", "id": "region_321", "name": "gpapi.dll", "norm_filename": "c:\\windows\\system32\\gpapi.dll", "region_type": "memory_mapped_file", "start_va": 140716966019072, "timestamp": "00:00:31.215", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000322-addr_0x0000009c3ef60000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_573", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 671071207424, "type": "region", "version": 1 }, "end_va": 671072255999, "entry_point": 0, "filename": null, "id": "region_322", "name": "private_0x0000009c3ef60000", "norm_filename": null, "region_type": "private_memory", "start_va": 671071207424, "timestamp": "00:00:32.687", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000323-addr_0x0000009c3f060000-size_0x0000000000400000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_574", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4194304, "start_va": 671072256000, "type": "region", "version": 1 }, "end_va": 671076450303, "entry_point": 0, "filename": null, "id": "region_323", "name": "private_0x0000009c3f060000", "norm_filename": null, "region_type": "private_memory", "start_va": 671072256000, "timestamp": "00:00:32.687", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000324-addr_0x0000009c3f5b0000-size_0x0000000000200000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_575", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 2097152, "start_va": 671077826560, "type": "region", "version": 1 }, "end_va": 671079923711, "entry_point": 0, "filename": null, "id": "region_324", "name": "private_0x0000009c3f5b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671077826560, "timestamp": "00:00:32.688", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000325-addr_0x0000009c3f7b0000-size_0x0000000000800000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_576", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8388608, "start_va": 671079923712, "type": "region", "version": 1 }, "end_va": 671088312319, "entry_point": 0, "filename": null, "id": "region_325", "name": "private_0x0000009c3f7b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671079923712, "timestamp": "00:00:32.689", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000326-addr_0x0000009c3ffb0000-size_0x0000000000400000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_577", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4194304, "start_va": 671088312320, "type": "region", "version": 1 }, "end_va": 671092506623, "entry_point": 0, "filename": null, "id": "region_326", "name": "private_0x0000009c3ffb0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671088312320, "timestamp": "00:00:32.689", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 167936, "start_va": 140716635455488, "type": "region", "version": 1 }, "end_va": 140716635623423, "entry_point": 140716635455488, "filename": "\\Windows\\System32\\wshom.ocx", "id": "region_327", "name": "wshom.ocx", "norm_filename": "c:\\windows\\system32\\wshom.ocx", "region_type": "memory_mapped_file", "start_va": 140716635455488, "timestamp": "00:00:32.689", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 217088, "start_va": 140716620316672, "type": "region", "version": 1 }, "end_va": 140716620533759, "entry_point": 140716620316672, "filename": "\\Windows\\System32\\scrrun.dll", "id": "region_328", "name": "scrrun.dll", "norm_filename": "c:\\windows\\system32\\scrrun.dll", "region_type": "memory_mapped_file", "start_va": 140716620316672, "timestamp": "00:00:32.879", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 114688, "start_va": 140716969230336, "type": "region", "version": 1 }, "end_va": 140716969345023, "entry_point": 140716969230336, "filename": "\\Windows\\System32\\mpr.dll", "id": "region_329", "name": "mpr.dll", "norm_filename": "c:\\windows\\system32\\mpr.dll", "region_type": "memory_mapped_file", "start_va": 140716969230336, "timestamp": "00:00:32.881", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 77824, "start_va": 671032934400, "type": "region", "version": 1 }, "end_va": 671033012223, "entry_point": 671032934400, "filename": "\\Windows\\System32\\wshom.ocx", "id": "region_330", "name": "wshom.ocx", "norm_filename": "c:\\windows\\system32\\wshom.ocx", "region_type": "memory_mapped_file", "start_va": 671032934400, "timestamp": "00:00:32.891", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 671032803328, "type": "region", "version": 1 }, "end_va": 671032815615, "entry_point": 671032803328, "filename": "\\Windows\\System32\\tzres.dll", "id": "region_331", "name": "tzres.dll", "norm_filename": "c:\\windows\\system32\\tzres.dll", "region_type": "memory_mapped_file", "start_va": 671032803328, "timestamp": "00:00:32.894", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 36864, "start_va": 671033065472, "type": "region", "version": 1 }, "end_va": 671033102335, "entry_point": 671033065472, "filename": "\\Windows\\System32\\en-US\\tzres.dll.mui", "id": "region_332", "name": "tzres.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\tzres.dll.mui", "region_type": "memory_mapped_file", "start_va": 671033065472, "timestamp": "00:00:32.896", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2322432, "start_va": 140716610945024, "type": "region", "version": 1 }, "end_va": 140716613267455, "entry_point": 140716610945024, "filename": "\\Windows\\System32\\msxml3.dll", "id": "region_335", "name": "msxml3.dll", "norm_filename": "c:\\windows\\system32\\msxml3.dll", "region_type": "memory_mapped_file", "start_va": 140716610945024, "timestamp": "00:00:32.930", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000336-addr_0x0000009c3f460000-size_0x0000000000050000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_578", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 327680, "start_va": 671076450304, "type": "region", "version": 1 }, "end_va": 671076777983, "entry_point": 0, "filename": null, "id": "region_336", "name": "private_0x0000009c3f460000", "norm_filename": null, "region_type": "private_memory", "start_va": 671076450304, "timestamp": "00:00:33.077", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000337-addr_0x0000009c403b0000-size_0x0000000000140000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_579", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1310720, "start_va": 671092506624, "type": "region", "version": 1 }, "end_va": 671093817343, "entry_point": 0, "filename": null, "id": "region_337", "name": "private_0x0000009c403b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671092506624, "timestamp": "00:00:33.080", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000338-addr_0x0000009c3f4b0000-size_0x0000000000060000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_580", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 393216, "start_va": 671076777984, "type": "region", "version": 1 }, "end_va": 671077171199, "entry_point": 0, "filename": null, "id": "region_338", "name": "private_0x0000009c3f4b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671076777984, "timestamp": "00:00:33.081", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000339-addr_0x0000009c404f0000-size_0x00000000001e0000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_581", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1966080, "start_va": 671093817344, "type": "region", "version": 1 }, "end_va": 671095783423, "entry_point": 0, "filename": null, "id": "region_339", "name": "private_0x0000009c404f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671093817344, "timestamp": "00:00:33.082", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000340-addr_0x0000009c406d0000-size_0x00000000001f0000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_582", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 2031616, "start_va": 671095783424, "type": "region", "version": 1 }, "end_va": 671097815039, "entry_point": 0, "filename": null, "id": "region_340", "name": "private_0x0000009c406d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671095783424, "timestamp": "00:00:33.083", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 913408, "start_va": 671092506624, "type": "region", "version": 1 }, "end_va": 671093420031, "entry_point": 671092506624, "filename": "\\Windows\\System32\\en-US\\KernelBase.dll.mui", "id": "region_341", "name": "kernelbase.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\kernelbase.dll.mui", "region_type": "memory_mapped_file", "start_va": 671092506624, "timestamp": "00:00:33.102", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000342-addr_0x0000009c404e0000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_583", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 671093751808, "type": "region", "version": 1 }, "end_va": 671093817343, "entry_point": 0, "filename": null, "id": "region_342", "name": "private_0x0000009c404e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671093751808, "timestamp": "00:00:33.116", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000343-addr_0x0000009c408c0000-size_0x0000000000400000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_584", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4194304, "start_va": 671097815040, "type": "region", "version": 1 }, "end_va": 671102009343, "entry_point": 0, "filename": null, "id": "region_343", "name": "private_0x0000009c408c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671097815040, "timestamp": "00:00:33.120", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 671032803328, "type": "region", "version": 1 }, "end_va": 671032807423, "entry_point": 671032803328, "filename": "\\Windows\\System32\\msxml3r.dll", "id": "region_344", "name": "msxml3r.dll", "norm_filename": "c:\\windows\\system32\\msxml3r.dll", "region_type": "memory_mapped_file", "start_va": 671032803328, "timestamp": "00:00:33.123", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2781184, "start_va": 140716791169024, "type": "region", "version": 1 }, "end_va": 140716793950207, "entry_point": 140716791169024, "filename": "\\Windows\\System32\\wininet.dll", "id": "region_345", "name": "wininet.dll", "norm_filename": "c:\\windows\\system32\\wininet.dll", "region_type": "memory_mapped_file", "start_va": 140716791169024, "timestamp": "00:00:33.148", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 249856, "start_va": 140716652167168, "type": "region", "version": 1 }, "end_va": 140716652417023, "entry_point": 140716652167168, "filename": "\\Windows\\System32\\mlang.dll", "id": "region_346", "name": "mlang.dll", "norm_filename": "c:\\windows\\system32\\mlang.dll", "region_type": "memory_mapped_file", "start_va": 140716652167168, "timestamp": "00:00:33.661", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 180224, "start_va": 140716979650560, "type": "region", "version": 1 }, "end_va": 140716979830783, "entry_point": 140716979650560, "filename": "\\Windows\\System32\\sspicli.dll", "id": "region_347", "name": "sspicli.dll", "norm_filename": "c:\\windows\\system32\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 140716979650560, "timestamp": "00:00:33.887", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 671033065472, "type": "region", "version": 1 }, "end_va": 671033069567, "entry_point": 0, "filename": null, "id": "region_348", "name": "pagefile_0x0000009c3cb00000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 671033065472, "timestamp": "00:00:33.997", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000349-addr_0x0000009c3f460000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_585", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 671076450304, "type": "region", "version": 1 }, "end_va": 671076454399, "entry_point": 671076450304, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\INetCache\\counters.dat", "id": "region_349", "name": "counters.dat", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\inetcache\\counters.dat", "region_type": "memory_mapped_file", "start_va": 671076450304, "timestamp": "00:00:34.006", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000350-addr_0x0000009c3f4a0000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_586", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 671076712448, "type": "region", "version": 1 }, "end_va": 671076777983, "entry_point": 0, "filename": null, "id": "region_350", "name": "private_0x0000009c3f4a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671076712448, "timestamp": "00:00:34.007", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 430080, "start_va": 140717025853440, "type": "region", "version": 1 }, "end_va": 140717026283519, "entry_point": 140717025853440, "filename": "\\Windows\\System32\\ws2_32.dll", "id": "region_351", "name": "ws2_32.dll", "norm_filename": "c:\\windows\\system32\\ws2_32.dll", "region_type": "memory_mapped_file", "start_va": 140717025853440, "timestamp": "00:00:34.012", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 140716996952064, "type": "region", "version": 1 }, "end_va": 140716996984831, "entry_point": 140716996952064, "filename": "\\Windows\\System32\\nsi.dll", "id": "region_352", "name": "nsi.dll", "norm_filename": "c:\\windows\\system32\\nsi.dll", "region_type": "memory_mapped_file", "start_va": 140716996952064, "timestamp": "00:00:34.266", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 86016, "start_va": 140716798377984, "type": "region", "version": 1 }, "end_va": 140716798463999, "entry_point": 140716798377984, "filename": "\\Windows\\System32\\OnDemandConnRouteHelper.dll", "id": "region_353", "name": "ondemandconnroutehelper.dll", "norm_filename": "c:\\windows\\system32\\ondemandconnroutehelper.dll", "region_type": "memory_mapped_file", "start_va": 140716798377984, "timestamp": "00:00:34.293", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 45056, "start_va": 140716940394496, "type": "region", "version": 1 }, "end_va": 140716940439551, "entry_point": 140716940394496, "filename": "\\Windows\\System32\\winnsi.dll", "id": "region_354", "name": "winnsi.dll", "norm_filename": "c:\\windows\\system32\\winnsi.dll", "region_type": "memory_mapped_file", "start_va": 140716940394496, "timestamp": "00:00:34.397", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 229376, "start_va": 140716940525568, "type": "region", "version": 1 }, "end_va": 140716940754943, "entry_point": 140716940525568, "filename": "\\Windows\\System32\\IPHLPAPI.DLL", "id": "region_355", "name": "iphlpapi.dll", "norm_filename": "c:\\windows\\system32\\iphlpapi.dll", "region_type": "memory_mapped_file", "start_va": 140716940525568, "timestamp": "00:00:34.401", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 876544, "start_va": 140716873285632, "type": "region", "version": 1 }, "end_va": 140716874162175, "entry_point": 140716873285632, "filename": "\\Windows\\System32\\winhttp.dll", "id": "region_356", "name": "winhttp.dll", "norm_filename": "c:\\windows\\system32\\winhttp.dll", "region_type": "memory_mapped_file", "start_va": 140716873285632, "timestamp": "00:00:34.406", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 380928, "start_va": 140716975783936, "type": "region", "version": 1 }, "end_va": 140716976164863, "entry_point": 140716975783936, "filename": "\\Windows\\System32\\mswsock.dll", "id": "region_357", "name": "mswsock.dll", "norm_filename": "c:\\windows\\system32\\mswsock.dll", "region_type": "memory_mapped_file", "start_va": 140716975783936, "timestamp": "00:00:34.609", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 671076515840, "type": "region", "version": 1 }, "end_va": 671076519935, "entry_point": 0, "filename": null, "id": "region_358", "name": "pagefile_0x0000009c3f470000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 671076515840, "timestamp": "00:00:34.625", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 688128, "start_va": 140716973686784, "type": "region", "version": 1 }, "end_va": 140716974374911, "entry_point": 140716973686784, "filename": "\\Windows\\System32\\dnsapi.dll", "id": "region_359", "name": "dnsapi.dll", "norm_filename": "c:\\windows\\system32\\dnsapi.dll", "region_type": "memory_mapped_file", "start_va": 140716973686784, "timestamp": "00:00:34.654", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 671076581376, "type": "region", "version": 1 }, "end_va": 671076589567, "entry_point": 0, "filename": null, "id": "region_360", "name": "pagefile_0x0000009c3f480000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 671076581376, "timestamp": "00:00:34.844", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 671076581376, "type": "region", "version": 1 }, "end_va": 671076646911, "entry_point": 0, "filename": null, "id": "region_361", "name": "pagefile_0x0000009c3f480000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 671076581376, "timestamp": "00:00:34.846", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 140716828000256, "type": "region", "version": 1 }, "end_va": 140716828041215, "entry_point": 140716828000256, "filename": "\\Windows\\System32\\rasadhlp.dll", "id": "region_362", "name": "rasadhlp.dll", "norm_filename": "c:\\windows\\system32\\rasadhlp.dll", "region_type": "memory_mapped_file", "start_va": 140716828000256, "timestamp": "00:00:34.858", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 425984, "start_va": 140716921454592, "type": "region", "version": 1 }, "end_va": 140716921880575, "entry_point": 140716921454592, "filename": "\\Windows\\System32\\FWPUCLNT.DLL", "id": "region_363", "name": "fwpuclnt.dll", "norm_filename": "c:\\windows\\system32\\fwpuclnt.dll", "region_type": "memory_mapped_file", "start_va": 140716921454592, "timestamp": "00:00:34.917", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 671076646912, "type": "region", "version": 1 }, "end_va": 671076655103, "entry_point": 0, "filename": null, "id": "region_364", "name": "pagefile_0x0000009c3f490000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 671076646912, "timestamp": "00:00:34.944", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2572288, "start_va": 140716899303424, "type": "region", "version": 1 }, "end_va": 140716901875711, "entry_point": 140716899303424, "filename": "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll", "id": "region_365", "name": "comctl32.dll", "norm_filename": "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll", "region_type": "memory_mapped_file", "start_va": 140716899303424, "timestamp": "00:00:34.945", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 671076777984, "type": "region", "version": 1 }, "end_va": 671076790271, "entry_point": 671076777984, "filename": "\\Windows\\System32\\en-US\\mswsock.dll.mui", "id": "region_366", "name": "mswsock.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\mswsock.dll.mui", "region_type": "memory_mapped_file", "start_va": 671076777984, "timestamp": "00:00:35.117", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000368-addr_0x0000009c3f500000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_587", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 671077105664, "type": "region", "version": 1 }, "end_va": 671077171199, "entry_point": 0, "filename": null, "id": "region_368", "name": "private_0x0000009c3f500000", "norm_filename": null, "region_type": "private_memory", "start_va": 671077105664, "timestamp": "00:00:35.117", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000370-addr_0x0000009c3f4d0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_588", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 671076909056, "type": "region", "version": 1 }, "end_va": 671076913151, "entry_point": 0, "filename": null, "id": "region_370", "name": "private_0x0000009c3f4d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671076909056, "timestamp": "00:00:35.340", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000378-addr_0x0000009c404f0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_589", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 671093817344, "type": "region", "version": 1 }, "end_va": 671094865919, "entry_point": 0, "filename": null, "id": "region_378", "name": "private_0x0000009c404f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671093817344, "timestamp": "00:00:35.422", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000379-addr_0x0000009c406c0000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_590", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 671095717888, "type": "region", "version": 1 }, "end_va": 671095783423, "entry_point": 0, "filename": null, "id": "region_379", "name": "private_0x0000009c406c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671095717888, "timestamp": "00:00:35.423", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000380-addr_0x00007ff7cb568000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_591", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140702245093376, "type": "region", "version": 1 }, "end_va": 140702245101567, "entry_point": 0, "filename": null, "id": "region_380", "name": "private_0x00007ff7cb568000", "norm_filename": null, "region_type": "private_memory", "start_va": 140702245093376, "timestamp": "00:00:35.423", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000386-addr_0x0000009c406d0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_592", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 671095783424, "type": "region", "version": 1 }, "end_va": 671096831999, "entry_point": 0, "filename": null, "id": "region_386", "name": "private_0x0000009c406d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671095783424, "timestamp": "00:00:35.940", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000387-addr_0x0000009c408b0000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_593", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 671097749504, "type": "region", "version": 1 }, "end_va": 671097815039, "entry_point": 0, "filename": null, "id": "region_387", "name": "private_0x0000009c408b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671097749504, "timestamp": "00:00:35.940", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000388-addr_0x0000009c40cc0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_594", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 671102009344, "type": "region", "version": 1 }, "end_va": 671103057919, "entry_point": 0, "filename": null, "id": "region_388", "name": "private_0x0000009c40cc0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671102009344, "timestamp": "00:00:35.941", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000389-addr_0x0000009c40dc0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_595", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 671103057920, "type": "region", "version": 1 }, "end_va": 671104106495, "entry_point": 0, "filename": null, "id": "region_389", "name": "private_0x0000009c40dc0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671103057920, "timestamp": "00:00:35.941", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000390-addr_0x00007ff7cb562000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_596", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140702245068800, "type": "region", "version": 1 }, "end_va": 140702245076991, "entry_point": 0, "filename": null, "id": "region_390", "name": "private_0x00007ff7cb562000", "norm_filename": null, "region_type": "private_memory", "start_va": 140702245068800, "timestamp": "00:00:35.941", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000391-addr_0x00007ff7cb564000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_597", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140702245076992, "type": "region", "version": 1 }, "end_va": 140702245085183, "entry_point": 0, "filename": null, "id": "region_391", "name": "private_0x00007ff7cb564000", "norm_filename": null, "region_type": "private_memory", "start_va": 140702245076992, "timestamp": "00:00:35.942", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000392-addr_0x00007ff7cb566000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_598", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140702245085184, "type": "region", "version": 1 }, "end_va": 140702245093375, "entry_point": 0, "filename": null, "id": "region_392", "name": "private_0x00007ff7cb566000", "norm_filename": null, "region_type": "private_memory", "start_va": 140702245085184, "timestamp": "00:00:35.942", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000395-addr_0x0000009c404f0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_599", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 671093817344, "type": "region", "version": 1 }, "end_va": 671094865919, "entry_point": 0, "filename": null, "id": "region_395", "name": "private_0x0000009c404f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671093817344, "timestamp": "00:00:39.507", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000398-addr_0x0000009c40dc0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_600", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 671103057920, "type": "region", "version": 1 }, "end_va": 671104106495, "entry_point": 0, "filename": null, "id": "region_398", "name": "private_0x0000009c40dc0000", "norm_filename": null, "region_type": "private_memory", "start_va": 671103057920, "timestamp": "00:00:40.318", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000001-region_00000399-addr_0x00007ff7cb568000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_601", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 140702245093376, "type": "region", "version": 1 }, "end_va": 140702245101567, "entry_point": 0, "filename": null, "id": "region_399", "name": "private_0x00007ff7cb568000", "norm_filename": null, "region_type": "private_memory", "start_va": 140702245093376, "timestamp": "00:00:40.318", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "\"C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\84526935.scr\" /S", "filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\84526935.scr", "id": "proc_3", "image_name": "84526935.scr", "monitor_reason": "child_process", "monitored_id": 3, "origin_monitor_id": 1, "ref_parent_process": { "ref_id": "proc_1", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "process_00000003-region_00000410-addr_0x0000000000010000-size_0x0000000000020000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_602", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 131072, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 196607, "entry_point": 0, "filename": null, "id": "region_410", "name": "private_0x0000000000010000", "norm_filename": null, "region_type": "private_memory", "start_va": 65536, "timestamp": "00:00:40.449", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000411-addr_0x0000000000030000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_603", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 204799, "entry_point": 0, "filename": null, "id": "region_411", "name": "private_0x0000000000030000", "norm_filename": null, "region_type": "private_memory", "start_va": 196608, "timestamp": "00:00:40.449", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 262144, "type": "region", "version": 1 }, "end_va": 344063, "entry_point": 0, "filename": null, "id": "region_412", "name": "pagefile_0x0000000000040000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 262144, "timestamp": "00:00:40.449", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000413-addr_0x0000000000060000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_604", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 393216, "type": "region", "version": 1 }, "end_va": 655359, "entry_point": 0, "filename": null, "id": "region_413", "name": "private_0x0000000000060000", "norm_filename": null, "region_type": "private_memory", "start_va": 393216, "timestamp": "00:00:40.450", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000414-addr_0x00000000000a0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_605", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 655360, "type": "region", "version": 1 }, "end_va": 1703935, "entry_point": 0, "filename": null, "id": "region_414", "name": "private_0x00000000000a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 655360, "timestamp": "00:00:40.450", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 1703936, "type": "region", "version": 1 }, "end_va": 1720319, "entry_point": 0, "filename": null, "id": "region_415", "name": "pagefile_0x00000000001a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1703936, "timestamp": "00:00:40.450", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 1769472, "type": "region", "version": 1 }, "end_va": 1773567, "entry_point": 0, "filename": null, "id": "region_416", "name": "pagefile_0x00000000001b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1769472, "timestamp": "00:00:40.450", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000417-addr_0x00000000001c0000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_606", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 1835008, "type": "region", "version": 1 }, "end_va": 1843199, "entry_point": 0, "filename": null, "id": "region_417", "name": "private_0x00000000001c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1835008, "timestamp": "00:00:40.450", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000418-addr_0x0000000000400000-size_0x00000000000a2000-perm_rwx.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": { "ref_id": "proc_dump_607", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 663552, "start_va": 4194304, "type": "region", "version": 1 }, "end_va": 4857855, "entry_point": 4194304, "filename": "\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\84526935.scr", "id": "region_418", "name": "84526935.scr", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\local\\temp\\84526935.scr", "region_type": "memory_mapped_file", "start_va": 4194304, "timestamp": "00:00:40.451", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1544192, "start_va": 1998127104, "type": "region", "version": 1 }, "end_va": 1999671295, "entry_point": 1998127104, "filename": "\\Windows\\SysWOW64\\ntdll.dll", "id": "region_419", "name": "ntdll.dll", "norm_filename": "c:\\windows\\syswow64\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1998127104, "timestamp": "00:00:40.452", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 2147155968, "type": "region", "version": 1 }, "end_va": 2147299327, "entry_point": 0, "filename": null, "id": "region_420", "name": "pagefile_0x000000007ffb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2147155968, "timestamp": "00:00:40.599", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000421-addr_0x000000007ffdb000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_608", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2147332096, "type": "region", "version": 1 }, "end_va": 2147344383, "entry_point": 0, "filename": null, "id": "region_421", "name": "private_0x000000007ffdb000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147332096, "timestamp": "00:00:40.600", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000422-addr_0x000000007ffde000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_609", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2147344384, "type": "region", "version": 1 }, "end_va": 2147348479, "entry_point": 0, "filename": null, "id": "region_422", "name": "private_0x000000007ffde000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147344384, "timestamp": "00:00:40.600", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000423-addr_0x000000007ffdf000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_610", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2147348480, "type": "region", "version": 1 }, "end_va": 2147352575, "entry_point": 0, "filename": null, "id": "region_423", "name": "private_0x000000007ffdf000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147348480, "timestamp": "00:00:40.601", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000424-addr_0x000000007ffe0000-size_0x0000000000010000-perm_r.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable" ], "ref_process_dump": { "ref_id": "proc_dump_611", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_424", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:00:40.601", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 140714892722176, "start_va": 2147418112, "type": "region", "version": 1 }, "end_va": 140717040140287, "entry_point": 0, "filename": null, "id": "region_425", "name": "private_0x000000007fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147418112, "timestamp": "00:00:40.601", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140717040140288, "type": "region", "version": 1 }, "end_va": 140717041983487, "entry_point": 140717040140288, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_426", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140717040140288, "timestamp": "00:00:40.601", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20446306304, "start_va": 140717041983488, "type": "region", "version": 1 }, "end_va": 140737488289791, "entry_point": 0, "filename": null, "id": "region_427", "name": "private_0x00007ffb3d4d2000", "norm_filename": null, "region_type": "private_memory", "start_va": 140717041983488, "timestamp": "00:00:40.601", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000428-addr_0x0000000000210000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_612", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 2162688, "type": "region", "version": 1 }, "end_va": 2228223, "entry_point": 0, "filename": null, "id": "region_428", "name": "private_0x0000000000210000", "norm_filename": null, "region_type": "private_memory", "start_va": 2162688, "timestamp": "00:00:40.615", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 471040, "start_va": 1553989632, "type": "region", "version": 1 }, "end_va": 1554460671, "entry_point": 1553989632, "filename": "\\Windows\\System32\\wow64win.dll", "id": "region_429", "name": "wow64win.dll", "norm_filename": "c:\\windows\\system32\\wow64win.dll", "region_type": "memory_mapped_file", "start_va": 1553989632, "timestamp": "00:00:40.615", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 323584, "start_va": 1554513920, "type": "region", "version": 1 }, "end_va": 1554837503, "entry_point": 1554513920, "filename": "\\Windows\\System32\\wow64.dll", "id": "region_430", "name": "wow64.dll", "norm_filename": "c:\\windows\\system32\\wow64.dll", "region_type": "memory_mapped_file", "start_va": 1554513920, "timestamp": "00:00:40.617", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1553924096, "type": "region", "version": 1 }, "end_va": 1553956863, "entry_point": 1553924096, "filename": "\\Windows\\System32\\wow64cpu.dll", "id": "region_431", "name": "wow64cpu.dll", "norm_filename": "c:\\windows\\system32\\wow64cpu.dll", "region_type": "memory_mapped_file", "start_va": 1553924096, "timestamp": "00:00:40.624", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000432-addr_0x00000000002c0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_613", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 2883584, "type": "region", "version": 1 }, "end_va": 3932159, "entry_point": 0, "filename": null, "id": "region_432", "name": "private_0x00000000002c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2883584, "timestamp": "00:00:40.639", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1531904, "start_va": 1978793984, "type": "region", "version": 1 }, "end_va": 1980325887, "entry_point": 1978793984, "filename": "\\Windows\\SysWOW64\\KernelBase.dll", "id": "region_433", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\syswow64\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 1978793984, "timestamp": "00:00:40.639", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 983040, "start_va": 1992032256, "type": "region", "version": 1 }, "end_va": 1993015295, "entry_point": 1992032256, "filename": "\\Windows\\SysWOW64\\kernel32.dll", "id": "region_434", "name": "kernel32.dll", "norm_filename": "c:\\windows\\syswow64\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1992032256, "timestamp": "00:00:41.448", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 131071, "entry_point": 0, "filename": null, "id": "region_435", "name": "pagefile_0x0000000000010000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 65536, "timestamp": "00:00:41.612", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 4915200, "type": "region", "version": 1 }, "end_va": 5693439, "entry_point": 4915200, "filename": "\\Windows\\System32\\locale.nls", "id": "region_436", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 4915200, "timestamp": "00:00:41.612", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 593920, "start_va": 1947795456, "type": "region", "version": 1 }, "end_va": 1948389375, "entry_point": 1947795456, "filename": "\\Windows\\SysWOW64\\apphelp.dll", "id": "region_437", "name": "apphelp.dll", "norm_filename": "c:\\windows\\syswow64\\apphelp.dll", "region_type": "memory_mapped_file", "start_va": 1947795456, "timestamp": "00:00:41.612", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2146107392, "type": "region", "version": 1 }, "end_va": 2147155967, "entry_point": 0, "filename": null, "id": "region_438", "name": "pagefile_0x000000007feb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2146107392, "timestamp": "00:00:41.617", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000439-addr_0x0000000000020000-size_0x0000000000004000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_614", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 16384, "start_va": 131072, "type": "region", "version": 1 }, "end_va": 147455, "entry_point": 0, "filename": null, "id": "region_439", "name": "private_0x0000000000020000", "norm_filename": null, "region_type": "private_memory", "start_va": 131072, "timestamp": "00:00:41.634", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000440-addr_0x00000000001d0000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_615", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 1900544, "type": "region", "version": 1 }, "end_va": 2162687, "entry_point": 0, "filename": null, "id": "region_440", "name": "private_0x00000000001d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1900544, "timestamp": "00:00:41.634", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000441-addr_0x0000000000570000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_616", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 5701632, "type": "region", "version": 1 }, "end_va": 6750207, "entry_point": 0, "filename": null, "id": "region_441", "name": "private_0x0000000000570000", "norm_filename": null, "region_type": "private_memory", "start_va": 5701632, "timestamp": "00:00:41.634", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1310720, "start_va": 1951399936, "type": "region", "version": 1 }, "end_va": 1952710655, "entry_point": 1951399936, "filename": "\\Windows\\SysWOW64\\user32.dll", "id": "region_442", "name": "user32.dll", "norm_filename": "c:\\windows\\syswow64\\user32.dll", "region_type": "memory_mapped_file", "start_va": 1951399936, "timestamp": "00:00:41.634", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1363968, "start_va": 1989869568, "type": "region", "version": 1 }, "end_va": 1991233535, "entry_point": 1989869568, "filename": "\\Windows\\SysWOW64\\gdi32.dll", "id": "region_443", "name": "gdi32.dll", "norm_filename": "c:\\windows\\syswow64\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 1989869568, "timestamp": "00:00:41.798", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000444-addr_0x000000007ffd8000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_617", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2147319808, "type": "region", "version": 1 }, "end_va": 2147332095, "entry_point": 0, "filename": null, "id": "region_444", "name": "private_0x000000007ffd8000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147319808, "timestamp": "00:00:41.893", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 6750208, "type": "region", "version": 1 }, "end_va": 8355839, "entry_point": 0, "filename": null, "id": "region_445", "name": "pagefile_0x0000000000670000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 6750208, "timestamp": "00:00:43.398", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 176128, "start_va": 1953693696, "type": "region", "version": 1 }, "end_va": 1953869823, "entry_point": 1953693696, "filename": "\\Windows\\SysWOW64\\imm32.dll", "id": "region_446", "name": "imm32.dll", "norm_filename": "c:\\windows\\syswow64\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 1953693696, "timestamp": "00:00:43.398", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 1974992896, "type": "region", "version": 1 }, "end_va": 1975771135, "entry_point": 1974992896, "filename": "\\Windows\\SysWOW64\\msvcrt.dll", "id": "region_447", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\syswow64\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 1974992896, "timestamp": "00:00:43.401", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1179648, "start_va": 1996947456, "type": "region", "version": 1 }, "end_va": 1998127103, "entry_point": 1996947456, "filename": "\\Windows\\SysWOW64\\msctf.dll", "id": "region_448", "name": "msctf.dll", "norm_filename": "c:\\windows\\syswow64\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 1996947456, "timestamp": "00:00:43.413", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000449-addr_0x0000000000030000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_618", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 200703, "entry_point": 0, "filename": null, "id": "region_449", "name": "private_0x0000000000030000", "norm_filename": null, "region_type": "private_memory", "start_va": 196608, "timestamp": "00:00:43.453", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000450-addr_0x0000000000220000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_619", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2228224, "type": "region", "version": 1 }, "end_va": 2232319, "entry_point": 0, "filename": null, "id": "region_450", "name": "private_0x0000000000220000", "norm_filename": null, "region_type": "private_memory", "start_va": 2228224, "timestamp": "00:00:43.454", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000451-addr_0x0000000000800000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_620", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 8388608, "type": "region", "version": 1 }, "end_va": 9437183, "entry_point": 0, "filename": null, "id": "region_451", "name": "private_0x0000000000800000", "norm_filename": null, "region_type": "private_memory", "start_va": 8388608, "timestamp": "00:00:43.454", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000452-addr_0x0000000000980000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_621", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 9961472, "type": "region", "version": 1 }, "end_va": 10027007, "entry_point": 0, "filename": null, "id": "region_452", "name": "private_0x0000000000980000", "norm_filename": null, "region_type": "private_memory", "start_va": 9961472, "timestamp": "00:00:43.454", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 10027008, "type": "region", "version": 1 }, "end_va": 11603967, "entry_point": 0, "filename": null, "id": "region_453", "name": "pagefile_0x0000000000990000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 10027008, "timestamp": "00:00:43.454", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 11665408, "type": "region", "version": 1 }, "end_va": 32636927, "entry_point": 0, "filename": null, "id": "region_454", "name": "pagefile_0x0000000000b20000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 11665408, "timestamp": "00:00:43.455", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000455-addr_0x0000000000230000-size_0x000000000005d000-perm_rwx.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": { "ref_id": "proc_dump_622", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 380928, "start_va": 2293760, "type": "region", "version": 1 }, "end_va": 2674687, "entry_point": 0, "filename": null, "id": "region_455", "name": "private_0x0000000000230000", "norm_filename": null, "region_type": "private_memory", "start_va": 2293760, "timestamp": "00:00:44.369", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000456-addr_0x00000000003c0000-size_0x0000000000039000-perm_rwx.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": { "ref_id": "proc_dump_623", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 233472, "start_va": 3932160, "type": "region", "version": 1 }, "end_va": 4165631, "entry_point": 0, "filename": null, "id": "region_456", "name": "private_0x00000000003c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 3932160, "timestamp": "00:00:44.383", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000457-addr_0x0000000000290000-size_0x0000000000001000-perm_rwx.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": { "ref_id": "proc_dump_624", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2686976, "type": "region", "version": 1 }, "end_va": 2691071, "entry_point": 0, "filename": null, "id": "region_457", "name": "private_0x0000000000290000", "norm_filename": null, "region_type": "private_memory", "start_va": 2686976, "timestamp": "00:00:44.390", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000458-addr_0x0000000000800000-size_0x0000000000039000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_625", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 233472, "start_va": 8388608, "type": "region", "version": 1 }, "end_va": 8622079, "entry_point": 0, "filename": null, "id": "region_458", "name": "private_0x0000000000800000", "norm_filename": null, "region_type": "private_memory", "start_va": 8388608, "timestamp": "00:00:44.392", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000459-addr_0x00000000008f0000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_626", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 9371648, "type": "region", "version": 1 }, "end_va": 9437183, "entry_point": 0, "filename": null, "id": "region_459", "name": "private_0x00000000008f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 9371648, "timestamp": "00:00:44.392", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 1977352192, "type": "region", "version": 1 }, "end_va": 1977630719, "entry_point": 1977352192, "filename": "\\Windows\\SysWOW64\\shlwapi.dll", "id": "region_460", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\syswow64\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 1977352192, "timestamp": "00:00:44.411", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1810432, "start_va": 1993277440, "type": "region", "version": 1 }, "end_va": 1995087871, "entry_point": 1993277440, "filename": "\\Windows\\SysWOW64\\combase.dll", "id": "region_461", "name": "combase.dll", "norm_filename": "c:\\windows\\syswow64\\combase.dll", "region_type": "memory_mapped_file", "start_va": 1993277440, "timestamp": "00:00:45.052", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 704512, "start_va": 1978073088, "type": "region", "version": 1 }, "end_va": 1978777599, "entry_point": 1978073088, "filename": "\\Windows\\SysWOW64\\rpcrt4.dll", "id": "region_462", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\syswow64\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 1978073088, "timestamp": "00:00:45.876", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 122880, "start_va": 1948909568, "type": "region", "version": 1 }, "end_va": 1949032447, "entry_point": 1948909568, "filename": "\\Windows\\SysWOW64\\sspicli.dll", "id": "region_463", "name": "sspicli.dll", "norm_filename": "c:\\windows\\syswow64\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 1948909568, "timestamp": "00:00:46.220", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 1948844032, "type": "region", "version": 1 }, "end_va": 1948884991, "entry_point": 1948844032, "filename": "\\Windows\\SysWOW64\\cryptbase.dll", "id": "region_464", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\syswow64\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 1948844032, "timestamp": "00:00:46.319", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 364544, "start_va": 1948450816, "type": "region", "version": 1 }, "end_va": 1948815359, "entry_point": 1948450816, "filename": "\\Windows\\SysWOW64\\bcryptprimitives.dll", "id": "region_465", "name": "bcryptprimitives.dll", "norm_filename": "c:\\windows\\syswow64\\bcryptprimitives.dll", "region_type": "memory_mapped_file", "start_va": 1948450816, "timestamp": "00:00:46.340", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 274432, "start_va": 1980366848, "type": "region", "version": 1 }, "end_va": 1980641279, "entry_point": 1980366848, "filename": "\\Windows\\SysWOW64\\sechost.dll", "id": "region_466", "name": "sechost.dll", "norm_filename": "c:\\windows\\syswow64\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 1980366848, "timestamp": "00:00:46.382", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 503808, "start_va": 1976827904, "type": "region", "version": 1 }, "end_va": 1977331711, "entry_point": 1976827904, "filename": "\\Windows\\SysWOW64\\advapi32.dll", "id": "region_467", "name": "advapi32.dll", "norm_filename": "c:\\windows\\syswow64\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 1976827904, "timestamp": "00:00:46.604", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 20705280, "start_va": 1953890304, "type": "region", "version": 1 }, "end_va": 1974595583, "entry_point": 1953890304, "filename": "\\Windows\\SysWOW64\\shell32.dll", "id": "region_468", "name": "shell32.dll", "norm_filename": "c:\\windows\\syswow64\\shell32.dll", "region_type": "memory_mapped_file", "start_va": 1953890304, "timestamp": "00:00:47.099", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 5099520, "start_va": 1984757760, "type": "region", "version": 1 }, "end_va": 1989857279, "entry_point": 1984757760, "filename": "\\Windows\\SysWOW64\\windows.storage.dll", "id": "region_469", "name": "windows.storage.dll", "norm_filename": "c:\\windows\\syswow64\\windows.storage.dll", "region_type": "memory_mapped_file", "start_va": 1984757760, "timestamp": "00:00:48.872", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 1995112448, "type": "region", "version": 1 }, "end_va": 1995161599, "entry_point": 1995112448, "filename": "\\Windows\\SysWOW64\\kernel.appcore.dll", "id": "region_470", "name": "kernel.appcore.dll", "norm_filename": "c:\\windows\\syswow64\\kernel.appcore.dll", "region_type": "memory_mapped_file", "start_va": 1995112448, "timestamp": "00:00:49.285", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 577536, "start_va": 1982332928, "type": "region", "version": 1 }, "end_va": 1982910463, "entry_point": 1982332928, "filename": "\\Windows\\SysWOW64\\SHCore.dll", "id": "region_471", "name": "shcore.dll", "norm_filename": "c:\\windows\\syswow64\\shcore.dll", "region_type": "memory_mapped_file", "start_va": 1982332928, "timestamp": "00:00:49.444", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 1975779328, "type": "region", "version": 1 }, "end_va": 1976057855, "entry_point": 1975779328, "filename": "\\Windows\\SysWOW64\\powrprof.dll", "id": "region_472", "name": "powrprof.dll", "norm_filename": "c:\\windows\\syswow64\\powrprof.dll", "region_type": "memory_mapped_file", "start_va": 1975779328, "timestamp": "00:00:49.653", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 61440, "start_va": 1996816384, "type": "region", "version": 1 }, "end_va": 1996877823, "entry_point": 1996816384, "filename": "\\Windows\\SysWOW64\\profapi.dll", "id": "region_473", "name": "profapi.dll", "norm_filename": "c:\\windows\\syswow64\\profapi.dll", "region_type": "memory_mapped_file", "start_va": 1996816384, "timestamp": "00:00:49.760", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 958464, "start_va": 1952710656, "type": "region", "version": 1 }, "end_va": 1953669119, "entry_point": 1952710656, "filename": "\\Windows\\SysWOW64\\ole32.dll", "id": "region_474", "name": "ole32.dll", "norm_filename": "c:\\windows\\syswow64\\ole32.dll", "region_type": "memory_mapped_file", "start_va": 1952710656, "timestamp": "00:00:49.868", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 593920, "start_va": 8650752, "type": "region", "version": 1 }, "end_va": 9244671, "entry_point": 8650752, "filename": "\\Windows\\SysWOW64\\oleaut32.dll", "id": "region_475", "name": "oleaut32.dll", "norm_filename": "c:\\windows\\syswow64\\oleaut32.dll", "region_type": "memory_mapped_file", "start_va": 8650752, "timestamp": "00:00:50.617", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000476-addr_0x0000000001f20000-size_0x0000000000410000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_627", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4259840, "start_va": 32636928, "type": "region", "version": 1 }, "end_va": 36896767, "entry_point": 0, "filename": null, "id": "region_476", "name": "private_0x0000000001f20000", "norm_filename": null, "region_type": "private_memory", "start_va": 32636928, "timestamp": "00:00:50.830", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000477-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_628", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_477", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:50.839", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000479-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_630", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_479", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:50.858", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000480-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_631", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_480", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:50.861", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000484-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_635", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_484", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:50.926", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000485-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_636", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_485", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:50.931", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000489-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_640", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_489", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:50.947", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000491-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_642", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_491", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:50.994", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000496-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_647", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_496", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.009", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000501-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_652", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_501", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.073", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000503-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_654", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_503", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.090", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000506-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_657", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_506", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.140", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000507-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_658", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_507", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.148", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000508-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_659", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_508", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.153", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000511-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_662", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_511", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.165", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000513-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_664", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_513", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.215", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000517-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_668", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_517", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.230", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000521-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_672", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_521", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.277", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000522-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_673", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_522", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.281", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000525-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_676", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_525", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.290", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000529-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_680", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_529", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.306", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000531-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_682", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_531", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.322", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000536-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_687", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_536", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.337", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000541-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_692", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_541", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.356", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000544-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_695", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_544", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.383", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000549-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_700", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_549", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.399", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000553-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_704", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_553", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.413", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000558-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_709", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_558", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.429", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000562-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_713", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_562", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.447", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000566-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_717", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_566", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.462", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000569-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_720", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_569", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.478", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000572-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_723", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_572", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.496", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000575-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_726", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_575", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.524", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000576-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_727", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_576", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.531", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000578-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_729", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_578", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.541", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000581-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_732", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_581", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.557", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000585-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_736", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_585", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.577", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000588-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_739", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_588", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.590", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000591-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_742", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_591", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.604", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000595-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_746", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_595", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.728", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000596-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_747", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_596", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.734", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000598-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_749", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_598", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.742", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000601-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_752", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_601", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.766", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000603-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_754", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_603", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.775", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000606-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_757", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_606", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.798", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000608-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_759", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_608", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.808", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000612-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_763", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_612", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.826", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000615-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_766", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_615", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.844", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000617-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_768", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_617", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.854", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000620-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_771", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_620", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.890", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000622-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_773", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_622", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.903", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000625-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_776", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_625", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.938", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000627-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_778", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_627", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.954", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000629-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_780", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_629", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:51.966", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000631-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_782", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_631", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.004", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000632-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_783", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_632", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.022", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000633-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_784", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_633", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.039", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000634-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_785", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_634", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.059", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000635-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_786", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_635", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.064", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000637-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_788", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_637", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.073", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000640-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_791", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_640", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.101", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000641-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_792", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_641", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.110", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000645-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_796", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_645", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.160", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000649-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_797", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_649", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.212", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000650-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_798", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_650", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.226", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000651-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_799", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_651", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.232", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000653-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_801", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_653", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.249", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000655-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_803", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_655", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.259", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000658-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_806", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_658", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.279", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000661-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_809", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_661", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.295", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000663-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_811", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_663", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.314", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000664-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_812", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_664", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.332", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000667-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_815", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_667", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.371", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000669-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_817", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_669", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.390", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000674-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_822", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_674", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.435", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000677-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_825", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_677", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.449", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000679-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_827", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_679", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.474", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000680-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_828", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_680", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.478", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000688-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_836", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_688", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.532", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000692-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_840", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_692", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.558", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000695-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_843", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_695", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.588", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000696-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_844", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_696", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.593", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000698-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_846", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_698", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.605", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000707-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_855", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_707", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.801", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000708-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_856", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_708", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.807", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000713-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_861", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_713", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.847", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000715-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_863", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_715", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.855", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000734-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_882", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_734", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.962", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000742-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_890", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_742", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:52.995", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000761-addr_0x00000000002a0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_909", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 2752512, "type": "region", "version": 1 }, "end_va": 2756607, "entry_point": 0, "filename": null, "id": "region_761", "name": "private_0x00000000002a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2752512, "timestamp": "00:00:53.086", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000765-addr_0x0000000002670000-size_0x0000000000110000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_910", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1114112, "start_va": 40304640, "type": "region", "version": 1 }, "end_va": 41418751, "entry_point": 0, "filename": null, "id": "region_765", "name": "private_0x0000000002670000", "norm_filename": null, "region_type": "private_memory", "start_va": 40304640, "timestamp": "00:00:53.842", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000775-addr_0x0000000002770000-size_0x0000000000010000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_911", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 65536, "start_va": 41353216, "type": "region", "version": 1 }, "end_va": 41418751, "entry_point": 0, "filename": null, "id": "region_775", "name": "private_0x0000000002770000", "norm_filename": null, "region_type": "private_memory", "start_va": 41353216, "timestamp": "00:00:54.823", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000780-addr_0x0000000000940000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_912", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 9699328, "type": "region", "version": 1 }, "end_va": 9961471, "entry_point": 0, "filename": null, "id": "region_780", "name": "private_0x0000000000940000", "norm_filename": null, "region_type": "private_memory", "start_va": 9699328, "timestamp": "00:00:54.900", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000781-addr_0x0000000002780000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_913", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 41418752, "type": "region", "version": 1 }, "end_va": 42467327, "entry_point": 0, "filename": null, "id": "region_781", "name": "private_0x0000000002780000", "norm_filename": null, "region_type": "private_memory", "start_va": 41418752, "timestamp": "00:00:54.900", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000783-addr_0x000000007ffd5000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_914", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2147307520, "type": "region", "version": 1 }, "end_va": 2147319807, "entry_point": 0, "filename": null, "id": "region_783", "name": "private_0x000000007ffd5000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147307520, "timestamp": "00:00:54.910", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000784-addr_0x0000000002700000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_915", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 40894464, "type": "region", "version": 1 }, "end_va": 41156607, "entry_point": 0, "filename": null, "id": "region_784", "name": "private_0x0000000002700000", "norm_filename": null, "region_type": "private_memory", "start_va": 40894464, "timestamp": "00:00:55.298", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000785-addr_0x0000000002880000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_916", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 42467328, "type": "region", "version": 1 }, "end_va": 43515903, "entry_point": 0, "filename": null, "id": "region_785", "name": "private_0x0000000002880000", "norm_filename": null, "region_type": "private_memory", "start_va": 42467328, "timestamp": "00:00:55.299", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000786-addr_0x000000007fead000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_917", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2146095104, "type": "region", "version": 1 }, "end_va": 2146107391, "entry_point": 0, "filename": null, "id": "region_786", "name": "private_0x000000007fead000", "norm_filename": null, "region_type": "private_memory", "start_va": 2146095104, "timestamp": "00:00:55.299", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000790-addr_0x0000000002980000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_918", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 43515904, "type": "region", "version": 1 }, "end_va": 43778047, "entry_point": 0, "filename": null, "id": "region_790", "name": "private_0x0000000002980000", "norm_filename": null, "region_type": "private_memory", "start_va": 43515904, "timestamp": "00:00:55.639", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000791-addr_0x00000000029c0000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_919", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 43778048, "type": "region", "version": 1 }, "end_va": 44826623, "entry_point": 0, "filename": null, "id": "region_791", "name": "private_0x00000000029c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 43778048, "timestamp": "00:00:55.640", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000792-addr_0x0000000002ac0000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_920", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 44826624, "type": "region", "version": 1 }, "end_va": 45088767, "entry_point": 0, "filename": null, "id": "region_792", "name": "private_0x0000000002ac0000", "norm_filename": null, "region_type": "private_memory", "start_va": 44826624, "timestamp": "00:00:55.640", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000793-addr_0x0000000002b00000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_921", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 45088768, "type": "region", "version": 1 }, "end_va": 46137343, "entry_point": 0, "filename": null, "id": "region_793", "name": "private_0x0000000002b00000", "norm_filename": null, "region_type": "private_memory", "start_va": 45088768, "timestamp": "00:00:55.642", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000794-addr_0x0000000002c00000-size_0x0000000000040000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_922", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 262144, "start_va": 46137344, "type": "region", "version": 1 }, "end_va": 46399487, "entry_point": 0, "filename": null, "id": "region_794", "name": "private_0x0000000002c00000", "norm_filename": null, "region_type": "private_memory", "start_va": 46137344, "timestamp": "00:00:55.642", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000795-addr_0x0000000002c40000-size_0x0000000000100000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_923", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1048576, "start_va": 46399488, "type": "region", "version": 1 }, "end_va": 47448063, "entry_point": 0, "filename": null, "id": "region_795", "name": "private_0x0000000002c40000", "norm_filename": null, "region_type": "private_memory", "start_va": 46399488, "timestamp": "00:00:55.642", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000796-addr_0x000000007fea4000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_924", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2146058240, "type": "region", "version": 1 }, "end_va": 2146070527, "entry_point": 0, "filename": null, "id": "region_796", "name": "private_0x000000007fea4000", "norm_filename": null, "region_type": "private_memory", "start_va": 2146058240, "timestamp": "00:00:55.643", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000797-addr_0x000000007fea7000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_925", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2146070528, "type": "region", "version": 1 }, "end_va": 2146082815, "entry_point": 0, "filename": null, "id": "region_797", "name": "private_0x000000007fea7000", "norm_filename": null, "region_type": "private_memory", "start_va": 2146070528, "timestamp": "00:00:55.643", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000003-region_00000798-addr_0x000000007feaa000-size_0x0000000000003000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_926", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 12288, "start_va": 2146082816, "type": "region", "version": 1 }, "end_va": 2146095103, "entry_point": 0, "filename": null, "id": "region_798", "name": "private_0x000000007feaa000", "norm_filename": null, "region_type": "private_memory", "start_va": 2146082816, "timestamp": "00:00:55.646", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "C:\\Windows\\system32\\cmd.exe /c \"\"C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\697\\FD09.bat\" \"C:\\Users\\CIIHMN~1\\AppData\\Roaming\\MICROS~1\\Amsisigd\\Chakmcat.exe\" \"C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\84526935.scr\"\"", "filename": "c:\\windows\\syswow64\\cmd.exe", "id": "proc_4", "image_name": "cmd.exe", "monitor_reason": "child_process", "monitored_id": 4, "origin_monitor_id": 3, "ref_parent_process": { "ref_id": "proc_3", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "process_00000004-region_00000802-addr_0x0000000000420000-size_0x0000000000020000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_927", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 131072, "start_va": 4325376, "type": "region", "version": 1 }, "end_va": 4456447, "entry_point": 0, "filename": null, "id": "region_802", "name": "private_0x0000000000420000", "norm_filename": null, "region_type": "private_memory", "start_va": 4325376, "timestamp": "00:00:56.598", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000004-region_00000803-addr_0x0000000000440000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_928", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 4456448, "type": "region", "version": 1 }, "end_va": 4464639, "entry_point": 0, "filename": null, "id": "region_803", "name": "private_0x0000000000440000", "norm_filename": null, "region_type": "private_memory", "start_va": 4456448, "timestamp": "00:00:56.602", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 4521984, "type": "region", "version": 1 }, "end_va": 4603903, "entry_point": 0, "filename": null, "id": "region_804", "name": "pagefile_0x0000000000450000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 4521984, "timestamp": "00:00:56.602", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 4653056, "type": "region", "version": 1 }, "end_va": 4915199, "entry_point": 0, "filename": null, "id": "region_805", "name": "private_0x0000000000470000", "norm_filename": null, "region_type": "private_memory", "start_va": 4653056, "timestamp": "00:00:56.602", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 4915200, "type": "region", "version": 1 }, "end_va": 5963775, "entry_point": 0, "filename": null, "id": "region_806", "name": "private_0x00000000004b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 4915200, "timestamp": "00:00:56.602", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 5963776, "type": "region", "version": 1 }, "end_va": 5980159, "entry_point": 0, "filename": null, "id": "region_807", "name": "pagefile_0x00000000005b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5963776, "timestamp": "00:00:56.602", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 6029312, "type": "region", "version": 1 }, "end_va": 6033407, "entry_point": 0, "filename": null, "id": "region_808", "name": "pagefile_0x00000000005c0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 6029312, "timestamp": "00:00:56.602", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 6094848, "type": "region", "version": 1 }, "end_va": 6103039, "entry_point": 0, "filename": null, "id": "region_809", "name": "private_0x00000000005d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 6094848, "timestamp": "00:00:56.603", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 327680, "start_va": 20250624, "type": "region", "version": 1 }, "end_va": 20578303, "entry_point": 20250624, "filename": "\\Windows\\SysWOW64\\cmd.exe", "id": "region_810", "name": "cmd.exe", "norm_filename": "c:\\windows\\syswow64\\cmd.exe", "region_type": "memory_mapped_file", "start_va": 20250624, "timestamp": "00:00:56.603", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "" ], "ref_process_dump": null, "size": 67108864, "start_va": 20578304, "type": "region", "version": 1 }, "end_va": 87687167, "entry_point": 0, "filename": null, "id": "region_811", "name": "pagefile_0x00000000013a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 20578304, "timestamp": "00:00:56.791", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1544192, "start_va": 1998127104, "type": "region", "version": 1 }, "end_va": 1999671295, "entry_point": 1998127104, "filename": "\\Windows\\SysWOW64\\ntdll.dll", "id": "region_812", "name": "ntdll.dll", "norm_filename": "c:\\windows\\syswow64\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1998127104, "timestamp": "00:00:56.791", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 2136670208, "type": "region", "version": 1 }, "end_va": 2136813567, "entry_point": 0, "filename": null, "id": "region_813", "name": "pagefile_0x000000007f5b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2136670208, "timestamp": "00:00:56.791", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2136829952, "type": "region", "version": 1 }, "end_va": 2136834047, "entry_point": 0, "filename": null, "id": "region_814", "name": "private_0x000000007f5d7000", "norm_filename": null, "region_type": "private_memory", "start_va": 2136829952, "timestamp": "00:00:56.791", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2136838144, "type": "region", "version": 1 }, "end_va": 2136842239, "entry_point": 0, "filename": null, "id": "region_815", "name": "private_0x000000007f5d9000", "norm_filename": null, "region_type": "private_memory", "start_va": 2136838144, "timestamp": "00:00:56.791", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2136854528, "type": "region", "version": 1 }, "end_va": 2136866815, "entry_point": 0, "filename": null, "id": "region_816", "name": "private_0x000000007f5dd000", "norm_filename": null, "region_type": "private_memory", "start_va": 2136854528, "timestamp": "00:00:56.792", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_817", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:00:56.792", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 138515869466624, "start_va": 2147418112, "type": "region", "version": 1 }, "end_va": 138518016884735, "entry_point": 0, "filename": null, "id": "region_818", "name": "private_0x000000007fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147418112, "timestamp": "00:00:56.792", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "" ], "ref_process_dump": null, "size": 2199023255552, "start_va": 138518016884736, "type": "region", "version": 1 }, "end_va": 140717040140287, "entry_point": 0, "filename": null, "id": "region_819", "name": "pagefile_0x00007dfb3d310000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 138518016884736, "timestamp": "00:00:56.792", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140717040140288, "type": "region", "version": 1 }, "end_va": 140717041983487, "entry_point": 140717040140288, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_820", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140717040140288, "timestamp": "00:00:56.792", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20446306304, "start_va": 140717041983488, "type": "region", "version": 1 }, "end_va": 140737488289791, "entry_point": 0, "filename": null, "id": "region_821", "name": "private_0x00007ffb3d4d2000", "norm_filename": null, "region_type": "private_memory", "start_va": 140717041983488, "timestamp": "00:00:56.792", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 6619136, "type": "region", "version": 1 }, "end_va": 6684671, "entry_point": 0, "filename": null, "id": "region_822", "name": "private_0x0000000000650000", "norm_filename": null, "region_type": "private_memory", "start_va": 6619136, "timestamp": "00:00:56.926", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 471040, "start_va": 1553989632, "type": "region", "version": 1 }, "end_va": 1554460671, "entry_point": 1553989632, "filename": "\\Windows\\System32\\wow64win.dll", "id": "region_823", "name": "wow64win.dll", "norm_filename": "c:\\windows\\system32\\wow64win.dll", "region_type": "memory_mapped_file", "start_va": 1553989632, "timestamp": "00:00:56.926", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 323584, "start_va": 1554513920, "type": "region", "version": 1 }, "end_va": 1554837503, "entry_point": 1554513920, "filename": "\\Windows\\System32\\wow64.dll", "id": "region_824", "name": "wow64.dll", "norm_filename": "c:\\windows\\system32\\wow64.dll", "region_type": "memory_mapped_file", "start_va": 1554513920, "timestamp": "00:00:56.926", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 8388608, "type": "region", "version": 1 }, "end_va": 9437183, "entry_point": 0, "filename": null, "id": "region_825", "name": "private_0x0000000000800000", "norm_filename": null, "region_type": "private_memory", "start_va": 8388608, "timestamp": "00:00:56.943", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1553924096, "type": "region", "version": 1 }, "end_va": 1553956863, "entry_point": 1553924096, "filename": "\\Windows\\System32\\wow64cpu.dll", "id": "region_826", "name": "wow64cpu.dll", "norm_filename": "c:\\windows\\system32\\wow64cpu.dll", "region_type": "memory_mapped_file", "start_va": 1553924096, "timestamp": "00:00:56.943", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 4325376, "type": "region", "version": 1 }, "end_va": 4390911, "entry_point": 0, "filename": null, "id": "region_867", "name": "pagefile_0x0000000000420000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 4325376, "timestamp": "00:00:57.370", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 6160384, "type": "region", "version": 1 }, "end_va": 6422527, "entry_point": 0, "filename": null, "id": "region_868", "name": "private_0x00000000005e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 6160384, "timestamp": "00:00:57.374", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 6684672, "type": "region", "version": 1 }, "end_va": 7462911, "entry_point": 6684672, "filename": "\\Windows\\System32\\locale.nls", "id": "region_869", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 6684672, "timestamp": "00:00:57.377", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 9437184, "type": "region", "version": 1 }, "end_va": 10485759, "entry_point": 0, "filename": null, "id": "region_870", "name": "private_0x0000000000900000", "norm_filename": null, "region_type": "private_memory", "start_va": 9437184, "timestamp": "00:00:57.379", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 12451840, "type": "region", "version": 1 }, "end_va": 12517375, "entry_point": 0, "filename": null, "id": "region_871", "name": "private_0x0000000000be0000", "norm_filename": null, "region_type": "private_memory", "start_va": 12451840, "timestamp": "00:00:57.383", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 1974992896, "type": "region", "version": 1 }, "end_va": 1975771135, "entry_point": 1974992896, "filename": "\\Windows\\SysWOW64\\msvcrt.dll", "id": "region_872", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\syswow64\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 1974992896, "timestamp": "00:00:57.383", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1531904, "start_va": 1978793984, "type": "region", "version": 1 }, "end_va": 1980325887, "entry_point": 1978793984, "filename": "\\Windows\\SysWOW64\\KernelBase.dll", "id": "region_873", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\syswow64\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 1978793984, "timestamp": "00:00:57.383", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 983040, "start_va": 1992032256, "type": "region", "version": 1 }, "end_va": 1993015295, "entry_point": 1992032256, "filename": "\\Windows\\SysWOW64\\kernel32.dll", "id": "region_874", "name": "kernel32.dll", "norm_filename": "c:\\windows\\syswow64\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1992032256, "timestamp": "00:00:57.384", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2135621632, "type": "region", "version": 1 }, "end_va": 2136670207, "entry_point": 0, "filename": null, "id": "region_875", "name": "pagefile_0x000000007f4b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2135621632, "timestamp": "00:00:57.384", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2136842240, "type": "region", "version": 1 }, "end_va": 2136854527, "entry_point": 0, "filename": null, "id": "region_876", "name": "private_0x000000007f5da000", "norm_filename": null, "region_type": "private_memory", "start_va": 2136842240, "timestamp": "00:00:57.386", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 4390912, "type": "region", "version": 1 }, "end_va": 4407295, "entry_point": 0, "filename": null, "id": "region_877", "name": "private_0x0000000000430000", "norm_filename": null, "region_type": "private_memory", "start_va": 4390912, "timestamp": "00:00:57.394", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 4456448, "type": "region", "version": 1 }, "end_va": 4472831, "entry_point": 0, "filename": null, "id": "region_878", "name": "private_0x0000000000440000", "norm_filename": null, "region_type": "private_memory", "start_va": 4456448, "timestamp": "00:00:57.451", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1933115392, "type": "region", "version": 1 }, "end_va": 1933148159, "entry_point": 1933115392, "filename": "\\Windows\\SysWOW64\\cmdext.dll", "id": "region_879", "name": "cmdext.dll", "norm_filename": "c:\\windows\\syswow64\\cmdext.dll", "region_type": "memory_mapped_file", "start_va": 1933115392, "timestamp": "00:00:57.480", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 503808, "start_va": 1976827904, "type": "region", "version": 1 }, "end_va": 1977331711, "entry_point": 1976827904, "filename": "\\Windows\\SysWOW64\\advapi32.dll", "id": "region_880", "name": "advapi32.dll", "norm_filename": "c:\\windows\\syswow64\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 1976827904, "timestamp": "00:00:57.489", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 274432, "start_va": 1980366848, "type": "region", "version": 1 }, "end_va": 1980641279, "entry_point": 1980366848, "filename": "\\Windows\\SysWOW64\\sechost.dll", "id": "region_881", "name": "sechost.dll", "norm_filename": "c:\\windows\\syswow64\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 1980366848, "timestamp": "00:00:57.490", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 704512, "start_va": 1978073088, "type": "region", "version": 1 }, "end_va": 1978777599, "entry_point": 1978073088, "filename": "\\Windows\\SysWOW64\\rpcrt4.dll", "id": "region_882", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\syswow64\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 1978073088, "timestamp": "00:00:57.491", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 122880, "start_va": 1948909568, "type": "region", "version": 1 }, "end_va": 1949032447, "entry_point": 1948909568, "filename": "\\Windows\\SysWOW64\\sspicli.dll", "id": "region_883", "name": "sspicli.dll", "norm_filename": "c:\\windows\\syswow64\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 1948909568, "timestamp": "00:00:57.493", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 1948844032, "type": "region", "version": 1 }, "end_va": 1948884991, "entry_point": 1948844032, "filename": "\\Windows\\SysWOW64\\cryptbase.dll", "id": "region_884", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\syswow64\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 1948844032, "timestamp": "00:00:57.493", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 364544, "start_va": 1948450816, "type": "region", "version": 1 }, "end_va": 1948815359, "entry_point": 1948450816, "filename": "\\Windows\\SysWOW64\\bcryptprimitives.dll", "id": "region_885", "name": "bcryptprimitives.dll", "norm_filename": "c:\\windows\\syswow64\\bcryptprimitives.dll", "region_type": "memory_mapped_file", "start_va": 1948450816, "timestamp": "00:00:57.494", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 6422528, "type": "region", "version": 1 }, "end_va": 6488063, "entry_point": 0, "filename": null, "id": "region_886", "name": "private_0x0000000000620000", "norm_filename": null, "region_type": "private_memory", "start_va": 6422528, "timestamp": "00:00:57.507", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 12517376, "type": "region", "version": 1 }, "end_va": 15888383, "entry_point": 12517376, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_887", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 12517376, "timestamp": "00:00:57.800", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 135168, "start_va": 7471104, "type": "region", "version": 1 }, "end_va": 7606271, "entry_point": 7471104, "filename": "\\Windows\\SysWOW64\\en-US\\cmd.exe.mui", "id": "region_2296", "name": "cmd.exe.mui", "norm_filename": "c:\\windows\\syswow64\\en-us\\cmd.exe.mui", "region_type": "memory_mapped_file", "start_va": 7471104, "timestamp": "00:01:03.181", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "cmd /C \"\"C:\\Users\\CIIHMN~1\\AppData\\Roaming\\MICROS~1\\Amsisigd\\Chakmcat.exe\" \"C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\84526935.scr\"\"", "filename": "c:\\windows\\syswow64\\cmd.exe", "id": "proc_6", "image_name": "cmd.exe", "monitor_reason": "child_process", "monitored_id": 6, "origin_monitor_id": 4, "ref_parent_process": { "ref_id": "proc_4", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "process_00000006-region_00000888-addr_0x0000000000f30000-size_0x0000000000020000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_932", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 131072, "start_va": 15925248, "type": "region", "version": 1 }, "end_va": 16056319, "entry_point": 0, "filename": null, "id": "region_888", "name": "private_0x0000000000f30000", "norm_filename": null, "region_type": "private_memory", "start_va": 15925248, "timestamp": "00:00:57.808", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000006-region_00000889-addr_0x0000000000f50000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_933", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 16056320, "type": "region", "version": 1 }, "end_va": 16064511, "entry_point": 0, "filename": null, "id": "region_889", "name": "private_0x0000000000f50000", "norm_filename": null, "region_type": "private_memory", "start_va": 16056320, "timestamp": "00:00:57.809", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 16121856, "type": "region", "version": 1 }, "end_va": 16203775, "entry_point": 0, "filename": null, "id": "region_890", "name": "pagefile_0x0000000000f60000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 16121856, "timestamp": "00:00:57.809", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 16252928, "type": "region", "version": 1 }, "end_va": 16515071, "entry_point": 0, "filename": null, "id": "region_891", "name": "private_0x0000000000f80000", "norm_filename": null, "region_type": "private_memory", "start_va": 16252928, "timestamp": "00:00:57.809", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 16515072, "type": "region", "version": 1 }, "end_va": 17563647, "entry_point": 0, "filename": null, "id": "region_892", "name": "private_0x0000000000fc0000", "norm_filename": null, "region_type": "private_memory", "start_va": 16515072, "timestamp": "00:00:57.809", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 17563648, "type": "region", "version": 1 }, "end_va": 17580031, "entry_point": 0, "filename": null, "id": "region_893", "name": "pagefile_0x00000000010c0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 17563648, "timestamp": "00:00:57.809", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 17629184, "type": "region", "version": 1 }, "end_va": 17633279, "entry_point": 0, "filename": null, "id": "region_894", "name": "pagefile_0x00000000010d0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 17629184, "timestamp": "00:00:57.809", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 17694720, "type": "region", "version": 1 }, "end_va": 17702911, "entry_point": 0, "filename": null, "id": "region_895", "name": "private_0x00000000010e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 17694720, "timestamp": "00:00:57.809", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 327680, "start_va": 20250624, "type": "region", "version": 1 }, "end_va": 20578303, "entry_point": 20250624, "filename": "\\Windows\\SysWOW64\\cmd.exe", "id": "region_896", "name": "cmd.exe", "norm_filename": "c:\\windows\\syswow64\\cmd.exe", "region_type": "memory_mapped_file", "start_va": 20250624, "timestamp": "00:00:57.810", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "" ], "ref_process_dump": null, "size": 67108864, "start_va": 20578304, "type": "region", "version": 1 }, "end_va": 87687167, "entry_point": 0, "filename": null, "id": "region_897", "name": "pagefile_0x00000000013a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 20578304, "timestamp": "00:00:57.811", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1544192, "start_va": 1998127104, "type": "region", "version": 1 }, "end_va": 1999671295, "entry_point": 1998127104, "filename": "\\Windows\\SysWOW64\\ntdll.dll", "id": "region_898", "name": "ntdll.dll", "norm_filename": "c:\\windows\\syswow64\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1998127104, "timestamp": "00:00:57.812", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 2135293952, "type": "region", "version": 1 }, "end_va": 2135437311, "entry_point": 0, "filename": null, "id": "region_899", "name": "pagefile_0x000000007f460000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2135293952, "timestamp": "00:00:57.812", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2135445504, "type": "region", "version": 1 }, "end_va": 2135449599, "entry_point": 0, "filename": null, "id": "region_900", "name": "private_0x000000007f485000", "norm_filename": null, "region_type": "private_memory", "start_va": 2135445504, "timestamp": "00:00:57.812", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2135465984, "type": "region", "version": 1 }, "end_va": 2135478271, "entry_point": 0, "filename": null, "id": "region_901", "name": "private_0x000000007f48a000", "norm_filename": null, "region_type": "private_memory", "start_va": 2135465984, "timestamp": "00:00:57.812", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2135478272, "type": "region", "version": 1 }, "end_va": 2135482367, "entry_point": 0, "filename": null, "id": "region_902", "name": "private_0x000000007f48d000", "norm_filename": null, "region_type": "private_memory", "start_va": 2135478272, "timestamp": "00:00:57.812", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_903", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:00:57.814", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 138515869466624, "start_va": 2147418112, "type": "region", "version": 1 }, "end_va": 138518016884735, "entry_point": 0, "filename": null, "id": "region_904", "name": "private_0x000000007fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147418112, "timestamp": "00:00:57.814", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "" ], "ref_process_dump": null, "size": 2199023255552, "start_va": 138518016884736, "type": "region", "version": 1 }, "end_va": 140717040140287, "entry_point": 0, "filename": null, "id": "region_905", "name": "pagefile_0x00007dfb3d310000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 138518016884736, "timestamp": "00:00:57.814", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140717040140288, "type": "region", "version": 1 }, "end_va": 140717041983487, "entry_point": 140717040140288, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_906", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140717040140288, "timestamp": "00:00:57.814", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20446306304, "start_va": 140717041983488, "type": "region", "version": 1 }, "end_va": 140737488289791, "entry_point": 0, "filename": null, "id": "region_907", "name": "private_0x00007ffb3d4d2000", "norm_filename": null, "region_type": "private_memory", "start_va": 140717041983488, "timestamp": "00:00:57.814", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 18546688, "type": "region", "version": 1 }, "end_va": 18612223, "entry_point": 0, "filename": null, "id": "region_908", "name": "private_0x00000000011b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 18546688, "timestamp": "00:00:57.827", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 471040, "start_va": 1553989632, "type": "region", "version": 1 }, "end_va": 1554460671, "entry_point": 1553989632, "filename": "\\Windows\\System32\\wow64win.dll", "id": "region_909", "name": "wow64win.dll", "norm_filename": "c:\\windows\\system32\\wow64win.dll", "region_type": "memory_mapped_file", "start_va": 1553989632, "timestamp": "00:00:57.827", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 323584, "start_va": 1554513920, "type": "region", "version": 1 }, "end_va": 1554837503, "entry_point": 1554513920, "filename": "\\Windows\\System32\\wow64.dll", "id": "region_910", "name": "wow64.dll", "norm_filename": "c:\\windows\\system32\\wow64.dll", "region_type": "memory_mapped_file", "start_va": 1554513920, "timestamp": "00:00:57.827", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 88866816, "type": "region", "version": 1 }, "end_va": 89915391, "entry_point": 0, "filename": null, "id": "region_911", "name": "private_0x00000000054c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 88866816, "timestamp": "00:00:57.838", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1553924096, "type": "region", "version": 1 }, "end_va": 1553956863, "entry_point": 1553924096, "filename": "\\Windows\\System32\\wow64cpu.dll", "id": "region_912", "name": "wow64cpu.dll", "norm_filename": "c:\\windows\\system32\\wow64cpu.dll", "region_type": "memory_mapped_file", "start_va": 1553924096, "timestamp": "00:00:57.838", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 15925248, "type": "region", "version": 1 }, "end_va": 15990783, "entry_point": 0, "filename": null, "id": "region_913", "name": "pagefile_0x0000000000f30000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 15925248, "timestamp": "00:00:57.861", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 17760256, "type": "region", "version": 1 }, "end_va": 18538495, "entry_point": 17760256, "filename": "\\Windows\\System32\\locale.nls", "id": "region_914", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 17760256, "timestamp": "00:00:57.862", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 18612224, "type": "region", "version": 1 }, "end_va": 18874367, "entry_point": 0, "filename": null, "id": "region_915", "name": "private_0x00000000011c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 18612224, "timestamp": "00:00:57.862", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 18874368, "type": "region", "version": 1 }, "end_va": 19922943, "entry_point": 0, "filename": null, "id": "region_916", "name": "private_0x0000000001200000", "norm_filename": null, "region_type": "private_memory", "start_va": 18874368, "timestamp": "00:00:57.862", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 91619328, "type": "region", "version": 1 }, "end_va": 91684863, "entry_point": 0, "filename": null, "id": "region_917", "name": "private_0x0000000005760000", "norm_filename": null, "region_type": "private_memory", "start_va": 91619328, "timestamp": "00:00:57.863", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 1974992896, "type": "region", "version": 1 }, "end_va": 1975771135, "entry_point": 1974992896, "filename": "\\Windows\\SysWOW64\\msvcrt.dll", "id": "region_918", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\syswow64\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 1974992896, "timestamp": "00:00:57.863", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1531904, "start_va": 1978793984, "type": "region", "version": 1 }, "end_va": 1980325887, "entry_point": 1978793984, "filename": "\\Windows\\SysWOW64\\KernelBase.dll", "id": "region_919", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\syswow64\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 1978793984, "timestamp": "00:00:57.863", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 983040, "start_va": 1992032256, "type": "region", "version": 1 }, "end_va": 1993015295, "entry_point": 1992032256, "filename": "\\Windows\\SysWOW64\\kernel32.dll", "id": "region_920", "name": "kernel32.dll", "norm_filename": "c:\\windows\\syswow64\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1992032256, "timestamp": "00:00:57.863", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2134245376, "type": "region", "version": 1 }, "end_va": 2135293951, "entry_point": 0, "filename": null, "id": "region_921", "name": "pagefile_0x000000007f360000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2134245376, "timestamp": "00:00:57.863", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2135453696, "type": "region", "version": 1 }, "end_va": 2135465983, "entry_point": 0, "filename": null, "id": "region_922", "name": "private_0x000000007f487000", "norm_filename": null, "region_type": "private_memory", "start_va": 2135453696, "timestamp": "00:00:57.863", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 15990784, "type": "region", "version": 1 }, "end_va": 16007167, "entry_point": 0, "filename": null, "id": "region_923", "name": "private_0x0000000000f40000", "norm_filename": null, "region_type": "private_memory", "start_va": 15990784, "timestamp": "00:00:57.866", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 16056320, "type": "region", "version": 1 }, "end_va": 16072703, "entry_point": 0, "filename": null, "id": "region_924", "name": "private_0x0000000000f50000", "norm_filename": null, "region_type": "private_memory", "start_va": 16056320, "timestamp": "00:00:57.896", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 91684864, "type": "region", "version": 1 }, "end_va": 95055871, "entry_point": 91684864, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_925", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 91684864, "timestamp": "00:00:57.911", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 593920, "start_va": 1947795456, "type": "region", "version": 1 }, "end_va": 1948389375, "entry_point": 1947795456, "filename": "\\Windows\\SysWOW64\\apphelp.dll", "id": "region_926", "name": "apphelp.dll", "norm_filename": "c:\\windows\\syswow64\\apphelp.dll", "region_type": "memory_mapped_file", "start_va": 1947795456, "timestamp": "00:00:57.927", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3735552, "start_va": 2130509824, "type": "region", "version": 1 }, "end_va": 2134245375, "entry_point": 2130509824, "filename": "\\Windows\\AppPatch\\sysmain.sdb", "id": "region_927", "name": "sysmain.sdb", "norm_filename": "c:\\windows\\apppatch\\sysmain.sdb", "region_type": "memory_mapped_file", "start_va": 2130509824, "timestamp": "00:00:57.929", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "\"C:\\Users\\CIIHMN~1\\AppData\\Roaming\\MICROS~1\\Amsisigd\\Chakmcat.exe\" \"C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\84526935.scr\"", "filename": "c:\\users\\ciihmn~1\\appdata\\roaming\\micros~1\\amsisigd\\chakmcat.exe", "id": "proc_7", "image_name": "chakmcat.exe", "monitor_reason": "child_process", "monitored_id": 7, "origin_monitor_id": 6, "ref_parent_process": { "ref_id": "proc_6", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "process_00000007-region_00000928-addr_0x0000000000010000-size_0x0000000000020000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_934", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 131072, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 196607, "entry_point": 0, "filename": null, "id": "region_928", "name": "private_0x0000000000010000", "norm_filename": null, "region_type": "private_memory", "start_va": 65536, "timestamp": "00:00:57.935", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000929-addr_0x0000000000030000-size_0x0000000000002000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_935", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 8192, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 204799, "entry_point": 0, "filename": null, "id": "region_929", "name": "private_0x0000000000030000", "norm_filename": null, "region_type": "private_memory", "start_va": 196608, "timestamp": "00:00:57.935", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 262144, "type": "region", "version": 1 }, "end_va": 344063, "entry_point": 0, "filename": null, "id": "region_930", "name": "pagefile_0x0000000000040000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 262144, "timestamp": "00:00:57.935", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 393216, "type": "region", "version": 1 }, "end_va": 655359, "entry_point": 0, "filename": null, "id": "region_931", "name": "private_0x0000000000060000", "norm_filename": null, "region_type": "private_memory", "start_va": 393216, "timestamp": "00:00:57.935", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 655360, "type": "region", "version": 1 }, "end_va": 1703935, "entry_point": 0, "filename": null, "id": "region_932", "name": "private_0x00000000000a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 655360, "timestamp": "00:00:57.938", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 1703936, "type": "region", "version": 1 }, "end_va": 1720319, "entry_point": 0, "filename": null, "id": "region_933", "name": "pagefile_0x00000000001a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1703936, "timestamp": "00:00:57.938", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 1769472, "type": "region", "version": 1 }, "end_va": 1773567, "entry_point": 0, "filename": null, "id": "region_934", "name": "pagefile_0x00000000001b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1769472, "timestamp": "00:00:57.938", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 1835008, "type": "region", "version": 1 }, "end_va": 1843199, "entry_point": 0, "filename": null, "id": "region_935", "name": "private_0x00000000001c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1835008, "timestamp": "00:00:57.938", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 663552, "start_va": 4194304, "type": "region", "version": 1 }, "end_va": 4857855, "entry_point": 4194304, "filename": "\\Users\\CIIHMN~1\\AppData\\Roaming\\MICROS~1\\Amsisigd\\Chakmcat.exe", "id": "region_936", "name": "chakmcat.exe", "norm_filename": "c:\\users\\ciihmn~1\\appdata\\roaming\\micros~1\\amsisigd\\chakmcat.exe", "region_type": "memory_mapped_file", "start_va": 4194304, "timestamp": "00:00:57.938", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1544192, "start_va": 1998127104, "type": "region", "version": 1 }, "end_va": 1999671295, "entry_point": 1998127104, "filename": "\\Windows\\SysWOW64\\ntdll.dll", "id": "region_937", "name": "ntdll.dll", "norm_filename": "c:\\windows\\syswow64\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 1998127104, "timestamp": "00:00:57.941", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 2147155968, "type": "region", "version": 1 }, "end_va": 2147299327, "entry_point": 0, "filename": null, "id": "region_938", "name": "pagefile_0x000000007ffb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2147155968, "timestamp": "00:00:57.941", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2147332096, "type": "region", "version": 1 }, "end_va": 2147344383, "entry_point": 0, "filename": null, "id": "region_939", "name": "private_0x000000007ffdb000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147332096, "timestamp": "00:00:57.942", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2147344384, "type": "region", "version": 1 }, "end_va": 2147348479, "entry_point": 0, "filename": null, "id": "region_940", "name": "private_0x000000007ffde000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147344384, "timestamp": "00:00:57.942", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2147348480, "type": "region", "version": 1 }, "end_va": 2147352575, "entry_point": 0, "filename": null, "id": "region_941", "name": "private_0x000000007ffdf000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147348480, "timestamp": "00:00:57.946", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_942", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:00:57.946", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 140714892722176, "start_va": 2147418112, "type": "region", "version": 1 }, "end_va": 140717040140287, "entry_point": 0, "filename": null, "id": "region_943", "name": "private_0x000000007fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147418112, "timestamp": "00:00:57.946", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140717040140288, "type": "region", "version": 1 }, "end_va": 140717041983487, "entry_point": 140717040140288, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_944", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140717040140288, "timestamp": "00:00:57.946", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20446306304, "start_va": 140717041983488, "type": "region", "version": 1 }, "end_va": 140737488289791, "entry_point": 0, "filename": null, "id": "region_945", "name": "private_0x00007ffb3d4d2000", "norm_filename": null, "region_type": "private_memory", "start_va": 140717041983488, "timestamp": "00:00:57.946", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 3014656, "type": "region", "version": 1 }, "end_va": 3080191, "entry_point": 0, "filename": null, "id": "region_946", "name": "private_0x00000000002e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 3014656, "timestamp": "00:00:57.958", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 471040, "start_va": 1553989632, "type": "region", "version": 1 }, "end_va": 1554460671, "entry_point": 1553989632, "filename": "\\Windows\\System32\\wow64win.dll", "id": "region_947", "name": "wow64win.dll", "norm_filename": "c:\\windows\\system32\\wow64win.dll", "region_type": "memory_mapped_file", "start_va": 1553989632, "timestamp": "00:00:57.958", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 323584, "start_va": 1554513920, "type": "region", "version": 1 }, "end_va": 1554837503, "entry_point": 1554513920, "filename": "\\Windows\\System32\\wow64.dll", "id": "region_948", "name": "wow64.dll", "norm_filename": "c:\\windows\\system32\\wow64.dll", "region_type": "memory_mapped_file", "start_va": 1554513920, "timestamp": "00:00:57.958", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 1900544, "type": "region", "version": 1 }, "end_va": 2949119, "entry_point": 0, "filename": null, "id": "region_949", "name": "private_0x00000000001d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1900544, "timestamp": "00:00:57.966", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1553924096, "type": "region", "version": 1 }, "end_va": 1553956863, "entry_point": 1553924096, "filename": "\\Windows\\System32\\wow64cpu.dll", "id": "region_950", "name": "wow64cpu.dll", "norm_filename": "c:\\windows\\system32\\wow64cpu.dll", "region_type": "memory_mapped_file", "start_va": 1553924096, "timestamp": "00:00:57.966", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 131071, "entry_point": 0, "filename": null, "id": "region_951", "name": "pagefile_0x0000000000010000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 65536, "timestamp": "00:00:57.998", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 131072, "type": "region", "version": 1 }, "end_va": 147455, "entry_point": 0, "filename": null, "id": "region_952", "name": "private_0x0000000000020000", "norm_filename": null, "region_type": "private_memory", "start_va": 131072, "timestamp": "00:00:57.999", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 3080192, "type": "region", "version": 1 }, "end_va": 3858431, "entry_point": 3080192, "filename": "\\Windows\\System32\\locale.nls", "id": "region_953", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 3080192, "timestamp": "00:00:57.999", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 3866624, "type": "region", "version": 1 }, "end_va": 4128767, "entry_point": 0, "filename": null, "id": "region_954", "name": "private_0x00000000003b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 3866624, "timestamp": "00:00:57.999", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 4915200, "type": "region", "version": 1 }, "end_va": 5963775, "entry_point": 0, "filename": null, "id": "region_955", "name": "private_0x00000000004b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 4915200, "timestamp": "00:00:57.999", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 593920, "start_va": 1947795456, "type": "region", "version": 1 }, "end_va": 1948389375, "entry_point": 1947795456, "filename": "\\Windows\\SysWOW64\\apphelp.dll", "id": "region_956", "name": "apphelp.dll", "norm_filename": "c:\\windows\\syswow64\\apphelp.dll", "region_type": "memory_mapped_file", "start_va": 1947795456, "timestamp": "00:00:57.999", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1310720, "start_va": 1951399936, "type": "region", "version": 1 }, "end_va": 1952710655, "entry_point": 1951399936, "filename": "\\Windows\\SysWOW64\\user32.dll", "id": "region_957", "name": "user32.dll", "norm_filename": "c:\\windows\\syswow64\\user32.dll", "region_type": "memory_mapped_file", "start_va": 1951399936, "timestamp": "00:00:57.999", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1531904, "start_va": 1978793984, "type": "region", "version": 1 }, "end_va": 1980325887, "entry_point": 1978793984, "filename": "\\Windows\\SysWOW64\\KernelBase.dll", "id": "region_958", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\syswow64\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 1978793984, "timestamp": "00:00:58.000", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1363968, "start_va": 1989869568, "type": "region", "version": 1 }, "end_va": 1991233535, "entry_point": 1989869568, "filename": "\\Windows\\SysWOW64\\gdi32.dll", "id": "region_959", "name": "gdi32.dll", "norm_filename": "c:\\windows\\syswow64\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 1989869568, "timestamp": "00:00:58.000", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 983040, "start_va": 1992032256, "type": "region", "version": 1 }, "end_va": 1993015295, "entry_point": 1992032256, "filename": "\\Windows\\SysWOW64\\kernel32.dll", "id": "region_960", "name": "kernel32.dll", "norm_filename": "c:\\windows\\syswow64\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1992032256, "timestamp": "00:00:58.000", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2146107392, "type": "region", "version": 1 }, "end_va": 2147155967, "entry_point": 0, "filename": null, "id": "region_961", "name": "pagefile_0x000000007feb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2146107392, "timestamp": "00:00:58.000", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2147319808, "type": "region", "version": 1 }, "end_va": 2147332095, "entry_point": 0, "filename": null, "id": "region_962", "name": "private_0x000000007ffd8000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147319808, "timestamp": "00:00:58.000", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 262143, "entry_point": 0, "filename": null, "id": "region_963", "name": "private_0x0000000000030000", "norm_filename": null, "region_type": "private_memory", "start_va": 196608, "timestamp": "00:00:58.014", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2949120, "type": "region", "version": 1 }, "end_va": 2953215, "entry_point": 0, "filename": null, "id": "region_964", "name": "private_0x00000000002d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2949120, "timestamp": "00:00:58.014", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 4128768, "type": "region", "version": 1 }, "end_va": 4132863, "entry_point": 0, "filename": null, "id": "region_965", "name": "private_0x00000000003f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 4128768, "timestamp": "00:00:58.015", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 5963776, "type": "region", "version": 1 }, "end_va": 7569407, "entry_point": 0, "filename": null, "id": "region_966", "name": "pagefile_0x00000000005b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5963776, "timestamp": "00:00:58.015", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 7602176, "type": "region", "version": 1 }, "end_va": 9179135, "entry_point": 0, "filename": null, "id": "region_967", "name": "pagefile_0x0000000000740000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 7602176, "timestamp": "00:00:58.015", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 9240576, "type": "region", "version": 1 }, "end_va": 30212095, "entry_point": 0, "filename": null, "id": "region_968", "name": "pagefile_0x00000000008d0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 9240576, "timestamp": "00:00:58.015", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000969-addr_0x0000000001cd0000-size_0x0000000000160000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_936", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 1441792, "start_va": 30212096, "type": "region", "version": 1 }, "end_va": 31653887, "entry_point": 0, "filename": null, "id": "region_969", "name": "private_0x0000000001cd0000", "norm_filename": null, "region_type": "private_memory", "start_va": 30212096, "timestamp": "00:00:58.016", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 176128, "start_va": 1953693696, "type": "region", "version": 1 }, "end_va": 1953869823, "entry_point": 1953693696, "filename": "\\Windows\\SysWOW64\\imm32.dll", "id": "region_970", "name": "imm32.dll", "norm_filename": "c:\\windows\\syswow64\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 1953693696, "timestamp": "00:00:58.016", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 1974992896, "type": "region", "version": 1 }, "end_va": 1975771135, "entry_point": 1974992896, "filename": "\\Windows\\SysWOW64\\msvcrt.dll", "id": "region_971", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\syswow64\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 1974992896, "timestamp": "00:00:58.016", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1179648, "start_va": 1996947456, "type": "region", "version": 1 }, "end_va": 1998127103, "entry_point": 1996947456, "filename": "\\Windows\\SysWOW64\\msctf.dll", "id": "region_972", "name": "msctf.dll", "norm_filename": "c:\\windows\\syswow64\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 1996947456, "timestamp": "00:00:58.016", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 380928, "start_va": 30212096, "type": "region", "version": 1 }, "end_va": 30593023, "entry_point": 0, "filename": null, "id": "region_973", "name": "private_0x0000000001cd0000", "norm_filename": null, "region_type": "private_memory", "start_va": 30212096, "timestamp": "00:00:58.687", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 31588352, "type": "region", "version": 1 }, "end_va": 31653887, "entry_point": 0, "filename": null, "id": "region_974", "name": "private_0x0000000001e20000", "norm_filename": null, "region_type": "private_memory", "start_va": 31588352, "timestamp": "00:00:58.688", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 233472, "start_va": 30605312, "type": "region", "version": 1 }, "end_va": 30838783, "entry_point": 0, "filename": null, "id": "region_975", "name": "private_0x0000000001d30000", "norm_filename": null, "region_type": "private_memory", "start_va": 30605312, "timestamp": "00:00:58.739", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 4096, "start_va": 30867456, "type": "region", "version": 1 }, "end_va": 30871551, "entry_point": 0, "filename": null, "id": "region_976", "name": "private_0x0000000001d70000", "norm_filename": null, "region_type": "private_memory", "start_va": 30867456, "timestamp": "00:00:58.745", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 233472, "start_va": 30932992, "type": "region", "version": 1 }, "end_va": 31166463, "entry_point": 0, "filename": null, "id": "region_977", "name": "private_0x0000000001d80000", "norm_filename": null, "region_type": "private_memory", "start_va": 30932992, "timestamp": "00:00:58.746", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 1977352192, "type": "region", "version": 1 }, "end_va": 1977630719, "entry_point": 1977352192, "filename": "\\Windows\\SysWOW64\\shlwapi.dll", "id": "region_978", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\syswow64\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 1977352192, "timestamp": "00:00:58.917", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1810432, "start_va": 1993277440, "type": "region", "version": 1 }, "end_va": 1995087871, "entry_point": 1993277440, "filename": "\\Windows\\SysWOW64\\combase.dll", "id": "region_979", "name": "combase.dll", "norm_filename": "c:\\windows\\syswow64\\combase.dll", "region_type": "memory_mapped_file", "start_va": 1993277440, "timestamp": "00:00:58.918", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 704512, "start_va": 1978073088, "type": "region", "version": 1 }, "end_va": 1978777599, "entry_point": 1978073088, "filename": "\\Windows\\SysWOW64\\rpcrt4.dll", "id": "region_980", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\syswow64\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 1978073088, "timestamp": "00:00:58.919", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 122880, "start_va": 1948909568, "type": "region", "version": 1 }, "end_va": 1949032447, "entry_point": 1948909568, "filename": "\\Windows\\SysWOW64\\sspicli.dll", "id": "region_981", "name": "sspicli.dll", "norm_filename": "c:\\windows\\syswow64\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 1948909568, "timestamp": "00:00:58.920", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 1948844032, "type": "region", "version": 1 }, "end_va": 1948884991, "entry_point": 1948844032, "filename": "\\Windows\\SysWOW64\\cryptbase.dll", "id": "region_982", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\syswow64\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 1948844032, "timestamp": "00:00:58.921", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 364544, "start_va": 1948450816, "type": "region", "version": 1 }, "end_va": 1948815359, "entry_point": 1948450816, "filename": "\\Windows\\SysWOW64\\bcryptprimitives.dll", "id": "region_983", "name": "bcryptprimitives.dll", "norm_filename": "c:\\windows\\syswow64\\bcryptprimitives.dll", "region_type": "memory_mapped_file", "start_va": 1948450816, "timestamp": "00:00:58.922", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 274432, "start_va": 1980366848, "type": "region", "version": 1 }, "end_va": 1980641279, "entry_point": 1980366848, "filename": "\\Windows\\SysWOW64\\sechost.dll", "id": "region_984", "name": "sechost.dll", "norm_filename": "c:\\windows\\syswow64\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 1980366848, "timestamp": "00:00:58.923", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 503808, "start_va": 1976827904, "type": "region", "version": 1 }, "end_va": 1977331711, "entry_point": 1976827904, "filename": "\\Windows\\SysWOW64\\advapi32.dll", "id": "region_985", "name": "advapi32.dll", "norm_filename": "c:\\windows\\syswow64\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 1976827904, "timestamp": "00:00:58.943", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 20705280, "start_va": 1953890304, "type": "region", "version": 1 }, "end_va": 1974595583, "entry_point": 1953890304, "filename": "\\Windows\\SysWOW64\\shell32.dll", "id": "region_986", "name": "shell32.dll", "norm_filename": "c:\\windows\\syswow64\\shell32.dll", "region_type": "memory_mapped_file", "start_va": 1953890304, "timestamp": "00:00:58.947", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 5099520, "start_va": 1984757760, "type": "region", "version": 1 }, "end_va": 1989857279, "entry_point": 1984757760, "filename": "\\Windows\\SysWOW64\\windows.storage.dll", "id": "region_987", "name": "windows.storage.dll", "norm_filename": "c:\\windows\\syswow64\\windows.storage.dll", "region_type": "memory_mapped_file", "start_va": 1984757760, "timestamp": "00:00:58.949", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 1995112448, "type": "region", "version": 1 }, "end_va": 1995161599, "entry_point": 1995112448, "filename": "\\Windows\\SysWOW64\\kernel.appcore.dll", "id": "region_988", "name": "kernel.appcore.dll", "norm_filename": "c:\\windows\\syswow64\\kernel.appcore.dll", "region_type": "memory_mapped_file", "start_va": 1995112448, "timestamp": "00:00:58.949", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 577536, "start_va": 1982332928, "type": "region", "version": 1 }, "end_va": 1982910463, "entry_point": 1982332928, "filename": "\\Windows\\SysWOW64\\SHCore.dll", "id": "region_989", "name": "shcore.dll", "norm_filename": "c:\\windows\\syswow64\\shcore.dll", "region_type": "memory_mapped_file", "start_va": 1982332928, "timestamp": "00:00:58.950", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 1975779328, "type": "region", "version": 1 }, "end_va": 1976057855, "entry_point": 1975779328, "filename": "\\Windows\\SysWOW64\\powrprof.dll", "id": "region_990", "name": "powrprof.dll", "norm_filename": "c:\\windows\\syswow64\\powrprof.dll", "region_type": "memory_mapped_file", "start_va": 1975779328, "timestamp": "00:00:58.951", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 61440, "start_va": 1996816384, "type": "region", "version": 1 }, "end_va": 1996877823, "entry_point": 1996816384, "filename": "\\Windows\\SysWOW64\\profapi.dll", "id": "region_991", "name": "profapi.dll", "norm_filename": "c:\\windows\\syswow64\\profapi.dll", "region_type": "memory_mapped_file", "start_va": 1996816384, "timestamp": "00:00:58.952", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 958464, "start_va": 1952710656, "type": "region", "version": 1 }, "end_va": 1953669119, "entry_point": 1952710656, "filename": "\\Windows\\SysWOW64\\ole32.dll", "id": "region_992", "name": "ole32.dll", "norm_filename": "c:\\windows\\syswow64\\ole32.dll", "region_type": "memory_mapped_file", "start_va": 1952710656, "timestamp": "00:00:58.959", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 593920, "start_va": 31653888, "type": "region", "version": 1 }, "end_va": 32247807, "entry_point": 31653888, "filename": "\\Windows\\SysWOW64\\oleaut32.dll", "id": "region_993", "name": "oleaut32.dll", "norm_filename": "c:\\windows\\syswow64\\oleaut32.dll", "region_type": "memory_mapped_file", "start_va": 31653888, "timestamp": "00:00:58.961", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000994-addr_0x0000000001e30000-size_0x00000000004a0000-perm_rw.bin", "flags": [ "max_total_dump_size_reached" ], "info": "No dump or only a partial dump was created because the total dump size was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_937", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4849664, "start_va": 31653888, "type": "region", "version": 1 }, "end_va": 36503551, "entry_point": 0, "filename": null, "id": "region_994", "name": "private_0x0000000001e30000", "norm_filename": null, "region_type": "private_memory", "start_va": 31653888, "timestamp": "00:00:58.962", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000995-addr_0x0000000001dc0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_938", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 31195136, "type": "region", "version": 1 }, "end_va": 31199231, "entry_point": 0, "filename": null, "id": "region_995", "name": "private_0x0000000001dc0000", "norm_filename": null, "region_type": "private_memory", "start_va": 31195136, "timestamp": "00:00:58.973", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00000999-addr_0x0000000001dc0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_942", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 31195136, "type": "region", "version": 1 }, "end_va": 31199231, "entry_point": 0, "filename": null, "id": "region_999", "name": "private_0x0000000001dc0000", "norm_filename": null, "region_type": "private_memory", "start_va": 31195136, "timestamp": "00:00:58.992", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00001003-addr_0x0000000001dc0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_946", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 31195136, "type": "region", "version": 1 }, "end_va": 31199231, "entry_point": 0, "filename": null, "id": "region_1003", "name": "private_0x0000000001dc0000", "norm_filename": null, "region_type": "private_memory", "start_va": 31195136, "timestamp": "00:00:59.006", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00001006-addr_0x0000000001dc0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_949", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 31195136, "type": "region", "version": 1 }, "end_va": 31199231, "entry_point": 0, "filename": null, "id": "region_1006", "name": "private_0x0000000001dc0000", "norm_filename": null, "region_type": "private_memory", "start_va": 31195136, "timestamp": "00:00:59.032", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00001007-addr_0x0000000001dc0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_950", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 31195136, "type": "region", "version": 1 }, "end_va": 31199231, "entry_point": 0, "filename": null, "id": "region_1007", "name": "private_0x0000000001dc0000", "norm_filename": null, "region_type": "private_memory", "start_va": 31195136, "timestamp": "00:00:59.035", "type": "region", "version": 1 }, { "dump": { "filename": "process_00000007-region_00001011-addr_0x0000000001dc0000-size_0x0000000000001000-perm_rw.bin", "flags": [ "dumped" ], "info": "Region dumped", "permissions": [ "readable", "writable" ], "ref_process_dump": { "ref_id": "proc_dump_954", "ref_source": "summary", "ref_type": "process_dump", "type": "reference", "version": 1 }, "size": 4096, "start_va": 31195136, "type": "region", "version": 1 }, "end_va": 31199231, "entry_point": 0, "filename": null, "id": "region_1011", "name": "private_0x0000000001dc0000", "norm_filename": null, "region_type": "private_memory", "start_va": 31195136, "timestamp": "00:00:59.051", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 31195136, "type": "region", "version": 1 }, "end_va": 31199231, "entry_point": 0, "filename": null, "id": "region_1020", "name": "private_0x0000000001dc0000", "norm_filename": null, "region_type": "private_memory", "start_va": 31195136, "timestamp": "00:00:59.082", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 36503552, "type": "region", "version": 1 }, "end_va": 39874559, "entry_point": 36503552, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_1694", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 36503552, "timestamp": "00:01:01.512", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 39911424, "type": "region", "version": 1 }, "end_va": 40959999, "entry_point": 0, "filename": null, "id": "region_1695", "name": "private_0x0000000002610000", "norm_filename": null, "region_type": "private_memory", "start_va": 39911424, "timestamp": "00:01:01.540", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1843200, "start_va": 40960000, "type": "region", "version": 1 }, "end_va": 42803199, "entry_point": 0, "filename": null, "id": "region_1711", "name": "private_0x0000000002710000", "norm_filename": null, "region_type": "private_memory", "start_va": 40960000, "timestamp": "00:01:01.627", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 598016, "start_va": 40960000, "type": "region", "version": 1 }, "end_va": 41558015, "entry_point": 0, "filename": null, "id": "region_1722", "name": "pagefile_0x0000000002710000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 40960000, "timestamp": "00:01:02.036", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1843200, "start_va": 41615360, "type": "region", "version": 1 }, "end_va": 43458559, "entry_point": 0, "filename": null, "id": "region_1732", "name": "private_0x00000000027b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 41615360, "timestamp": "00:01:02.045", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "C:\\Windows\\system32\\svchost.exe", "filename": "c:\\windows\\system32\\svchost.exe", "id": "proc_8", "image_name": "svchost.exe", "monitor_reason": "child_process", "monitored_id": 8, "origin_monitor_id": 7, "ref_parent_process": { "ref_id": "proc_7", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2138464256, "type": "region", "version": 1 }, "end_va": 2138468351, "entry_point": 0, "filename": null, "id": "region_1696", "name": "private_0x000000007f766000", "norm_filename": null, "region_type": "private_memory", "start_va": 2138464256, "timestamp": "00:01:01.543", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_1697", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:01:01.543", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 131072, "start_va": 466190991360, "type": "region", "version": 1 }, "end_va": 466191122431, "entry_point": 0, "filename": null, "id": "region_1698", "name": "private_0x0000006c8b260000", "norm_filename": null, "region_type": "private_memory", "start_va": 466190991360, "timestamp": "00:01:01.543", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 466191122432, "type": "region", "version": 1 }, "end_va": 466191204351, "entry_point": 0, "filename": null, "id": "region_1699", "name": "pagefile_0x0000006c8b280000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 466191122432, "timestamp": "00:01:01.543", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 466191253504, "type": "region", "version": 1 }, "end_va": 466191777791, "entry_point": 0, "filename": null, "id": "region_1700", "name": "private_0x0000006c8b2a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 466191253504, "timestamp": "00:01:01.543", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 466191777792, "type": "region", "version": 1 }, "end_va": 466191794175, "entry_point": 0, "filename": null, "id": "region_1701", "name": "pagefile_0x0000006c8b320000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 466191777792, "timestamp": "00:01:01.543", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 466191843328, "type": "region", "version": 1 }, "end_va": 466191847423, "entry_point": 0, "filename": null, "id": "region_1702", "name": "pagefile_0x0000006c8b330000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 466191843328, "timestamp": "00:01:01.543", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 466191908864, "type": "region", "version": 1 }, "end_va": 466191917055, "entry_point": 0, "filename": null, "id": "region_1703", "name": "private_0x0000006c8b340000", "norm_filename": null, "region_type": "private_memory", "start_va": 466191908864, "timestamp": "00:01:01.543", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "" ], "ref_process_dump": null, "size": 2199023255552, "start_va": 138495511560192, "type": "region", "version": 1 }, "end_va": 140694534815743, "entry_point": 0, "filename": null, "id": "region_1704", "name": "pagefile_0x00007df5ffc50000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 138495511560192, "timestamp": "00:01:01.543", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 140697877938176, "type": "region", "version": 1 }, "end_va": 140697878081535, "entry_point": 0, "filename": null, "id": "region_1705", "name": "pagefile_0x00007ff6c7090000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140697877938176, "timestamp": "00:01:01.543", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 140697878093824, "type": "region", "version": 1 }, "end_va": 140697878097919, "entry_point": 0, "filename": null, "id": "region_1706", "name": "private_0x00007ff6c70b6000", "norm_filename": null, "region_type": "private_memory", "start_va": 140697878093824, "timestamp": "00:01:01.543", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140697878126592, "type": "region", "version": 1 }, "end_va": 140697878134783, "entry_point": 0, "filename": null, "id": "region_1707", "name": "private_0x00007ff6c70be000", "norm_filename": null, "region_type": "private_memory", "start_va": 140697878126592, "timestamp": "00:01:01.543", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 53248, "start_va": 140697892028416, "type": "region", "version": 1 }, "end_va": 140697892081663, "entry_point": 140697892028416, "filename": "\\Windows\\System32\\svchost.exe", "id": "region_1708", "name": "svchost.exe", "norm_filename": "c:\\windows\\system32\\svchost.exe", "region_type": "memory_mapped_file", "start_va": 140697892028416, "timestamp": "00:01:01.543", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140717040140288, "type": "region", "version": 1 }, "end_va": 140717041983487, "entry_point": 140717040140288, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_1709", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140717040140288, "timestamp": "00:01:01.621", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 466193022976, "type": "region", "version": 1 }, "end_va": 466193051647, "entry_point": 0, "filename": null, "id": "region_1718", "name": "private_0x0000006c8b450000", "norm_filename": null, "region_type": "private_memory", "start_va": 466193022976, "timestamp": "00:01:01.922", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 466193743872, "type": "region", "version": 1 }, "end_va": 466194792447, "entry_point": 0, "filename": null, "id": "region_1719", "name": "private_0x0000006c8b500000", "norm_filename": null, "region_type": "private_memory", "start_va": 466193743872, "timestamp": "00:01:01.922", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1953792, "start_va": 140716994985984, "type": "region", "version": 1 }, "end_va": 140716996939775, "entry_point": 140716994985984, "filename": "\\Windows\\System32\\KernelBase.dll", "id": "region_1720", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\system32\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 140716994985984, "timestamp": "00:01:01.923", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 708608, "start_va": 140717039419392, "type": "region", "version": 1 }, "end_va": 140717040127999, "entry_point": 140717039419392, "filename": "\\Windows\\System32\\kernel32.dll", "id": "region_1721", "name": "kernel32.dll", "norm_filename": "c:\\windows\\system32\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 140717039419392, "timestamp": "00:01:01.923", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 598016, "start_va": 2490368, "type": "region", "version": 1 }, "end_va": 3088383, "entry_point": 0, "filename": null, "id": "region_1723", "name": "pagefile_0x0000000000260000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2490368, "timestamp": "00:01:02.042", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 466190991360, "type": "region", "version": 1 }, "end_va": 466191056895, "entry_point": 0, "filename": null, "id": "region_1724", "name": "pagefile_0x0000006c8b260000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 466190991360, "timestamp": "00:01:02.042", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 466191974400, "type": "region", "version": 1 }, "end_va": 466192752639, "entry_point": 466191974400, "filename": "\\Windows\\System32\\locale.nls", "id": "region_1725", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 466191974400, "timestamp": "00:01:02.043", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 466193088512, "type": "region", "version": 1 }, "end_va": 466193612799, "entry_point": 0, "filename": null, "id": "region_1726", "name": "private_0x0000006c8b460000", "norm_filename": null, "region_type": "private_memory", "start_va": 466193088512, "timestamp": "00:01:02.043", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 140697876889600, "type": "region", "version": 1 }, "end_va": 140697877938175, "entry_point": 0, "filename": null, "id": "region_1727", "name": "pagefile_0x00007ff6c6f90000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140697876889600, "timestamp": "00:01:02.043", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140697878118400, "type": "region", "version": 1 }, "end_va": 140697878126591, "entry_point": 0, "filename": null, "id": "region_1728", "name": "private_0x00007ff6c70bc000", "norm_filename": null, "region_type": "private_memory", "start_va": 140697878118400, "timestamp": "00:01:02.043", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1204224, "start_va": 140717019627520, "type": "region", "version": 1 }, "end_va": 140717020831743, "entry_point": 140717019627520, "filename": "\\Windows\\System32\\rpcrt4.dll", "id": "region_1729", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\system32\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 140717019627520, "timestamp": "00:01:02.043", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 372736, "start_va": 140717029916672, "type": "region", "version": 1 }, "end_va": 140717030289407, "entry_point": 140717029916672, "filename": "\\Windows\\System32\\sechost.dll", "id": "region_1730", "name": "sechost.dll", "norm_filename": "c:\\windows\\system32\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 140717029916672, "timestamp": "00:01:02.043", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 4096, "start_va": 3145728, "type": "region", "version": 1 }, "end_va": 3149823, "entry_point": 0, "filename": null, "id": "region_1737", "name": "private_0x0000000000300000", "norm_filename": null, "region_type": "private_memory", "start_va": 3145728, "timestamp": "00:01:02.348", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 140717030309888, "type": "region", "version": 1 }, "end_va": 140717031088127, "entry_point": 140717030309888, "filename": "\\Windows\\System32\\oleaut32.dll", "id": "region_1738", "name": "oleaut32.dll", "norm_filename": "c:\\windows\\system32\\oleaut32.dll", "region_type": "memory_mapped_file", "start_va": 140717030309888, "timestamp": "00:01:02.362", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 643072, "start_va": 140717035945984, "type": "region", "version": 1 }, "end_va": 140717036589055, "entry_point": 140717035945984, "filename": "\\Windows\\System32\\msvcrt.dll", "id": "region_1739", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\system32\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 140717035945984, "timestamp": "00:01:02.363", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2605056, "start_va": 140717033193472, "type": "region", "version": 1 }, "end_va": 140717035798527, "entry_point": 140717033193472, "filename": "\\Windows\\System32\\combase.dll", "id": "region_1740", "name": "combase.dll", "norm_filename": "c:\\windows\\system32\\combase.dll", "region_type": "memory_mapped_file", "start_va": 140717033193472, "timestamp": "00:01:02.364", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 299008, "start_va": 466194792448, "type": "region", "version": 1 }, "end_va": 466195091455, "entry_point": 0, "filename": null, "id": "region_1741", "name": "private_0x0000006c8b600000", "norm_filename": null, "region_type": "private_memory", "start_va": 466194792448, "timestamp": "00:01:02.366", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 2097152, "start_va": 466195120128, "type": "region", "version": 1 }, "end_va": 466197217279, "entry_point": 0, "filename": null, "id": "region_1742", "name": "private_0x0000006c8b650000", "norm_filename": null, "region_type": "private_memory", "start_va": 466195120128, "timestamp": "00:01:02.367", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 466195841024, "type": "region", "version": 1 }, "end_va": 466196889599, "entry_point": 0, "filename": null, "id": "region_1743", "name": "private_0x0000006c8b700000", "norm_filename": null, "region_type": "private_memory", "start_va": 466195841024, "timestamp": "00:01:02.367", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1314816, "start_va": 466196889600, "type": "region", "version": 1 }, "end_va": 466198204415, "entry_point": 466196889600, "filename": "\\Windows\\System32\\ole32.dll", "id": "region_1744", "name": "ole32.dll", "norm_filename": "c:\\windows\\system32\\ole32.dll", "region_type": "memory_mapped_file", "start_va": 466196889600, "timestamp": "00:01:02.372", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1937408, "start_va": 466196889600, "type": "region", "version": 1 }, "end_va": 466198827007, "entry_point": 0, "filename": null, "id": "region_1745", "name": "private_0x0000006c8b800000", "norm_filename": null, "region_type": "private_memory", "start_va": 466196889600, "timestamp": "00:01:02.374", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 2097152, "start_va": 466198855680, "type": "region", "version": 1 }, "end_va": 466200952831, "entry_point": 0, "filename": null, "id": "region_1746", "name": "private_0x0000006c8b9e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 466198855680, "timestamp": "00:01:02.375", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 466198986752, "type": "region", "version": 1 }, "end_va": 466200035327, "entry_point": 0, "filename": null, "id": "region_1747", "name": "private_0x0000006c8ba00000", "norm_filename": null, "region_type": "private_memory", "start_va": 466198986752, "timestamp": "00:01:02.375", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 2097152, "start_va": 466200035328, "type": "region", "version": 1 }, "end_va": 466202132479, "entry_point": 0, "filename": null, "id": "region_1748", "name": "private_0x0000006c8bb00000", "norm_filename": null, "region_type": "private_memory", "start_va": 466200035328, "timestamp": "00:01:02.375", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 466200035328, "type": "region", "version": 1 }, "end_va": 466201083903, "entry_point": 0, "filename": null, "id": "region_1749", "name": "private_0x0000006c8bb00000", "norm_filename": null, "region_type": "private_memory", "start_va": 466200035328, "timestamp": "00:01:02.375", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 2097152, "start_va": 466201083904, "type": "region", "version": 1 }, "end_va": 466203181055, "entry_point": 0, "filename": null, "id": "region_1750", "name": "private_0x0000006c8bc00000", "norm_filename": null, "region_type": "private_memory", "start_va": 466201083904, "timestamp": "00:01:02.375", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 466201083904, "type": "region", "version": 1 }, "end_va": 466202132479, "entry_point": 0, "filename": null, "id": "region_1751", "name": "private_0x0000006c8bc00000", "norm_filename": null, "region_type": "private_memory", "start_va": 466201083904, "timestamp": "00:01:02.376", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 2097152, "start_va": 466202132480, "type": "region", "version": 1 }, "end_va": 466204229631, "entry_point": 0, "filename": null, "id": "region_1752", "name": "private_0x0000006c8bd00000", "norm_filename": null, "region_type": "private_memory", "start_va": 466202132480, "timestamp": "00:01:02.376", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 466202132480, "type": "region", "version": 1 }, "end_va": 466203181055, "entry_point": 0, "filename": null, "id": "region_1753", "name": "private_0x0000006c8bd00000", "norm_filename": null, "region_type": "private_memory", "start_va": 466202132480, "timestamp": "00:01:02.376", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 466191056896, "type": "region", "version": 1 }, "end_va": 466191065087, "entry_point": 0, "filename": null, "id": "region_1754", "name": "private_0x0000006c8b270000", "norm_filename": null, "region_type": "private_memory", "start_va": 466191056896, "timestamp": "00:01:02.377", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 679936, "start_va": 140717023100928, "type": "region", "version": 1 }, "end_va": 140717023780863, "entry_point": 140717023100928, "filename": "\\Windows\\System32\\advapi32.dll", "id": "region_1755", "name": "advapi32.dll", "norm_filename": "c:\\windows\\system32\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 140717023100928, "timestamp": "00:01:02.378", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 331776, "start_va": 140716997017600, "type": "region", "version": 1 }, "end_va": 140716997349375, "entry_point": 140716997017600, "filename": "\\Windows\\System32\\shlwapi.dll", "id": "region_1756", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\system32\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 140716997017600, "timestamp": "00:01:02.386", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1593344, "start_va": 140717024215040, "type": "region", "version": 1 }, "end_va": 140717025808383, "entry_point": 140717024215040, "filename": "\\Windows\\System32\\gdi32.dll", "id": "region_1757", "name": "gdi32.dll", "norm_filename": "c:\\windows\\system32\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 140717024215040, "timestamp": "00:01:02.387", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1368064, "start_va": 140717026770944, "type": "region", "version": 1 }, "end_va": 140717028139007, "entry_point": 140717026770944, "filename": "\\Windows\\System32\\user32.dll", "id": "region_1758", "name": "user32.dll", "norm_filename": "c:\\windows\\system32\\user32.dll", "region_type": "memory_mapped_file", "start_va": 140717026770944, "timestamp": "00:01:02.388", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 212992, "start_va": 466192760832, "type": "region", "version": 1 }, "end_va": 466192973823, "entry_point": 466192760832, "filename": "\\Windows\\System32\\imm32.dll", "id": "region_1759", "name": "imm32.dll", "norm_filename": "c:\\windows\\system32\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 466192760832, "timestamp": "00:01:02.390", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 466196889600, "type": "region", "version": 1 }, "end_va": 466198495231, "entry_point": 0, "filename": null, "id": "region_1760", "name": "pagefile_0x0000006c8b800000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 466196889600, "timestamp": "00:01:02.390", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 36864, "start_va": 466198790144, "type": "region", "version": 1 }, "end_va": 466198827007, "entry_point": 0, "filename": null, "id": "region_1761", "name": "private_0x0000006c8b9d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 466198790144, "timestamp": "00:01:02.390", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 221184, "start_va": 140717022838784, "type": "region", "version": 1 }, "end_va": 140717023059967, "entry_point": 140717022838784, "filename": "\\Windows\\System32\\imm32.dll", "id": "region_1762", "name": "imm32.dll", "norm_filename": "c:\\windows\\system32\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 140717022838784, "timestamp": "00:01:02.391", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1425408, "start_va": 140717037060096, "type": "region", "version": 1 }, "end_va": 140717038485503, "entry_point": 140717037060096, "filename": "\\Windows\\System32\\msctf.dll", "id": "region_1763", "name": "msctf.dll", "norm_filename": "c:\\windows\\system32\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 140717037060096, "timestamp": "00:01:02.392", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 466203181056, "type": "region", "version": 1 }, "end_va": 466204758015, "entry_point": 0, "filename": null, "id": "region_1764", "name": "pagefile_0x0000006c8be00000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 466203181056, "timestamp": "00:01:02.395", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 466204819456, "type": "region", "version": 1 }, "end_va": 466225790975, "entry_point": 0, "filename": null, "id": "region_1765", "name": "pagefile_0x0000006c8bf90000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 466204819456, "timestamp": "00:01:02.396", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 466191056896, "type": "region", "version": 1 }, "end_va": 466191060991, "entry_point": 466191056896, "filename": "\\Windows\\System32\\en-US\\svchost.exe.mui", "id": "region_1766", "name": "svchost.exe.mui", "norm_filename": "c:\\windows\\system32\\en-us\\svchost.exe.mui", "region_type": "memory_mapped_file", "start_va": 466191056896, "timestamp": "00:01:02.398", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 466192760832, "type": "region", "version": 1 }, "end_va": 466192764927, "entry_point": 0, "filename": null, "id": "region_1767", "name": "private_0x0000006c8b410000", "norm_filename": null, "region_type": "private_memory", "start_va": 466192760832, "timestamp": "00:01:02.427", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 466192826368, "type": "region", "version": 1 }, "end_va": 466192830463, "entry_point": 0, "filename": null, "id": "region_1768", "name": "private_0x0000006c8b420000", "norm_filename": null, "region_type": "private_memory", "start_va": 466192826368, "timestamp": "00:01:02.427", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 180224, "start_va": 140716979650560, "type": "region", "version": 1 }, "end_va": 140716979830783, "entry_point": 140716979650560, "filename": "\\Windows\\System32\\sspicli.dll", "id": "region_1769", "name": "sspicli.dll", "norm_filename": "c:\\windows\\system32\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 140716979650560, "timestamp": "00:01:02.433", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 466225790976, "type": "region", "version": 1 }, "end_va": 466229161983, "entry_point": 466225790976, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_1770", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 466225790976, "timestamp": "00:01:02.445", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 140717036601344, "type": "region", "version": 1 }, "end_va": 140717036634111, "entry_point": 140717036601344, "filename": "\\Windows\\System32\\psapi.dll", "id": "region_1771", "name": "psapi.dll", "norm_filename": "c:\\windows\\system32\\psapi.dll", "region_type": "memory_mapped_file", "start_va": 140717036601344, "timestamp": "00:01:02.471", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 598016, "start_va": 466195120128, "type": "region", "version": 1 }, "end_va": 466195718143, "entry_point": 0, "filename": null, "id": "region_2293", "name": "pagefile_0x0000006c8b650000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 466195120128, "timestamp": "00:01:03.088", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "C:\\Windows\\Explorer.EXE", "filename": "c:\\windows\\explorer.exe", "id": "proc_9", "image_name": "explorer.exe", "monitor_reason": "injection", "monitored_id": 9, "origin_monitor_id": 8, "ref_parent_process": { "ref_id": "proc_8", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 7667712, "type": "region", "version": 1 }, "end_va": 7733247, "entry_point": 0, "filename": null, "id": "region_1772", "name": "pagefile_0x0000000000750000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 7667712, "timestamp": "00:01:02.553", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 7733248, "type": "region", "version": 1 }, "end_va": 7761919, "entry_point": 0, "filename": null, "id": "region_1773", "name": "private_0x0000000000760000", "norm_filename": null, "region_type": "private_memory", "start_va": 7733248, "timestamp": "00:01:02.553", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 7798784, "type": "region", "version": 1 }, "end_va": 7880703, "entry_point": 0, "filename": null, "id": "region_1774", "name": "pagefile_0x0000000000770000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 7798784, "timestamp": "00:01:02.553", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 7929856, "type": "region", "version": 1 }, "end_va": 8454143, "entry_point": 0, "filename": null, "id": "region_1775", "name": "private_0x0000000000790000", "norm_filename": null, "region_type": "private_memory", "start_va": 7929856, "timestamp": "00:01:02.553", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 8454144, "type": "region", "version": 1 }, "end_va": 8470527, "entry_point": 0, "filename": null, "id": "region_1776", "name": "pagefile_0x0000000000810000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 8454144, "timestamp": "00:01:02.553", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 8519680, "type": "region", "version": 1 }, "end_va": 8531967, "entry_point": 0, "filename": null, "id": "region_1777", "name": "pagefile_0x0000000000820000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 8519680, "timestamp": "00:01:02.553", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 8585216, "type": "region", "version": 1 }, "end_va": 8593407, "entry_point": 0, "filename": null, "id": "region_1778", "name": "private_0x0000000000830000", "norm_filename": null, "region_type": "private_memory", "start_va": 8585216, "timestamp": "00:01:02.553", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 8650752, "type": "region", "version": 1 }, "end_va": 9428991, "entry_point": 8650752, "filename": "\\Windows\\System32\\locale.nls", "id": "region_1779", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 8650752, "timestamp": "00:01:02.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 9502720, "type": "region", "version": 1 }, "end_va": 9510911, "entry_point": 0, "filename": null, "id": "region_1780", "name": "pagefile_0x0000000000910000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 9502720, "timestamp": "00:01:02.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 9568256, "type": "region", "version": 1 }, "end_va": 9580543, "entry_point": 0, "filename": null, "id": "region_1781", "name": "pagefile_0x0000000000920000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 9568256, "timestamp": "00:01:02.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 9633792, "type": "region", "version": 1 }, "end_va": 9641983, "entry_point": 0, "filename": null, "id": "region_1782", "name": "pagefile_0x0000000000930000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 9633792, "timestamp": "00:01:02.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 73728, "start_va": 9699328, "type": "region", "version": 1 }, "end_va": 9773055, "entry_point": 9699328, "filename": "\\Windows\\System32\\en-US\\wscui.cpl.mui", "id": "region_1783", "name": "wscui.cpl.mui", "norm_filename": "c:\\windows\\system32\\en-us\\wscui.cpl.mui", "region_type": "memory_mapped_file", "start_va": 9699328, "timestamp": "00:01:02.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 9961472, "type": "region", "version": 1 }, "end_va": 9990143, "entry_point": 0, "filename": null, "id": "region_1784", "name": "private_0x0000000000980000", "norm_filename": null, "region_type": "private_memory", "start_va": 9961472, "timestamp": "00:01:02.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 32768, "start_va": 10027008, "type": "region", "version": 1 }, "end_va": 10059775, "entry_point": 10027008, "filename": "\\Windows\\en-US\\explorer.exe.mui", "id": "region_1785", "name": "explorer.exe.mui", "norm_filename": "c:\\windows\\en-us\\explorer.exe.mui", "region_type": "memory_mapped_file", "start_va": 10027008, "timestamp": "00:01:02.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 10092544, "type": "region", "version": 1 }, "end_va": 11141119, "entry_point": 0, "filename": null, "id": "region_1786", "name": "private_0x00000000009a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 10092544, "timestamp": "00:01:02.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 11141120, "type": "region", "version": 1 }, "end_va": 12746751, "entry_point": 0, "filename": null, "id": "region_1787", "name": "pagefile_0x0000000000aa0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 11141120, "timestamp": "00:01:02.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 12779520, "type": "region", "version": 1 }, "end_va": 12783615, "entry_point": 0, "filename": null, "id": "region_1788", "name": "private_0x0000000000c30000", "norm_filename": null, "region_type": "private_memory", "start_va": 12779520, "timestamp": "00:01:02.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 12845056, "type": "region", "version": 1 }, "end_va": 12849151, "entry_point": 0, "filename": null, "id": "region_1789", "name": "private_0x0000000000c40000", "norm_filename": null, "region_type": "private_memory", "start_va": 12845056, "timestamp": "00:01:02.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 12910592, "type": "region", "version": 1 }, "end_va": 12914687, "entry_point": 0, "filename": null, "id": "region_1790", "name": "pagefile_0x0000000000c50000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 12910592, "timestamp": "00:01:02.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 12976128, "type": "region", "version": 1 }, "end_va": 12980223, "entry_point": 0, "filename": null, "id": "region_1791", "name": "pagefile_0x0000000000c60000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 12976128, "timestamp": "00:01:02.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 13041664, "type": "region", "version": 1 }, "end_va": 13045759, "entry_point": 0, "filename": null, "id": "region_1792", "name": "pagefile_0x0000000000c70000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 13041664, "timestamp": "00:01:02.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 13107200, "type": "region", "version": 1 }, "end_va": 13111295, "entry_point": 0, "filename": null, "id": "region_1793", "name": "pagefile_0x0000000000c80000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 13107200, "timestamp": "00:01:02.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 13172736, "type": "region", "version": 1 }, "end_va": 13238271, "entry_point": 0, "filename": null, "id": "region_1794", "name": "private_0x0000000000c90000", "norm_filename": null, "region_type": "private_memory", "start_va": 13172736, "timestamp": "00:01:02.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 13238272, "type": "region", "version": 1 }, "end_va": 14815231, "entry_point": 0, "filename": null, "id": "region_1795", "name": "pagefile_0x0000000000ca0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 13238272, "timestamp": "00:01:02.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 14876672, "type": "region", "version": 1 }, "end_va": 35848191, "entry_point": 0, "filename": null, "id": "region_1796", "name": "pagefile_0x0000000000e30000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 14876672, "timestamp": "00:01:02.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 35848192, "type": "region", "version": 1 }, "end_va": 35864575, "entry_point": 35848192, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", "id": "region_1797", "name": "cversions.1.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db", "region_type": "memory_mapped_file", "start_va": 35848192, "timestamp": "00:01:02.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 139264, "start_va": 35913728, "type": "region", "version": 1 }, "end_va": 36052991, "entry_point": 35913728, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000012.db", "id": "region_1798", "name": "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000012.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000012.db", "region_type": "memory_mapped_file", "start_va": 35913728, "timestamp": "00:01:02.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 36110336, "type": "region", "version": 1 }, "end_va": 36114431, "entry_point": 0, "filename": null, "id": "region_1799", "name": "pagefile_0x0000000002270000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 36110336, "timestamp": "00:01:02.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 36175872, "type": "region", "version": 1 }, "end_va": 36700159, "entry_point": 0, "filename": null, "id": "region_1800", "name": "private_0x0000000002280000", "norm_filename": null, "region_type": "private_memory", "start_va": 36175872, "timestamp": "00:01:02.554", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 114688, "start_va": 36700160, "type": "region", "version": 1 }, "end_va": 36814847, "entry_point": 36700160, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000030.db", "id": "region_1801", "name": "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000030.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000030.db", "region_type": "memory_mapped_file", "start_va": 36700160, "timestamp": "00:01:02.555", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 36831232, "type": "region", "version": 1 }, "end_va": 36843519, "entry_point": 0, "filename": null, "id": "region_1802", "name": "pagefile_0x0000000002320000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 36831232, "timestamp": "00:01:02.555", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 36896768, "type": "region", "version": 1 }, "end_va": 36909055, "entry_point": 0, "filename": null, "id": "region_1803", "name": "pagefile_0x0000000002330000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 36896768, "timestamp": "00:01:02.555", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 36962304, "type": "region", "version": 1 }, "end_va": 37027839, "entry_point": 0, "filename": null, "id": "region_1804", "name": "private_0x0000000002340000", "norm_filename": null, "region_type": "private_memory", "start_va": 36962304, "timestamp": "00:01:02.555", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 37027840, "type": "region", "version": 1 }, "end_va": 40398847, "entry_point": 37027840, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_1805", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 37027840, "timestamp": "00:01:02.555", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 40435712, "type": "region", "version": 1 }, "end_va": 40959999, "entry_point": 0, "filename": null, "id": "region_1806", "name": "private_0x0000000002690000", "norm_filename": null, "region_type": "private_memory", "start_va": 40435712, "timestamp": "00:01:02.555", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 40960000, "type": "region", "version": 1 }, "end_va": 41484287, "entry_point": 0, "filename": null, "id": "region_1807", "name": "private_0x0000000002710000", "norm_filename": null, "region_type": "private_memory", "start_va": 40960000, "timestamp": "00:01:02.555", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 41484288, "type": "region", "version": 1 }, "end_va": 42008575, "entry_point": 0, "filename": null, "id": "region_1808", "name": "private_0x0000000002790000", "norm_filename": null, "region_type": "private_memory", "start_va": 41484288, "timestamp": "00:01:02.555", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 397312, "start_va": 42008576, "type": "region", "version": 1 }, "end_va": 42405887, "entry_point": 42008576, "filename": "\\Windows\\System32\\en-US\\shell32.dll.mui", "id": "region_1809", "name": "shell32.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\shell32.dll.mui", "region_type": "memory_mapped_file", "start_va": 42008576, "timestamp": "00:01:02.555", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 172032, "start_va": 42467328, "type": "region", "version": 1 }, "end_va": 42639359, "entry_point": 0, "filename": null, "id": "region_1810", "name": "pagefile_0x0000000002880000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 42467328, "timestamp": "00:01:02.555", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 913408, "start_va": 42663936, "type": "region", "version": 1 }, "end_va": 43577343, "entry_point": 42663936, "filename": "\\Windows\\System32\\en-US\\KernelBase.dll.mui", "id": "region_1811", "name": "kernelbase.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\kernelbase.dll.mui", "region_type": "memory_mapped_file", "start_va": 42663936, "timestamp": "00:01:02.555", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 43581440, "type": "region", "version": 1 }, "end_va": 43589631, "entry_point": 43581440, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db", "id": "region_1812", "name": "thumbcache_idx.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db", "region_type": "memory_mapped_file", "start_va": 43581440, "timestamp": "00:01:02.555", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 43646976, "type": "region", "version": 1 }, "end_va": 43655167, "entry_point": 0, "filename": null, "id": "region_1813", "name": "pagefile_0x00000000029a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 43646976, "timestamp": "00:01:02.555", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 43712512, "type": "region", "version": 1 }, "end_va": 43720703, "entry_point": 43712512, "filename": "\\Windows\\System32\\en-US\\hcproviders.dll.mui", "id": "region_1814", "name": "hcproviders.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\hcproviders.dll.mui", "region_type": "memory_mapped_file", "start_va": 43712512, "timestamp": "00:01:02.555", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 45056, "start_va": 43778048, "type": "region", "version": 1 }, "end_va": 43823103, "entry_point": 43778048, "filename": "\\Windows\\System32\\en-US\\ActionCenter.dll.mui", "id": "region_1815", "name": "actioncenter.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\actioncenter.dll.mui", "region_type": "memory_mapped_file", "start_va": 43778048, "timestamp": "00:01:02.555", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 43843584, "type": "region", "version": 1 }, "end_va": 43851775, "entry_point": 43843584, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db", "id": "region_1816", "name": "thumbcache_idx.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db", "region_type": "memory_mapped_file", "start_va": 43843584, "timestamp": "00:01:02.555", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 43909120, "type": "region", "version": 1 }, "end_va": 43917311, "entry_point": 43909120, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db", "id": "region_1817", "name": "iconcache_idx.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db", "region_type": "memory_mapped_file", "start_va": 43909120, "timestamp": "00:01:02.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 43974656, "type": "region", "version": 1 }, "end_va": 43982847, "entry_point": 43974656, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db", "id": "region_1818", "name": "thumbcache_idx.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db", "region_type": "memory_mapped_file", "start_va": 43974656, "timestamp": "00:01:02.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 44040192, "type": "region", "version": 1 }, "end_va": 44048383, "entry_point": 44040192, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db", "id": "region_1819", "name": "iconcache_idx.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db", "region_type": "memory_mapped_file", "start_va": 44040192, "timestamp": "00:01:02.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 44105728, "type": "region", "version": 1 }, "end_va": 44630015, "entry_point": 0, "filename": null, "id": "region_1820", "name": "private_0x0000000002a10000", "norm_filename": null, "region_type": "private_memory", "start_va": 44105728, "timestamp": "00:01:02.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 44630016, "type": "region", "version": 1 }, "end_va": 45154303, "entry_point": 0, "filename": null, "id": "region_1821", "name": "private_0x0000000002a90000", "norm_filename": null, "region_type": "private_memory", "start_va": 44630016, "timestamp": "00:01:02.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 45154304, "type": "region", "version": 1 }, "end_va": 45162495, "entry_point": 0, "filename": null, "id": "region_1822", "name": "pagefile_0x0000000002b10000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 45154304, "timestamp": "00:01:02.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 45219840, "type": "region", "version": 1 }, "end_va": 45228031, "entry_point": 0, "filename": null, "id": "region_1823", "name": "pagefile_0x0000000002b20000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 45219840, "timestamp": "00:01:02.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 45285376, "type": "region", "version": 1 }, "end_va": 45293567, "entry_point": 45285376, "filename": "\\Windows\\System32\\oleaccrc.dll", "id": "region_1824", "name": "oleaccrc.dll", "norm_filename": "c:\\windows\\system32\\oleaccrc.dll", "region_type": "memory_mapped_file", "start_va": 45285376, "timestamp": "00:01:02.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20480, "start_va": 45350912, "type": "region", "version": 1 }, "end_va": 45371391, "entry_point": 45350912, "filename": "\\Windows\\System32\\en-US\\oleaccrc.dll.mui", "id": "region_1825", "name": "oleaccrc.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\oleaccrc.dll.mui", "region_type": "memory_mapped_file", "start_va": 45350912, "timestamp": "00:01:02.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 753664, "start_va": 45416448, "type": "region", "version": 1 }, "end_va": 46170111, "entry_point": 0, "filename": null, "id": "region_1826", "name": "pagefile_0x0000000002b50000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 45416448, "timestamp": "00:01:02.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 46202880, "type": "region", "version": 1 }, "end_va": 46219263, "entry_point": 0, "filename": null, "id": "region_1827", "name": "pagefile_0x0000000002c10000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 46202880, "timestamp": "00:01:02.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 46268416, "type": "region", "version": 1 }, "end_va": 47316991, "entry_point": 0, "filename": null, "id": "region_1828", "name": "private_0x0000000002c20000", "norm_filename": null, "region_type": "private_memory", "start_va": 46268416, "timestamp": "00:01:02.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 47316992, "type": "region", "version": 1 }, "end_va": 48365567, "entry_point": 0, "filename": null, "id": "region_1829", "name": "private_0x0000000002d20000", "norm_filename": null, "region_type": "private_memory", "start_va": 47316992, "timestamp": "00:01:02.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 48365568, "type": "region", "version": 1 }, "end_va": 48394239, "entry_point": 0, "filename": null, "id": "region_1830", "name": "private_0x0000000002e20000", "norm_filename": null, "region_type": "private_memory", "start_va": 48365568, "timestamp": "00:01:02.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 48431104, "type": "region", "version": 1 }, "end_va": 48443391, "entry_point": 0, "filename": null, "id": "region_1831", "name": "pagefile_0x0000000002e30000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 48431104, "timestamp": "00:01:02.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 17039360, "start_va": 48496640, "type": "region", "version": 1 }, "end_va": 65535999, "entry_point": 48496640, "filename": "\\Windows\\Fonts\\StaticCache.dat", "id": "region_1832", "name": "staticcache.dat", "norm_filename": "c:\\windows\\fonts\\staticcache.dat", "region_type": "memory_mapped_file", "start_va": 48496640, "timestamp": "00:01:02.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 65536000, "type": "region", "version": 1 }, "end_va": 65540095, "entry_point": 0, "filename": null, "id": "region_1833", "name": "private_0x0000000003e80000", "norm_filename": null, "region_type": "private_memory", "start_va": 65536000, "timestamp": "00:01:02.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 65601536, "type": "region", "version": 1 }, "end_va": 65605631, "entry_point": 0, "filename": null, "id": "region_1834", "name": "private_0x0000000003e90000", "norm_filename": null, "region_type": "private_memory", "start_va": 65601536, "timestamp": "00:01:02.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 65667072, "type": "region", "version": 1 }, "end_va": 65671167, "entry_point": 0, "filename": null, "id": "region_1835", "name": "private_0x0000000003ea0000", "norm_filename": null, "region_type": "private_memory", "start_va": 65667072, "timestamp": "00:01:02.556", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 65732608, "type": "region", "version": 1 }, "end_va": 65744895, "entry_point": 0, "filename": null, "id": "region_1836", "name": "pagefile_0x0000000003eb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 65732608, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 65798144, "type": "region", "version": 1 }, "end_va": 66322431, "entry_point": 0, "filename": null, "id": "region_1837", "name": "private_0x0000000003ec0000", "norm_filename": null, "region_type": "private_memory", "start_va": 65798144, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 66322432, "type": "region", "version": 1 }, "end_va": 66330623, "entry_point": 0, "filename": null, "id": "region_1838", "name": "private_0x0000000003f40000", "norm_filename": null, "region_type": "private_memory", "start_va": 66322432, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 66387968, "type": "region", "version": 1 }, "end_va": 66392063, "entry_point": 0, "filename": null, "id": "region_1839", "name": "private_0x0000000003f50000", "norm_filename": null, "region_type": "private_memory", "start_va": 66387968, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 66453504, "type": "region", "version": 1 }, "end_va": 66457599, "entry_point": 0, "filename": null, "id": "region_1840", "name": "private_0x0000000003f60000", "norm_filename": null, "region_type": "private_memory", "start_va": 66453504, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 66519040, "type": "region", "version": 1 }, "end_va": 66523135, "entry_point": 0, "filename": null, "id": "region_1841", "name": "private_0x0000000003f70000", "norm_filename": null, "region_type": "private_memory", "start_va": 66519040, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 66584576, "type": "region", "version": 1 }, "end_va": 66588671, "entry_point": 0, "filename": null, "id": "region_1842", "name": "private_0x0000000003f80000", "norm_filename": null, "region_type": "private_memory", "start_va": 66584576, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 66650112, "type": "region", "version": 1 }, "end_va": 66715647, "entry_point": 0, "filename": null, "id": "region_1843", "name": "pagefile_0x0000000003f90000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 66650112, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 66715648, "type": "region", "version": 1 }, "end_va": 66781183, "entry_point": 0, "filename": null, "id": "region_1844", "name": "pagefile_0x0000000003fa0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 66715648, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 66781184, "type": "region", "version": 1 }, "end_va": 66846719, "entry_point": 0, "filename": null, "id": "region_1845", "name": "pagefile_0x0000000003fb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 66781184, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 66846720, "type": "region", "version": 1 }, "end_va": 66850815, "entry_point": 0, "filename": null, "id": "region_1846", "name": "private_0x0000000003fc0000", "norm_filename": null, "region_type": "private_memory", "start_va": 66846720, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 66912256, "type": "region", "version": 1 }, "end_va": 66916351, "entry_point": 0, "filename": null, "id": "region_1847", "name": "private_0x0000000003fd0000", "norm_filename": null, "region_type": "private_memory", "start_va": 66912256, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 66977792, "type": "region", "version": 1 }, "end_va": 66994175, "entry_point": 66977792, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", "id": "region_1848", "name": "cversions.1.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db", "region_type": "memory_mapped_file", "start_va": 66977792, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 67043328, "type": "region", "version": 1 }, "end_va": 67047423, "entry_point": 0, "filename": null, "id": "region_1849", "name": "private_0x0000000003ff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 67043328, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 67108864, "type": "region", "version": 1 }, "end_va": 67112959, "entry_point": 0, "filename": null, "id": "region_1850", "name": "pagefile_0x0000000004000000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 67108864, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 67174400, "type": "region", "version": 1 }, "end_va": 67178495, "entry_point": 0, "filename": null, "id": "region_1851", "name": "private_0x0000000004010000", "norm_filename": null, "region_type": "private_memory", "start_va": 67174400, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 67239936, "type": "region", "version": 1 }, "end_va": 67252223, "entry_point": 0, "filename": null, "id": "region_1852", "name": "pagefile_0x0000000004020000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 67239936, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 67305472, "type": "region", "version": 1 }, "end_va": 67309567, "entry_point": 0, "filename": null, "id": "region_1853", "name": "private_0x0000000004030000", "norm_filename": null, "region_type": "private_memory", "start_va": 67305472, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 67371008, "type": "region", "version": 1 }, "end_va": 67387391, "entry_point": 67371008, "filename": "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db", "id": "region_1854", "name": "cversions.2.db", "norm_filename": "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db", "region_type": "memory_mapped_file", "start_va": 67371008, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 67436544, "type": "region", "version": 1 }, "end_va": 67960831, "entry_point": 0, "filename": null, "id": "region_1855", "name": "private_0x0000000004050000", "norm_filename": null, "region_type": "private_memory", "start_va": 67436544, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 233472, "start_va": 67960832, "type": "region", "version": 1 }, "end_va": 68194303, "entry_point": 0, "filename": null, "id": "region_1856", "name": "pagefile_0x00000000040d0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 67960832, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 68222976, "type": "region", "version": 1 }, "end_va": 68227071, "entry_point": 0, "filename": null, "id": "region_1857", "name": "private_0x0000000004110000", "norm_filename": null, "region_type": "private_memory", "start_va": 68222976, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 68288512, "type": "region", "version": 1 }, "end_va": 68300799, "entry_point": 0, "filename": null, "id": "region_1858", "name": "pagefile_0x0000000004120000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 68288512, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 68354048, "type": "region", "version": 1 }, "end_va": 68362239, "entry_point": 68354048, "filename": "\\Windows\\System32\\en-US\\stobject.dll.mui", "id": "region_1859", "name": "stobject.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\stobject.dll.mui", "region_type": "memory_mapped_file", "start_va": 68354048, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 68419584, "type": "region", "version": 1 }, "end_va": 68431871, "entry_point": 0, "filename": null, "id": "region_1860", "name": "pagefile_0x0000000004140000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 68419584, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 68485120, "type": "region", "version": 1 }, "end_va": 68493311, "entry_point": 68485120, "filename": "\\Windows\\System32\\en-US\\InputSwitch.dll.mui", "id": "region_1861", "name": "inputswitch.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\inputswitch.dll.mui", "region_type": "memory_mapped_file", "start_va": 68485120, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 68550656, "type": "region", "version": 1 }, "end_va": 68554751, "entry_point": 0, "filename": null, "id": "region_1862", "name": "private_0x0000000004160000", "norm_filename": null, "region_type": "private_memory", "start_va": 68550656, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 68616192, "type": "region", "version": 1 }, "end_va": 68628479, "entry_point": 0, "filename": null, "id": "region_1863", "name": "pagefile_0x0000000004170000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 68616192, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 68681728, "type": "region", "version": 1 }, "end_va": 68689919, "entry_point": 0, "filename": null, "id": "region_1864", "name": "pagefile_0x0000000004180000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 68681728, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 68747264, "type": "region", "version": 1 }, "end_va": 69271551, "entry_point": 0, "filename": null, "id": "region_1865", "name": "private_0x0000000004190000", "norm_filename": null, "region_type": "private_memory", "start_va": 68747264, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 69271552, "type": "region", "version": 1 }, "end_va": 69795839, "entry_point": 0, "filename": null, "id": "region_1866", "name": "private_0x0000000004210000", "norm_filename": null, "region_type": "private_memory", "start_va": 69271552, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 69795840, "type": "region", "version": 1 }, "end_va": 69808127, "entry_point": 0, "filename": null, "id": "region_1867", "name": "pagefile_0x0000000004290000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 69795840, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 69861376, "type": "region", "version": 1 }, "end_va": 69877759, "entry_point": 69861376, "filename": "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db", "id": "region_1868", "name": "cversions.2.db", "norm_filename": "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db", "region_type": "memory_mapped_file", "start_va": 69861376, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 274432, "start_va": 69926912, "type": "region", "version": 1 }, "end_va": 70201343, "entry_point": 69926912, "filename": "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000007.db", "id": "region_1869", "name": "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000007.db", "norm_filename": "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000007.db", "region_type": "memory_mapped_file", "start_va": 69926912, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 70254592, "type": "region", "version": 1 }, "end_va": 70778879, "entry_point": 0, "filename": null, "id": "region_1870", "name": "private_0x0000000004300000", "norm_filename": null, "region_type": "private_memory", "start_va": 70254592, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 70778880, "type": "region", "version": 1 }, "end_va": 71303167, "entry_point": 0, "filename": null, "id": "region_1871", "name": "private_0x0000000004380000", "norm_filename": null, "region_type": "private_memory", "start_va": 70778880, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 71303168, "type": "region", "version": 1 }, "end_va": 71307263, "entry_point": 0, "filename": null, "id": "region_1872", "name": "private_0x0000000004400000", "norm_filename": null, "region_type": "private_memory", "start_va": 71303168, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 71368704, "type": "region", "version": 1 }, "end_va": 71892991, "entry_point": 0, "filename": null, "id": "region_1873", "name": "private_0x0000000004410000", "norm_filename": null, "region_type": "private_memory", "start_va": 71368704, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 569344, "start_va": 71892992, "type": "region", "version": 1 }, "end_va": 72462335, "entry_point": 71892992, "filename": "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db", "id": "region_1874", "name": "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db", "norm_filename": "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db", "region_type": "memory_mapped_file", "start_va": 71892992, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 72482816, "type": "region", "version": 1 }, "end_va": 73007103, "entry_point": 0, "filename": null, "id": "region_1875", "name": "private_0x0000000004520000", "norm_filename": null, "region_type": "private_memory", "start_va": 72482816, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 73007104, "type": "region", "version": 1 }, "end_va": 73011199, "entry_point": 0, "filename": null, "id": "region_1876", "name": "private_0x00000000045a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 73007104, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 69632, "start_va": 73072640, "type": "region", "version": 1 }, "end_va": 73142271, "entry_point": 73072640, "filename": "\\Windows\\System32\\en-US\\propsys.dll.mui", "id": "region_1877", "name": "propsys.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\propsys.dll.mui", "region_type": "memory_mapped_file", "start_va": 73072640, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 73203712, "type": "region", "version": 1 }, "end_va": 73727999, "entry_point": 0, "filename": null, "id": "region_1878", "name": "private_0x00000000045d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 73203712, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 73728000, "type": "region", "version": 1 }, "end_va": 74252287, "entry_point": 0, "filename": null, "id": "region_1879", "name": "private_0x0000000004650000", "norm_filename": null, "region_type": "private_memory", "start_va": 73728000, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 74252288, "type": "region", "version": 1 }, "end_va": 74776575, "entry_point": 0, "filename": null, "id": "region_1880", "name": "private_0x00000000046d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 74252288, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 74776576, "type": "region", "version": 1 }, "end_va": 75300863, "entry_point": 0, "filename": null, "id": "region_1881", "name": "private_0x0000000004750000", "norm_filename": null, "region_type": "private_memory", "start_va": 74776576, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 75300864, "type": "region", "version": 1 }, "end_va": 75825151, "entry_point": 0, "filename": null, "id": "region_1882", "name": "private_0x00000000047d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 75300864, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 75825152, "type": "region", "version": 1 }, "end_va": 76349439, "entry_point": 0, "filename": null, "id": "region_1883", "name": "private_0x0000000004850000", "norm_filename": null, "region_type": "private_memory", "start_va": 75825152, "timestamp": "00:01:02.557", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "" ], "ref_process_dump": null, "size": 8388608, "start_va": 76349440, "type": "region", "version": 1 }, "end_va": 84738047, "entry_point": 0, "filename": null, "id": "region_1884", "name": "private_0x00000000048d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 76349440, "timestamp": "00:01:02.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 5185536, "start_va": 84738048, "type": "region", "version": 1 }, "end_va": 89923583, "entry_point": 0, "filename": null, "id": "region_1885", "name": "pagefile_0x00000000050d0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 84738048, "timestamp": "00:01:02.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 89980928, "type": "region", "version": 1 }, "end_va": 91029503, "entry_point": 0, "filename": null, "id": "region_1886", "name": "private_0x00000000055d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 89980928, "timestamp": "00:01:02.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 91029504, "type": "region", "version": 1 }, "end_va": 91553791, "entry_point": 0, "filename": null, "id": "region_1887", "name": "private_0x00000000056d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 91029504, "timestamp": "00:01:02.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 91553792, "type": "region", "version": 1 }, "end_va": 91557887, "entry_point": 91553792, "filename": "\\Windows\\System32\\msxml6r.dll", "id": "region_1888", "name": "msxml6r.dll", "norm_filename": "c:\\windows\\system32\\msxml6r.dll", "region_type": "memory_mapped_file", "start_va": 91553792, "timestamp": "00:01:02.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 91619328, "type": "region", "version": 1 }, "end_va": 91647999, "entry_point": 0, "filename": null, "id": "region_1889", "name": "private_0x0000000005760000", "norm_filename": null, "region_type": "private_memory", "start_va": 91619328, "timestamp": "00:01:02.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 91684864, "type": "region", "version": 1 }, "end_va": 92209151, "entry_point": 0, "filename": null, "id": "region_1890", "name": "private_0x0000000005770000", "norm_filename": null, "region_type": "private_memory", "start_va": 91684864, "timestamp": "00:01:02.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20480, "start_va": 92209152, "type": "region", "version": 1 }, "end_va": 92229631, "entry_point": 92209152, "filename": "\\Windows\\System32\\winnlsres.dll", "id": "region_1891", "name": "winnlsres.dll", "norm_filename": "c:\\windows\\system32\\winnlsres.dll", "region_type": "memory_mapped_file", "start_va": 92209152, "timestamp": "00:01:02.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 92274688, "type": "region", "version": 1 }, "end_va": 92340223, "entry_point": 92274688, "filename": "\\Windows\\System32\\en-US\\winnlsres.dll.mui", "id": "region_1892", "name": "winnlsres.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\winnlsres.dll.mui", "region_type": "memory_mapped_file", "start_va": 92274688, "timestamp": "00:01:02.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 92340224, "type": "region", "version": 1 }, "end_va": 92344319, "entry_point": 0, "filename": null, "id": "region_1893", "name": "pagefile_0x0000000005810000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 92340224, "timestamp": "00:01:02.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 92405760, "type": "region", "version": 1 }, "end_va": 92409855, "entry_point": 0, "filename": null, "id": "region_1894", "name": "private_0x0000000005820000", "norm_filename": null, "region_type": "private_memory", "start_va": 92405760, "timestamp": "00:01:02.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 92471296, "type": "region", "version": 1 }, "end_va": 92475391, "entry_point": 0, "filename": null, "id": "region_1895", "name": "private_0x0000000005830000", "norm_filename": null, "region_type": "private_memory", "start_va": 92471296, "timestamp": "00:01:02.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 92536832, "type": "region", "version": 1 }, "end_va": 92549119, "entry_point": 92536832, "filename": "\\Windows\\System32\\en-US\\mswsock.dll.mui", "id": "region_1896", "name": "mswsock.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\mswsock.dll.mui", "region_type": "memory_mapped_file", "start_va": 92536832, "timestamp": "00:01:02.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 92602368, "type": "region", "version": 1 }, "end_va": 92667903, "entry_point": 0, "filename": null, "id": "region_1897", "name": "private_0x0000000005850000", "norm_filename": null, "region_type": "private_memory", "start_va": 92602368, "timestamp": "00:01:02.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 92667904, "type": "region", "version": 1 }, "end_va": 93716479, "entry_point": 0, "filename": null, "id": "region_1898", "name": "private_0x0000000005860000", "norm_filename": null, "region_type": "private_memory", "start_va": 92667904, "timestamp": "00:01:02.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 93716480, "type": "region", "version": 1 }, "end_va": 94240767, "entry_point": 0, "filename": null, "id": "region_1899", "name": "private_0x0000000005960000", "norm_filename": null, "region_type": "private_memory", "start_va": 93716480, "timestamp": "00:01:02.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 94240768, "type": "region", "version": 1 }, "end_va": 94765055, "entry_point": 0, "filename": null, "id": "region_1900", "name": "private_0x00000000059e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 94240768, "timestamp": "00:01:02.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 94765056, "type": "region", "version": 1 }, "end_va": 95289343, "entry_point": 0, "filename": null, "id": "region_1901", "name": "private_0x0000000005a60000", "norm_filename": null, "region_type": "private_memory", "start_va": 94765056, "timestamp": "00:01:02.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 95289344, "type": "region", "version": 1 }, "end_va": 95813631, "entry_point": 0, "filename": null, "id": "region_1902", "name": "private_0x0000000005ae0000", "norm_filename": null, "region_type": "private_memory", "start_va": 95289344, "timestamp": "00:01:02.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 95813632, "type": "region", "version": 1 }, "end_va": 95817727, "entry_point": 95813632, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_256.db", "id": "region_1903", "name": "iconcache_256.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_256.db", "region_type": "memory_mapped_file", "start_va": 95813632, "timestamp": "00:01:02.559", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 95879168, "type": "region", "version": 1 }, "end_va": 95887359, "entry_point": 95879168, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db", "id": "region_1904", "name": "iconcache_idx.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db", "region_type": "memory_mapped_file", "start_va": 95879168, "timestamp": "00:01:02.559", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 95944704, "type": "region", "version": 1 }, "end_va": 95956991, "entry_point": 0, "filename": null, "id": "region_1905", "name": "pagefile_0x0000000005b80000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 95944704, "timestamp": "00:01:02.559", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 96010240, "type": "region", "version": 1 }, "end_va": 96018431, "entry_point": 96010240, "filename": "\\Windows\\System32\\en-US\\sndvolsso.dll.mui", "id": "region_1906", "name": "sndvolsso.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\sndvolsso.dll.mui", "region_type": "memory_mapped_file", "start_va": 96010240, "timestamp": "00:01:02.559", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 32768, "start_va": 96075776, "type": "region", "version": 1 }, "end_va": 96108543, "entry_point": 96075776, "filename": "\\Windows\\System32\\en-US\\windows.storage.dll.mui", "id": "region_1907", "name": "windows.storage.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\windows.storage.dll.mui", "region_type": "memory_mapped_file", "start_va": 96075776, "timestamp": "00:01:02.559", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 96141312, "type": "region", "version": 1 }, "end_va": 96153599, "entry_point": 0, "filename": null, "id": "region_1908", "name": "pagefile_0x0000000005bb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 96141312, "timestamp": "00:01:02.559", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 96206848, "type": "region", "version": 1 }, "end_va": 96210943, "entry_point": 0, "filename": null, "id": "region_1909", "name": "pagefile_0x0000000005bc0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 96206848, "timestamp": "00:01:02.559", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 96272384, "type": "region", "version": 1 }, "end_va": 96276479, "entry_point": 96272384, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_256.db", "id": "region_1910", "name": "iconcache_256.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_256.db", "region_type": "memory_mapped_file", "start_va": 96272384, "timestamp": "00:01:02.559", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 96337920, "type": "region", "version": 1 }, "end_va": 96350207, "entry_point": 0, "filename": null, "id": "region_1911", "name": "pagefile_0x0000000005be0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 96337920, "timestamp": "00:01:02.559", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 96403456, "type": "region", "version": 1 }, "end_va": 96407551, "entry_point": 0, "filename": null, "id": "region_1912", "name": "private_0x0000000005bf0000", "norm_filename": null, "region_type": "private_memory", "start_va": 96403456, "timestamp": "00:01:02.559", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 36864, "start_va": 96468992, "type": "region", "version": 1 }, "end_va": 96505855, "entry_point": 0, "filename": null, "id": "region_1913", "name": "private_0x0000000005c00000", "norm_filename": null, "region_type": "private_memory", "start_va": 96468992, "timestamp": "00:01:02.559", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 96534528, "type": "region", "version": 1 }, "end_va": 96550911, "entry_point": 0, "filename": null, "id": "region_1914", "name": "private_0x0000000005c10000", "norm_filename": null, "region_type": "private_memory", "start_va": 96534528, "timestamp": "00:01:02.559", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 96600064, "type": "region", "version": 1 }, "end_va": 96608255, "entry_point": 96600064, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db", "id": "region_1915", "name": "thumbcache_idx.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db", "region_type": "memory_mapped_file", "start_va": 96600064, "timestamp": "00:01:02.559", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 96665600, "type": "region", "version": 1 }, "end_va": 96669695, "entry_point": 96665600, "filename": "\\Windows\\System32\\netmsg.dll", "id": "region_1916", "name": "netmsg.dll", "norm_filename": "c:\\windows\\system32\\netmsg.dll", "region_type": "memory_mapped_file", "start_va": 96665600, "timestamp": "00:01:02.559", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 96731136, "type": "region", "version": 1 }, "end_va": 96735231, "entry_point": 0, "filename": null, "id": "region_1917", "name": "private_0x0000000005c40000", "norm_filename": null, "region_type": "private_memory", "start_va": 96731136, "timestamp": "00:01:02.560", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 36864, "start_va": 96796672, "type": "region", "version": 1 }, "end_va": 96833535, "entry_point": 0, "filename": null, "id": "region_1918", "name": "private_0x0000000005c50000", "norm_filename": null, "region_type": "private_memory", "start_va": 96796672, "timestamp": "00:01:02.560", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 110592, "start_va": 96862208, "type": "region", "version": 1 }, "end_va": 96972799, "entry_point": 96862208, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000031.db", "id": "region_1919", "name": "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000031.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000031.db", "region_type": "memory_mapped_file", "start_va": 96862208, "timestamp": "00:01:02.560", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 97058816, "type": "region", "version": 1 }, "end_va": 97067007, "entry_point": 97058816, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db", "id": "region_1920", "name": "thumbcache_idx.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db", "region_type": "memory_mapped_file", "start_va": 97058816, "timestamp": "00:01:02.560", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 97124352, "type": "region", "version": 1 }, "end_va": 97128447, "entry_point": 97124352, "filename": "\\Windows\\System32\\en-US\\imageres.dll.mui", "id": "region_1921", "name": "imageres.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\imageres.dll.mui", "region_type": "memory_mapped_file", "start_va": 97124352, "timestamp": "00:01:02.560", "type": "region", "version": 1 } ], "terminate_reason": "timeout", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "C:\\Windows\\System32\\RuntimeBroker.exe -Embedding", "filename": "c:\\windows\\system32\\runtimebroker.exe", "id": "proc_10", "image_name": "runtimebroker.exe", "monitor_reason": "injection", "monitored_id": 10, "origin_monitor_id": 9, "ref_parent_process": { "ref_id": "proc_9", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_2315", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 636324806656, "type": "region", "version": 1 }, "end_va": 636324872191, "entry_point": 0, "filename": null, "id": "region_2316", "name": "pagefile_0x0000009427ea0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 636324806656, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 636324872192, "type": "region", "version": 1 }, "end_va": 636324876287, "entry_point": 0, "filename": null, "id": "region_2317", "name": "private_0x0000009427eb0000", "norm_filename": null, "region_type": "private_memory", "start_va": 636324872192, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 636324937728, "type": "region", "version": 1 }, "end_va": 636325019647, "entry_point": 0, "filename": null, "id": "region_2318", "name": "pagefile_0x0000009427ec0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 636324937728, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 636325068800, "type": "region", "version": 1 }, "end_va": 636325593087, "entry_point": 0, "filename": null, "id": "region_2319", "name": "private_0x0000009427ee0000", "norm_filename": null, "region_type": "private_memory", "start_va": 636325068800, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 636325593088, "type": "region", "version": 1 }, "end_va": 636325609471, "entry_point": 0, "filename": null, "id": "region_2320", "name": "pagefile_0x0000009427f60000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 636325593088, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 636325658624, "type": "region", "version": 1 }, "end_va": 636325666815, "entry_point": 0, "filename": null, "id": "region_2321", "name": "pagefile_0x0000009427f70000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 636325658624, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 636325724160, "type": "region", "version": 1 }, "end_va": 636325732351, "entry_point": 0, "filename": null, "id": "region_2322", "name": "private_0x0000009427f80000", "norm_filename": null, "region_type": "private_memory", "start_va": 636325724160, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 636325789696, "type": "region", "version": 1 }, "end_va": 636325793791, "entry_point": 0, "filename": null, "id": "region_2323", "name": "private_0x0000009427f90000", "norm_filename": null, "region_type": "private_memory", "start_va": 636325789696, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 636325855232, "type": "region", "version": 1 }, "end_va": 636325859327, "entry_point": 0, "filename": null, "id": "region_2324", "name": "pagefile_0x0000009427fa0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 636325855232, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 636325920768, "type": "region", "version": 1 }, "end_va": 636325949439, "entry_point": 0, "filename": null, "id": "region_2325", "name": "private_0x0000009427fb0000", "norm_filename": null, "region_type": "private_memory", "start_va": 636325920768, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 636325986304, "type": "region", "version": 1 }, "end_va": 636325990399, "entry_point": 0, "filename": null, "id": "region_2326", "name": "pagefile_0x0000009427fc0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 636325986304, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 172032, "start_va": 636326051840, "type": "region", "version": 1 }, "end_va": 636326223871, "entry_point": 0, "filename": null, "id": "region_2327", "name": "pagefile_0x0000009427fd0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 636326051840, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 636326248448, "type": "region", "version": 1 }, "end_va": 636327297023, "entry_point": 0, "filename": null, "id": "region_2328", "name": "private_0x0000009428000000", "norm_filename": null, "region_type": "private_memory", "start_va": 636326248448, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 636327297024, "type": "region", "version": 1 }, "end_va": 636328075263, "entry_point": 636327297024, "filename": "\\Windows\\System32\\locale.nls", "id": "region_2329", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 636327297024, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 636328083456, "type": "region", "version": 1 }, "end_va": 636328607743, "entry_point": 0, "filename": null, "id": "region_2330", "name": "private_0x00000094281c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 636328083456, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 636328607744, "type": "region", "version": 1 }, "end_va": 636328620031, "entry_point": 0, "filename": null, "id": "region_2331", "name": "pagefile_0x0000009428240000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 636328607744, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 636328673280, "type": "region", "version": 1 }, "end_va": 636328677375, "entry_point": 0, "filename": null, "id": "region_2332", "name": "pagefile_0x0000009428250000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 636328673280, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 636328738816, "type": "region", "version": 1 }, "end_va": 636328742911, "entry_point": 0, "filename": null, "id": "region_2333", "name": "pagefile_0x0000009428260000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 636328738816, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 32768, "start_va": 636328804352, "type": "region", "version": 1 }, "end_va": 636328837119, "entry_point": 636328804352, "filename": "\\Windows\\System32\\en-US\\windows.storage.dll.mui", "id": "region_2334", "name": "windows.storage.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\windows.storage.dll.mui", "region_type": "memory_mapped_file", "start_va": 636328804352, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 636328869888, "type": "region", "version": 1 }, "end_va": 636328886271, "entry_point": 636328869888, "filename": "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db", "id": "region_2335", "name": "cversions.2.db", "norm_filename": "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db", "region_type": "memory_mapped_file", "start_va": 636328869888, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 636328935424, "type": "region", "version": 1 }, "end_va": 636328964095, "entry_point": 0, "filename": null, "id": "region_2336", "name": "private_0x0000009428290000", "norm_filename": null, "region_type": "private_memory", "start_va": 636328935424, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 139264, "start_va": 636329000960, "type": "region", "version": 1 }, "end_va": 636329140223, "entry_point": 636329000960, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000012.db", "id": "region_2337", "name": "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000012.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000012.db", "region_type": "memory_mapped_file", "start_va": 636329000960, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 636329197568, "type": "region", "version": 1 }, "end_va": 636329201663, "entry_point": 0, "filename": null, "id": "region_2338", "name": "pagefile_0x00000094282d0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 636329197568, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 636329263104, "type": "region", "version": 1 }, "end_va": 636329279487, "entry_point": 636329263104, "filename": "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db", "id": "region_2339", "name": "cversions.2.db", "norm_filename": "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db", "region_type": "memory_mapped_file", "start_va": 636329263104, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 636329394176, "type": "region", "version": 1 }, "end_va": 636330442751, "entry_point": 0, "filename": null, "id": "region_2340", "name": "private_0x0000009428300000", "norm_filename": null, "region_type": "private_memory", "start_va": 636329394176, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 636330442752, "type": "region", "version": 1 }, "end_va": 636330967039, "entry_point": 0, "filename": null, "id": "region_2341", "name": "private_0x0000009428400000", "norm_filename": null, "region_type": "private_memory", "start_va": 636330442752, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 636330967040, "type": "region", "version": 1 }, "end_va": 636332572671, "entry_point": 0, "filename": null, "id": "region_2342", "name": "pagefile_0x0000009428480000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 636330967040, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 636332605440, "type": "region", "version": 1 }, "end_va": 636334182399, "entry_point": 0, "filename": null, "id": "region_2343", "name": "pagefile_0x0000009428610000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 636332605440, "timestamp": "00:01:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 636334243840, "type": "region", "version": 1 }, "end_va": 636355215359, "entry_point": 0, "filename": null, "id": "region_2344", "name": "pagefile_0x00000094287a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 636334243840, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 636355215360, "type": "region", "version": 1 }, "end_va": 636358586367, "entry_point": 636355215360, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_2345", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 636355215360, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 636358623232, "type": "region", "version": 1 }, "end_va": 636359147519, "entry_point": 0, "filename": null, "id": "region_2346", "name": "private_0x0000009429ee0000", "norm_filename": null, "region_type": "private_memory", "start_va": 636358623232, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 636359147520, "type": "region", "version": 1 }, "end_va": 636359671807, "entry_point": 0, "filename": null, "id": "region_2347", "name": "private_0x0000009429f60000", "norm_filename": null, "region_type": "private_memory", "start_va": 636359147520, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 636359671808, "type": "region", "version": 1 }, "end_va": 636360196095, "entry_point": 0, "filename": null, "id": "region_2348", "name": "private_0x0000009429fe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 636359671808, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 636360720384, "type": "region", "version": 1 }, "end_va": 636361244671, "entry_point": 0, "filename": null, "id": "region_2349", "name": "private_0x000000942a0e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 636360720384, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 274432, "start_va": 636361244672, "type": "region", "version": 1 }, "end_va": 636361519103, "entry_point": 636361244672, "filename": "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000007.db", "id": "region_2350", "name": "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000007.db", "norm_filename": "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000007.db", "region_type": "memory_mapped_file", "start_va": 636361244672, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 636361572352, "type": "region", "version": 1 }, "end_va": 636361601023, "entry_point": 0, "filename": null, "id": "region_2351", "name": "private_0x000000942a1b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 636361572352, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 69632, "start_va": 636361637888, "type": "region", "version": 1 }, "end_va": 636361707519, "entry_point": 636361637888, "filename": "\\Windows\\System32\\en-US\\propsys.dll.mui", "id": "region_2352", "name": "propsys.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\propsys.dll.mui", "region_type": "memory_mapped_file", "start_va": 636361637888, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 636361900032, "type": "region", "version": 1 }, "end_va": 636362948607, "entry_point": 0, "filename": null, "id": "region_2353", "name": "private_0x000000942a200000", "norm_filename": null, "region_type": "private_memory", "start_va": 636361900032, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 636362948608, "type": "region", "version": 1 }, "end_va": 636363997183, "entry_point": 0, "filename": null, "id": "region_2354", "name": "private_0x000000942a300000", "norm_filename": null, "region_type": "private_memory", "start_va": 636362948608, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 636363997184, "type": "region", "version": 1 }, "end_va": 636364521471, "entry_point": 0, "filename": null, "id": "region_2355", "name": "private_0x000000942a400000", "norm_filename": null, "region_type": "private_memory", "start_va": 636363997184, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 913408, "start_va": 636365045760, "type": "region", "version": 1 }, "end_va": 636365959167, "entry_point": 636365045760, "filename": "\\Windows\\System32\\en-US\\KernelBase.dll.mui", "id": "region_2356", "name": "kernelbase.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\kernelbase.dll.mui", "region_type": "memory_mapped_file", "start_va": 636365045760, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 569344, "start_va": 636365963264, "type": "region", "version": 1 }, "end_va": 636366532607, "entry_point": 636365963264, "filename": "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db", "id": "region_2357", "name": "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db", "norm_filename": "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db", "region_type": "memory_mapped_file", "start_va": 636365963264, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "" ], "ref_process_dump": null, "size": 2199023255552, "start_va": 138495505137664, "type": "region", "version": 1 }, "end_va": 140694528393215, "entry_point": 0, "filename": null, "id": "region_2358", "name": "pagefile_0x00007df5ff630000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 138495505137664, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140699243544576, "type": "region", "version": 1 }, "end_va": 140699243552767, "entry_point": 0, "filename": null, "id": "region_2359", "name": "private_0x00007ff7186e8000", "norm_filename": null, "region_type": "private_memory", "start_va": 140699243544576, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140699243552768, "type": "region", "version": 1 }, "end_va": 140699243560959, "entry_point": 0, "filename": null, "id": "region_2360", "name": "private_0x00007ff7186ea000", "norm_filename": null, "region_type": "private_memory", "start_va": 140699243552768, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140699243569152, "type": "region", "version": 1 }, "end_va": 140699243577343, "entry_point": 0, "filename": null, "id": "region_2361", "name": "private_0x00007ff7186ee000", "norm_filename": null, "region_type": "private_memory", "start_va": 140699243569152, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 140699243577344, "type": "region", "version": 1 }, "end_va": 140699244625919, "entry_point": 0, "filename": null, "id": "region_2362", "name": "pagefile_0x00007ff7186f0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140699243577344, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 140699244625920, "type": "region", "version": 1 }, "end_va": 140699244769279, "entry_point": 0, "filename": null, "id": "region_2363", "name": "pagefile_0x00007ff7187f0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140699244625920, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 140699244773376, "type": "region", "version": 1 }, "end_va": 140699244777471, "entry_point": 0, "filename": null, "id": "region_2364", "name": "private_0x00007ff718814000", "norm_filename": null, "region_type": "private_memory", "start_va": 140699244773376, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140699244781568, "type": "region", "version": 1 }, "end_va": 140699244789759, "entry_point": 0, "filename": null, "id": "region_2365", "name": "private_0x00007ff718816000", "norm_filename": null, "region_type": "private_memory", "start_va": 140699244781568, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140699244789760, "type": "region", "version": 1 }, "end_va": 140699244797951, "entry_point": 0, "filename": null, "id": "region_2366", "name": "private_0x00007ff718818000", "norm_filename": null, "region_type": "private_memory", "start_va": 140699244789760, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140699244797952, "type": "region", "version": 1 }, "end_va": 140699244806143, "entry_point": 0, "filename": null, "id": "region_2367", "name": "private_0x00007ff71881a000", "norm_filename": null, "region_type": "private_memory", "start_va": 140699244797952, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140699244806144, "type": "region", "version": 1 }, "end_va": 140699244814335, "entry_point": 0, "filename": null, "id": "region_2368", "name": "private_0x00007ff71881c000", "norm_filename": null, "region_type": "private_memory", "start_va": 140699244806144, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140699244814336, "type": "region", "version": 1 }, "end_va": 140699244822527, "entry_point": 0, "filename": null, "id": "region_2369", "name": "private_0x00007ff71881e000", "norm_filename": null, "region_type": "private_memory", "start_va": 140699244814336, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 90112, "start_va": 140699258912768, "type": "region", "version": 1 }, "end_va": 140699259002879, "entry_point": 140699258912768, "filename": "\\Windows\\System32\\RuntimeBroker.exe", "id": "region_2370", "name": "runtimebroker.exe", "norm_filename": "c:\\windows\\system32\\runtimebroker.exe", "region_type": "memory_mapped_file", "start_va": 140699258912768, "timestamp": "00:01:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 8724480, "start_va": 140701621551104, "type": "region", "version": 1 }, "end_va": 140701630275583, "entry_point": 140701625610256, "filename": "\\Windows\\System32\\ntoskrnl.exe", "id": "region_2371", "name": "ntoskrnl.exe", "norm_filename": "c:\\windows\\system32\\ntoskrnl.exe", "region_type": "memory_mapped_file", "start_va": 140701621551104, "timestamp": "00:01:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 831488, "start_va": 140716650201088, "type": "region", "version": 1 }, "end_va": 140716651032575, "entry_point": 140716650201088, "filename": "\\Windows\\System32\\Windows.Storage.Search.dll", "id": "region_2372", "name": "windows.storage.search.dll", "norm_filename": "c:\\windows\\system32\\windows.storage.search.dll", "region_type": "memory_mapped_file", "start_va": 140716650201088, "timestamp": "00:01:03.871", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 749568, "start_va": 140716651053056, "type": "region", "version": 1 }, "end_va": 140716651802623, "entry_point": 140716651053056, "filename": "\\Windows\\System32\\StructuredQuery.dll", "id": "region_2373", "name": "structuredquery.dll", "norm_filename": "c:\\windows\\system32\\structuredquery.dll", "region_type": "memory_mapped_file", "start_va": 140716651053056, "timestamp": "00:01:03.873", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 598016, "start_va": 140716714426368, "type": "region", "version": 1 }, "end_va": 140716715024383, "entry_point": 140716714426368, "filename": "\\Windows\\System32\\Windows.Internal.Shell.Broker.dll", "id": "region_2374", "name": "windows.internal.shell.broker.dll", "norm_filename": "c:\\windows\\system32\\windows.internal.shell.broker.dll", "region_type": "memory_mapped_file", "start_va": 140716714426368, "timestamp": "00:01:03.874", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 90112, "start_va": 140716734676992, "type": "region", "version": 1 }, "end_va": 140716734767103, "entry_point": 140716734676992, "filename": "\\Windows\\System32\\wwapi.dll", "id": "region_2375", "name": "wwapi.dll", "norm_filename": "c:\\windows\\system32\\wwapi.dll", "region_type": "memory_mapped_file", "start_va": 140716734676992, "timestamp": "00:01:03.875", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 704512, "start_va": 140716734808064, "type": "region", "version": 1 }, "end_va": 140716735512575, "entry_point": 140716734808064, "filename": "\\Windows\\System32\\Windows.Networking.Connectivity.dll", "id": "region_2376", "name": "windows.networking.connectivity.dll", "norm_filename": "c:\\windows\\system32\\windows.networking.connectivity.dll", "region_type": "memory_mapped_file", "start_va": 140716734808064, "timestamp": "00:01:03.875", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 811008, "start_va": 140716768296960, "type": "region", "version": 1 }, "end_va": 140716769107967, "entry_point": 140716768296960, "filename": "\\Windows\\System32\\TokenBroker.dll", "id": "region_2377", "name": "tokenbroker.dll", "norm_filename": "c:\\windows\\system32\\tokenbroker.dll", "region_type": "memory_mapped_file", "start_va": 140716768296960, "timestamp": "00:01:03.875", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 274432, "start_va": 140716774981632, "type": "region", "version": 1 }, "end_va": 140716775256063, "entry_point": 140716774981632, "filename": "\\Windows\\System32\\ExecModelClient.dll", "id": "region_2378", "name": "execmodelclient.dll", "norm_filename": "c:\\windows\\system32\\execmodelclient.dll", "region_type": "memory_mapped_file", "start_va": 140716774981632, "timestamp": "00:01:03.875", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 192512, "start_va": 140716781535232, "type": "region", "version": 1 }, "end_va": 140716781727743, "entry_point": 140716781535232, "filename": "\\Windows\\System32\\edputil.dll", "id": "region_2379", "name": "edputil.dll", "norm_filename": "c:\\windows\\system32\\edputil.dll", "region_type": "memory_mapped_file", "start_va": 140716781535232, "timestamp": "00:01:03.876", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 4628480, "start_va": 140716782321664, "type": "region", "version": 1 }, "end_va": 140716786950143, "entry_point": 140716782321664, "filename": "\\Windows\\System32\\actxprxy.dll", "id": "region_2380", "name": "actxprxy.dll", "norm_filename": "c:\\windows\\system32\\actxprxy.dll", "region_type": "memory_mapped_file", "start_va": 140716782321664, "timestamp": "00:01:03.878", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 57344, "start_va": 140716794576896, "type": "region", "version": 1 }, "end_va": 140716794634239, "entry_point": 140716794576896, "filename": "\\Windows\\System32\\npmproxy.dll", "id": "region_2381", "name": "npmproxy.dll", "norm_filename": "c:\\windows\\system32\\npmproxy.dll", "region_type": "memory_mapped_file", "start_va": 140716794576896, "timestamp": "00:01:03.878", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 389120, "start_va": 140716795625472, "type": "region", "version": 1 }, "end_va": 140716796014591, "entry_point": 140716795625472, "filename": "\\Windows\\System32\\wlanapi.dll", "id": "region_2382", "name": "wlanapi.dll", "norm_filename": "c:\\windows\\system32\\wlanapi.dll", "region_type": "memory_mapped_file", "start_va": 140716795625472, "timestamp": "00:01:03.878", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 258048, "start_va": 140716812861440, "type": "region", "version": 1 }, "end_va": 140716813119487, "entry_point": 140716812861440, "filename": "\\Windows\\System32\\netprofm.dll", "id": "region_2383", "name": "netprofm.dll", "norm_filename": "c:\\windows\\system32\\netprofm.dll", "region_type": "memory_mapped_file", "start_va": 140716812861440, "timestamp": "00:01:03.878", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 159744, "start_va": 140716832522240, "type": "region", "version": 1 }, "end_va": 140716832681983, "entry_point": 140716832522240, "filename": "\\Windows\\System32\\IDStore.dll", "id": "region_2384", "name": "idstore.dll", "norm_filename": "c:\\windows\\system32\\idstore.dll", "region_type": "memory_mapped_file", "start_va": 140716832522240, "timestamp": "00:01:03.878", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 229376, "start_va": 140716833308672, "type": "region", "version": 1 }, "end_va": 140716833538047, "entry_point": 140716833308672, "filename": "\\Windows\\System32\\Windows.Networking.HostName.dll", "id": "region_2385", "name": "windows.networking.hostname.dll", "norm_filename": "c:\\windows\\system32\\windows.networking.hostname.dll", "region_type": "memory_mapped_file", "start_va": 140716833308672, "timestamp": "00:01:03.878", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1798144, "start_va": 140716844908544, "type": "region", "version": 1 }, "end_va": 140716846706687, "entry_point": 140716844908544, "filename": "\\Windows\\System32\\Windows.UI.Immersive.dll", "id": "region_2386", "name": "windows.ui.immersive.dll", "norm_filename": "c:\\windows\\system32\\windows.ui.immersive.dll", "region_type": "memory_mapped_file", "start_va": 140716844908544, "timestamp": "00:01:03.879", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 3629056, "start_va": 140716846743552, "type": "region", "version": 1 }, "end_va": 140716850372607, "entry_point": 140716846743552, "filename": "\\Windows\\System32\\iertutil.dll", "id": "region_2387", "name": "iertutil.dll", "norm_filename": "c:\\windows\\system32\\iertutil.dll", "region_type": "memory_mapped_file", "start_va": 140716846743552, "timestamp": "00:01:03.879", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1110016, "start_va": 140716867846144, "type": "region", "version": 1 }, "end_va": 140716868956159, "entry_point": 140716867846144, "filename": "\\Windows\\System32\\MrmCoreR.dll", "id": "region_2388", "name": "mrmcorer.dll", "norm_filename": "c:\\windows\\system32\\mrmcorer.dll", "region_type": "memory_mapped_file", "start_va": 140716867846144, "timestamp": "00:01:03.879", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 598016, "start_va": 140716903432192, "type": "region", "version": 1 }, "end_va": 140716904030207, "entry_point": 140716903432192, "filename": "\\Windows\\System32\\msvcp110_win.dll", "id": "region_2389", "name": "msvcp110_win.dll", "norm_filename": "c:\\windows\\system32\\msvcp110_win.dll", "region_type": "memory_mapped_file", "start_va": 140716903432192, "timestamp": "00:01:03.879", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 233472, "start_va": 140716904087552, "type": "region", "version": 1 }, "end_va": 140716904321023, "entry_point": 140716904087552, "filename": "\\Windows\\System32\\policymanager.dll", "id": "region_2390", "name": "policymanager.dll", "norm_filename": "c:\\windows\\system32\\policymanager.dll", "region_type": "memory_mapped_file", "start_va": 140716904087552, "timestamp": "00:01:03.879", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 221184, "start_va": 140716905594880, "type": "region", "version": 1 }, "end_va": 140716905816063, "entry_point": 140716905594880, "filename": "\\Windows\\System32\\xmllite.dll", "id": "region_2391", "name": "xmllite.dll", "norm_filename": "c:\\windows\\system32\\xmllite.dll", "region_type": "memory_mapped_file", "start_va": 140716905594880, "timestamp": "00:01:03.879", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1249280, "start_va": 140716922830848, "type": "region", "version": 1 }, "end_va": 140716924080127, "entry_point": 140716922830848, "filename": "\\Windows\\System32\\WinTypes.dll", "id": "region_2392", "name": "wintypes.dll", "norm_filename": "c:\\windows\\system32\\wintypes.dll", "region_type": "memory_mapped_file", "start_va": 140716922830848, "timestamp": "00:01:03.879", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 114688, "start_va": 140716924928000, "type": "region", "version": 1 }, "end_va": 140716925042687, "entry_point": 140716924928000, "filename": "\\Windows\\System32\\samlib.dll", "id": "region_2393", "name": "samlib.dll", "norm_filename": "c:\\windows\\system32\\samlib.dll", "region_type": "memory_mapped_file", "start_va": 140716924928000, "timestamp": "00:01:03.879", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 98304, "start_va": 140716926566400, "type": "region", "version": 1 }, "end_va": 140716926664703, "entry_point": 140716926566400, "filename": "\\Windows\\System32\\samcli.dll", "id": "region_2394", "name": "samcli.dll", "norm_filename": "c:\\windows\\system32\\samcli.dll", "region_type": "memory_mapped_file", "start_va": 140716926566400, "timestamp": "00:01:03.879", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1585152, "start_va": 140716929253376, "type": "region", "version": 1 }, "end_va": 140716930838527, "entry_point": 140716929253376, "filename": "\\Windows\\System32\\propsys.dll", "id": "region_2395", "name": "propsys.dll", "norm_filename": "c:\\windows\\system32\\propsys.dll", "region_type": "memory_mapped_file", "start_va": 140716929253376, "timestamp": "00:01:03.879", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 466944, "start_va": 140716930891776, "type": "region", "version": 1 }, "end_va": 140716931358719, "entry_point": 140716930891776, "filename": "\\Windows\\System32\\MMDevAPI.dll", "id": "region_2396", "name": "mmdevapi.dll", "norm_filename": "c:\\windows\\system32\\mmdevapi.dll", "region_type": "memory_mapped_file", "start_va": 140716930891776, "timestamp": "00:01:03.879", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 90112, "start_va": 140716932071424, "type": "region", "version": 1 }, "end_va": 140716932161535, "entry_point": 140716932071424, "filename": "\\Windows\\System32\\wkscli.dll", "id": "region_2397", "name": "wkscli.dll", "norm_filename": "c:\\windows\\system32\\wkscli.dll", "region_type": "memory_mapped_file", "start_va": 140716932071424, "timestamp": "00:01:03.879", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 45056, "start_va": 140716940394496, "type": "region", "version": 1 }, "end_va": 140716940439551, "entry_point": 140716940394496, "filename": "\\Windows\\System32\\winnsi.dll", "id": "region_2398", "name": "winnsi.dll", "norm_filename": "c:\\windows\\system32\\winnsi.dll", "region_type": "memory_mapped_file", "start_va": 140716940394496, "timestamp": "00:01:03.879", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 229376, "start_va": 140716940525568, "type": "region", "version": 1 }, "end_va": 140716940754943, "entry_point": 140716940525568, "filename": "\\Windows\\System32\\IPHLPAPI.DLL", "id": "region_2399", "name": "iphlpapi.dll", "norm_filename": "c:\\windows\\system32\\iphlpapi.dll", "region_type": "memory_mapped_file", "start_va": 140716940525568, "timestamp": "00:01:03.879", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 77824, "start_va": 140716947144704, "type": "region", "version": 1 }, "end_va": 140716947222527, "entry_point": 140716947144704, "filename": "\\Windows\\System32\\wtsapi32.dll", "id": "region_2400", "name": "wtsapi32.dll", "norm_filename": "c:\\windows\\system32\\wtsapi32.dll", "region_type": "memory_mapped_file", "start_va": 140716947144704, "timestamp": "00:01:03.879", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 151552, "start_va": 140716947734528, "type": "region", "version": 1 }, "end_va": 140716947886079, "entry_point": 140716947734528, "filename": "\\Windows\\System32\\sppc.dll", "id": "region_2401", "name": "sppc.dll", "norm_filename": "c:\\windows\\system32\\sppc.dll", "region_type": "memory_mapped_file", "start_va": 140716947734528, "timestamp": "00:01:03.879", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 155648, "start_va": 140716947931136, "type": "region", "version": 1 }, "end_va": 140716948086783, "entry_point": 140716947931136, "filename": "\\Windows\\System32\\slc.dll", "id": "region_2402", "name": "slc.dll", "norm_filename": "c:\\windows\\system32\\slc.dll", "region_type": "memory_mapped_file", "start_va": 140716947931136, "timestamp": "00:01:03.879", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 819200, "start_va": 140716953894912, "type": "region", "version": 1 }, "end_va": 140716954714111, "entry_point": 140716953894912, "filename": "\\Windows\\System32\\CoreMessaging.dll", "id": "region_2403", "name": "coremessaging.dll", "norm_filename": "c:\\windows\\system32\\coremessaging.dll", "region_type": "memory_mapped_file", "start_va": 140716953894912, "timestamp": "00:01:03.879", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 614400, "start_va": 140716959399936, "type": "region", "version": 1 }, "end_va": 140716960014335, "entry_point": 140716959399936, "filename": "\\Windows\\System32\\uxtheme.dll", "id": "region_2404", "name": "uxtheme.dll", "norm_filename": "c:\\windows\\system32\\uxtheme.dll", "region_type": "memory_mapped_file", "start_va": 140716959399936, "timestamp": "00:01:03.880", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 159744, "start_va": 140716960055296, "type": "region", "version": 1 }, "end_va": 140716960215039, "entry_point": 140716960055296, "filename": "\\Windows\\System32\\devobj.dll", "id": "region_2405", "name": "devobj.dll", "norm_filename": "c:\\windows\\system32\\devobj.dll", "region_type": "memory_mapped_file", "start_va": 140716960055296, "timestamp": "00:01:03.880", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 974848, "start_va": 140716961366016, "type": "region", "version": 1 }, "end_va": 140716962340863, "entry_point": 140716961366016, "filename": "\\Windows\\System32\\twinapi.appcore.dll", "id": "region_2406", "name": "twinapi.appcore.dll", "norm_filename": "c:\\windows\\system32\\twinapi.appcore.dll", "region_type": "memory_mapped_file", "start_va": 140716961366016, "timestamp": "00:01:03.880", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 140716969361408, "type": "region", "version": 1 }, "end_va": 140716969410559, "entry_point": 140716969361408, "filename": "\\Windows\\System32\\netutils.dll", "id": "region_2407", "name": "netutils.dll", "norm_filename": "c:\\windows\\system32\\netutils.dll", "region_type": "memory_mapped_file", "start_va": 140716969361408, "timestamp": "00:01:03.880", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 208896, "start_va": 140716972310528, "type": "region", "version": 1 }, "end_va": 140716972519423, "entry_point": 140716972310528, "filename": "\\Windows\\System32\\rsaenh.dll", "id": "region_2408", "name": "rsaenh.dll", "norm_filename": "c:\\windows\\system32\\rsaenh.dll", "region_type": "memory_mapped_file", "start_va": 140716972310528, "timestamp": "00:01:03.880", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 126976, "start_va": 140716973293568, "type": "region", "version": 1 }, "end_va": 140716973420543, "entry_point": 140716973293568, "filename": "\\Windows\\System32\\userenv.dll", "id": "region_2409", "name": "userenv.dll", "norm_filename": "c:\\windows\\system32\\userenv.dll", "region_type": "memory_mapped_file", "start_va": 140716973293568, "timestamp": "00:01:03.880", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 94208, "start_va": 140716976177152, "type": "region", "version": 1 }, "end_va": 140716976271359, "entry_point": 140716976177152, "filename": "\\Windows\\System32\\cryptsp.dll", "id": "region_2410", "name": "cryptsp.dll", "norm_filename": "c:\\windows\\system32\\cryptsp.dll", "region_type": "memory_mapped_file", "start_va": 140716976177152, "timestamp": "00:01:03.880", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 45056, "start_va": 140716977684480, "type": "region", "version": 1 }, "end_va": 140716977729535, "entry_point": 140716977684480, "filename": "\\Windows\\System32\\cryptbase.dll", "id": "region_2411", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\system32\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 140716977684480, "timestamp": "00:01:03.880", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 180224, "start_va": 140716979650560, "type": "region", "version": 1 }, "end_va": 140716979830783, "entry_point": 140716979650560, "filename": "\\Windows\\System32\\sspicli.dll", "id": "region_2412", "name": "sspicli.dll", "norm_filename": "c:\\windows\\system32\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 140716979650560, "timestamp": "00:01:03.880", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 163840, "start_va": 140716981747712, "type": "region", "version": 1 }, "end_va": 140716981911551, "entry_point": 140716981747712, "filename": "\\Windows\\System32\\bcrypt.dll", "id": "region_2413", "name": "bcrypt.dll", "norm_filename": "c:\\windows\\system32\\bcrypt.dll", "region_type": "memory_mapped_file", "start_va": 140716981747712, "timestamp": "00:01:03.880", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 438272, "start_va": 140716981944320, "type": "region", "version": 1 }, "end_va": 140716982382591, "entry_point": 140716981944320, "filename": "\\Windows\\System32\\bcryptprimitives.dll", "id": "region_2414", "name": "bcryptprimitives.dll", "norm_filename": "c:\\windows\\system32\\bcryptprimitives.dll", "region_type": "memory_mapped_file", "start_va": 140716981944320, "timestamp": "00:01:03.880", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 622592, "start_va": 140716982403072, "type": "region", "version": 1 }, "end_va": 140716983025663, "entry_point": 140716982403072, "filename": "\\Windows\\System32\\sxs.dll", "id": "region_2415", "name": "sxs.dll", "norm_filename": "c:\\windows\\system32\\sxs.dll", "region_type": "memory_mapped_file", "start_va": 140716982403072, "timestamp": "00:01:03.880", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 69632, "start_va": 140716983713792, "type": "region", "version": 1 }, "end_va": 140716983783423, "entry_point": 140716983713792, "filename": "\\Windows\\System32\\msasn1.dll", "id": "region_2416", "name": "msasn1.dll", "norm_filename": "c:\\windows\\system32\\msasn1.dll", "region_type": "memory_mapped_file", "start_va": 140716983713792, "timestamp": "00:01:03.880", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 61440, "start_va": 140716983844864, "type": "region", "version": 1 }, "end_va": 140716983906303, "entry_point": 140716983844864, "filename": "\\Windows\\System32\\kernel.appcore.dll", "id": "region_2417", "name": "kernel.appcore.dll", "norm_filename": "c:\\windows\\system32\\kernel.appcore.dll", "region_type": "memory_mapped_file", "start_va": 140716983844864, "timestamp": "00:01:03.880", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 77824, "start_va": 140716983910400, "type": "region", "version": 1 }, "end_va": 140716983988223, "entry_point": 140716983910400, "filename": "\\Windows\\System32\\profapi.dll", "id": "region_2418", "name": "profapi.dll", "norm_filename": "c:\\windows\\system32\\profapi.dll", "region_type": "memory_mapped_file", "start_va": 140716983910400, "timestamp": "00:01:03.880", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 303104, "start_va": 140716984041472, "type": "region", "version": 1 }, "end_va": 140716984344575, "entry_point": 140716984041472, "filename": "\\Windows\\System32\\powrprof.dll", "id": "region_2419", "name": "powrprof.dll", "norm_filename": "c:\\windows\\system32\\powrprof.dll", "region_type": "memory_mapped_file", "start_va": 140716984041472, "timestamp": "00:01:03.880", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 6455296, "start_va": 140716984369152, "type": "region", "version": 1 }, "end_va": 140716990824447, "entry_point": 140716984369152, "filename": "\\Windows\\System32\\windows.storage.dll", "id": "region_2420", "name": "windows.storage.dll", "norm_filename": "c:\\windows\\system32\\windows.storage.dll", "region_type": "memory_mapped_file", "start_va": 140716984369152, "timestamp": "00:01:03.880", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 140716990857216, "type": "region", "version": 1 }, "end_va": 140716991135743, "entry_point": 140716990857216, "filename": "\\Windows\\System32\\cfgmgr32.dll", "id": "region_2421", "name": "cfgmgr32.dll", "norm_filename": "c:\\windows\\system32\\cfgmgr32.dll", "region_type": "memory_mapped_file", "start_va": 140716990857216, "timestamp": "00:01:03.881", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 733184, "start_va": 140716992299008, "type": "region", "version": 1 }, "end_va": 140716993032191, "entry_point": 140716992299008, "filename": "\\Windows\\System32\\SHCore.dll", "id": "region_2422", "name": "shcore.dll", "norm_filename": "c:\\windows\\system32\\shcore.dll", "region_type": "memory_mapped_file", "start_va": 140716992299008, "timestamp": "00:01:03.881", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1839104, "start_va": 140716993085440, "type": "region", "version": 1 }, "end_va": 140716994924543, "entry_point": 140716993085440, "filename": "\\Windows\\System32\\crypt32.dll", "id": "region_2423", "name": "crypt32.dll", "norm_filename": "c:\\windows\\system32\\crypt32.dll", "region_type": "memory_mapped_file", "start_va": 140716993085440, "timestamp": "00:01:03.881", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1953792, "start_va": 140716994985984, "type": "region", "version": 1 }, "end_va": 140716996939775, "entry_point": 140716994985984, "filename": "\\Windows\\System32\\KernelBase.dll", "id": "region_2424", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\system32\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 140716994985984, "timestamp": "00:01:03.881", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 140716996952064, "type": "region", "version": 1 }, "end_va": 140716996984831, "entry_point": 140716996952064, "filename": "\\Windows\\System32\\nsi.dll", "id": "region_2425", "name": "nsi.dll", "norm_filename": "c:\\windows\\system32\\nsi.dll", "region_type": "memory_mapped_file", "start_va": 140716996952064, "timestamp": "00:01:03.881", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 331776, "start_va": 140716997017600, "type": "region", "version": 1 }, "end_va": 140716997349375, "entry_point": 140716997017600, "filename": "\\Windows\\System32\\shlwapi.dll", "id": "region_2426", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\system32\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 140716997017600, "timestamp": "00:01:03.881", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 22171648, "start_va": 140716997410816, "type": "region", "version": 1 }, "end_va": 140717019582463, "entry_point": 140716997410816, "filename": "\\Windows\\System32\\shell32.dll", "id": "region_2427", "name": "shell32.dll", "norm_filename": "c:\\windows\\system32\\shell32.dll", "region_type": "memory_mapped_file", "start_va": 140716997410816, "timestamp": "00:01:03.881", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1204224, "start_va": 140717019627520, "type": "region", "version": 1 }, "end_va": 140717020831743, "entry_point": 140717019627520, "filename": "\\Windows\\System32\\rpcrt4.dll", "id": "region_2428", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\system32\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 140717019627520, "timestamp": "00:01:03.882", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 221184, "start_va": 140717022838784, "type": "region", "version": 1 }, "end_va": 140717023059967, "entry_point": 140717022838784, "filename": "\\Windows\\System32\\imm32.dll", "id": "region_2429", "name": "imm32.dll", "norm_filename": "c:\\windows\\system32\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 140717022838784, "timestamp": "00:01:03.882", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 679936, "start_va": 140717023100928, "type": "region", "version": 1 }, "end_va": 140717023780863, "entry_point": 140717023100928, "filename": "\\Windows\\System32\\advapi32.dll", "id": "region_2430", "name": "advapi32.dll", "norm_filename": "c:\\windows\\system32\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 140717023100928, "timestamp": "00:01:03.882", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1593344, "start_va": 140717024215040, "type": "region", "version": 1 }, "end_va": 140717025808383, "entry_point": 140717024215040, "filename": "\\Windows\\System32\\gdi32.dll", "id": "region_2431", "name": "gdi32.dll", "norm_filename": "c:\\windows\\system32\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 140717024215040, "timestamp": "00:01:03.882", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1368064, "start_va": 140717026770944, "type": "region", "version": 1 }, "end_va": 140717028139007, "entry_point": 140717026770944, "filename": "\\Windows\\System32\\user32.dll", "id": "region_2432", "name": "user32.dll", "norm_filename": "c:\\windows\\system32\\user32.dll", "region_type": "memory_mapped_file", "start_va": 140717026770944, "timestamp": "00:01:03.882", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 372736, "start_va": 140717029916672, "type": "region", "version": 1 }, "end_va": 140717030289407, "entry_point": 140717029916672, "filename": "\\Windows\\System32\\sechost.dll", "id": "region_2433", "name": "sechost.dll", "norm_filename": "c:\\windows\\system32\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 140717029916672, "timestamp": "00:01:03.882", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 140717030309888, "type": "region", "version": 1 }, "end_va": 140717031088127, "entry_point": 140717030309888, "filename": "\\Windows\\System32\\oleaut32.dll", "id": "region_2434", "name": "oleaut32.dll", "norm_filename": "c:\\windows\\system32\\oleaut32.dll", "region_type": "memory_mapped_file", "start_va": 140717030309888, "timestamp": "00:01:03.882", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 675840, "start_va": 140717031096320, "type": "region", "version": 1 }, "end_va": 140717031772159, "entry_point": 140717031096320, "filename": "\\Windows\\System32\\clbcatq.dll", "id": "region_2435", "name": "clbcatq.dll", "norm_filename": "c:\\windows\\system32\\clbcatq.dll", "region_type": "memory_mapped_file", "start_va": 140717031096320, "timestamp": "00:01:03.882", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1314816, "start_va": 140717031817216, "type": "region", "version": 1 }, "end_va": 140717033132031, "entry_point": 140717031817216, "filename": "\\Windows\\System32\\ole32.dll", "id": "region_2436", "name": "ole32.dll", "norm_filename": "c:\\windows\\system32\\ole32.dll", "region_type": "memory_mapped_file", "start_va": 140717031817216, "timestamp": "00:01:03.882", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2605056, "start_va": 140717033193472, "type": "region", "version": 1 }, "end_va": 140717035798527, "entry_point": 140717033193472, "filename": "\\Windows\\System32\\combase.dll", "id": "region_2437", "name": "combase.dll", "norm_filename": "c:\\windows\\system32\\combase.dll", "region_type": "memory_mapped_file", "start_va": 140717033193472, "timestamp": "00:01:03.882", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 643072, "start_va": 140717035945984, "type": "region", "version": 1 }, "end_va": 140717036589055, "entry_point": 140717035945984, "filename": "\\Windows\\System32\\msvcrt.dll", "id": "region_2438", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\system32\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 140717035945984, "timestamp": "00:01:03.882", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1425408, "start_va": 140717037060096, "type": "region", "version": 1 }, "end_va": 140717038485503, "entry_point": 140717037060096, "filename": "\\Windows\\System32\\msctf.dll", "id": "region_2439", "name": "msctf.dll", "norm_filename": "c:\\windows\\system32\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 140717037060096, "timestamp": "00:01:03.882", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 708608, "start_va": 140717039419392, "type": "region", "version": 1 }, "end_va": 140717040127999, "entry_point": 140717039419392, "filename": "\\Windows\\System32\\kernel32.dll", "id": "region_2440", "name": "kernel32.dll", "norm_filename": "c:\\windows\\system32\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 140717039419392, "timestamp": "00:01:03.882", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140717040140288, "type": "region", "version": 1 }, "end_va": 140717041983487, "entry_point": 140717040140288, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_2441", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140717040140288, "timestamp": "00:01:03.883", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 598016, "start_va": 636366553088, "type": "region", "version": 1 }, "end_va": 636367151103, "entry_point": 0, "filename": null, "id": "region_2443", "name": "pagefile_0x000000942a670000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 636366553088, "timestamp": "00:01:04.033", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 4096, "start_va": 636329328640, "type": "region", "version": 1 }, "end_va": 636329332735, "entry_point": 0, "filename": null, "id": "region_2444", "name": "private_0x00000094282f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 636329328640, "timestamp": "00:01:04.043", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 430080, "start_va": 636360196096, "type": "region", "version": 1 }, "end_va": 636360626175, "entry_point": 0, "filename": null, "id": "region_2445", "name": "private_0x000000942a060000", "norm_filename": null, "region_type": "private_memory", "start_va": 636360196096, "timestamp": "00:01:04.078", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 2097152, "start_va": 636367208448, "type": "region", "version": 1 }, "end_va": 636369305599, "entry_point": 0, "filename": null, "id": "region_2446", "name": "private_0x000000942a710000", "norm_filename": null, "region_type": "private_memory", "start_va": 636367208448, "timestamp": "00:01:04.079", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 636368191488, "type": "region", "version": 1 }, "end_va": 636369240063, "entry_point": 0, "filename": null, "id": "region_2447", "name": "private_0x000000942a800000", "norm_filename": null, "region_type": "private_memory", "start_va": 636368191488, "timestamp": "00:01:04.079", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 2097152, "start_va": 636369240064, "type": "region", "version": 1 }, "end_va": 636371337215, "entry_point": 0, "filename": null, "id": "region_2448", "name": "private_0x000000942a900000", "norm_filename": null, "region_type": "private_memory", "start_va": 636369240064, "timestamp": "00:01:04.079", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 636369240064, "type": "region", "version": 1 }, "end_va": 636370288639, "entry_point": 0, "filename": null, "id": "region_2449", "name": "private_0x000000942a900000", "norm_filename": null, "region_type": "private_memory", "start_va": 636369240064, "timestamp": "00:01:04.080", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 2097152, "start_va": 636370288640, "type": "region", "version": 1 }, "end_va": 636372385791, "entry_point": 0, "filename": null, "id": "region_2450", "name": "private_0x000000942aa00000", "norm_filename": null, "region_type": "private_memory", "start_va": 636370288640, "timestamp": "00:01:04.080", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 636370288640, "type": "region", "version": 1 }, "end_va": 636371337215, "entry_point": 0, "filename": null, "id": "region_2451", "name": "private_0x000000942aa00000", "norm_filename": null, "region_type": "private_memory", "start_va": 636370288640, "timestamp": "00:01:04.080", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 2097152, "start_va": 636371337216, "type": "region", "version": 1 }, "end_va": 636373434367, "entry_point": 0, "filename": null, "id": "region_2452", "name": "private_0x000000942ab00000", "norm_filename": null, "region_type": "private_memory", "start_va": 636371337216, "timestamp": "00:01:04.081", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 636371337216, "type": "region", "version": 1 }, "end_va": 636372385791, "entry_point": 0, "filename": null, "id": "region_2453", "name": "private_0x000000942ab00000", "norm_filename": null, "region_type": "private_memory", "start_va": 636371337216, "timestamp": "00:01:04.081", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 636360196096, "type": "region", "version": 1 }, "end_va": 636360204287, "entry_point": 0, "filename": null, "id": "region_2454", "name": "private_0x000000942a060000", "norm_filename": null, "region_type": "private_memory", "start_va": 636360196096, "timestamp": "00:01:04.082", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 36864, "start_va": 636360589312, "type": "region", "version": 1 }, "end_va": 636360626175, "entry_point": 0, "filename": null, "id": "region_2455", "name": "private_0x000000942a0c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 636360589312, "timestamp": "00:01:04.082", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 140717036601344, "type": "region", "version": 1 }, "end_va": 140717036634111, "entry_point": 140717036601344, "filename": "\\Windows\\System32\\psapi.dll", "id": "region_2456", "name": "psapi.dll", "norm_filename": "c:\\windows\\system32\\psapi.dll", "region_type": "memory_mapped_file", "start_va": 140717036601344, "timestamp": "00:01:04.127", "type": "region", "version": 1 } ], "terminate_reason": "timeout", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "cmd /C \"nslookup myip.opendns.com resolver1.opendns.com > C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\A7BD.bi1\"", "filename": "c:\\windows\\system32\\cmd.exe", "id": "proc_11", "image_name": "cmd.exe", "monitor_reason": "child_process", "monitored_id": 11, "origin_monitor_id": 9, "ref_parent_process": { "ref_id": "proc_9", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_2941", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:01:18.641", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 131072, "start_va": 198735691776, "type": "region", "version": 1 }, "end_va": 198735822847, "entry_point": 0, "filename": null, "id": "region_2942", "name": "private_0x0000002e45920000", "norm_filename": null, "region_type": "private_memory", "start_va": 198735691776, "timestamp": "00:01:18.641", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 198735822848, "type": "region", "version": 1 }, "end_va": 198735904767, "entry_point": 0, "filename": null, "id": "region_2943", "name": "pagefile_0x0000002e45940000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 198735822848, "timestamp": "00:01:18.641", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 198735953920, "type": "region", "version": 1 }, "end_va": 198737002495, "entry_point": 0, "filename": null, "id": "region_2944", "name": "private_0x0000002e45960000", "norm_filename": null, "region_type": "private_memory", "start_va": 198735953920, "timestamp": "00:01:18.641", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 198737002496, "type": "region", "version": 1 }, "end_va": 198737018879, "entry_point": 0, "filename": null, "id": "region_2945", "name": "pagefile_0x0000002e45a60000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 198737002496, "timestamp": "00:01:18.641", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 198737068032, "type": "region", "version": 1 }, "end_va": 198737072127, "entry_point": 0, "filename": null, "id": "region_2946", "name": "pagefile_0x0000002e45a70000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 198737068032, "timestamp": "00:01:18.641", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 198737133568, "type": "region", "version": 1 }, "end_va": 198737141759, "entry_point": 0, "filename": null, "id": "region_2947", "name": "private_0x0000002e45a80000", "norm_filename": null, "region_type": "private_memory", "start_va": 198737133568, "timestamp": "00:01:18.641", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "" ], "ref_process_dump": null, "size": 2199023255552, "start_va": 138495509397504, "type": "region", "version": 1 }, "end_va": 140694532653055, "entry_point": 0, "filename": null, "id": "region_2948", "name": "pagefile_0x00007df5ffa40000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 138495509397504, "timestamp": "00:01:18.641", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 140697119227904, "type": "region", "version": 1 }, "end_va": 140697119371263, "entry_point": 0, "filename": null, "id": "region_2949", "name": "pagefile_0x00007ff699d00000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140697119227904, "timestamp": "00:01:18.641", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 140697119375360, "type": "region", "version": 1 }, "end_va": 140697119379455, "entry_point": 0, "filename": null, "id": "region_2950", "name": "private_0x00007ff699d24000", "norm_filename": null, "region_type": "private_memory", "start_va": 140697119375360, "timestamp": "00:01:18.641", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140697119416320, "type": "region", "version": 1 }, "end_va": 140697119424511, "entry_point": 0, "filename": null, "id": "region_2951", "name": "private_0x00007ff699d2e000", "norm_filename": null, "region_type": "private_memory", "start_va": 140697119416320, "timestamp": "00:01:18.641", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 364544, "start_va": 140697124470784, "type": "region", "version": 1 }, "end_va": 140697124835327, "entry_point": 140697124470784, "filename": "\\Windows\\System32\\cmd.exe", "id": "region_2952", "name": "cmd.exe", "norm_filename": "c:\\windows\\system32\\cmd.exe", "region_type": "memory_mapped_file", "start_va": 140697124470784, "timestamp": "00:01:18.641", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140717040140288, "type": "region", "version": 1 }, "end_va": 140717041983487, "entry_point": 140717040140288, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_2953", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140717040140288, "timestamp": "00:01:18.864", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 198735691776, "type": "region", "version": 1 }, "end_va": 198735757311, "entry_point": 0, "filename": null, "id": "region_2955", "name": "pagefile_0x0000002e45920000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 198735691776, "timestamp": "00:01:18.932", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 198737199104, "type": "region", "version": 1 }, "end_va": 198737977343, "entry_point": 198737199104, "filename": "\\Windows\\System32\\locale.nls", "id": "region_2956", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 198737199104, "timestamp": "00:01:18.932", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 198738247680, "type": "region", "version": 1 }, "end_va": 198739296255, "entry_point": 0, "filename": null, "id": "region_2957", "name": "private_0x0000002e45b90000", "norm_filename": null, "region_type": "private_memory", "start_va": 198738247680, "timestamp": "00:01:18.932", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 140697118179328, "type": "region", "version": 1 }, "end_va": 140697119227903, "entry_point": 0, "filename": null, "id": "region_2958", "name": "pagefile_0x00007ff699c00000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140697118179328, "timestamp": "00:01:18.932", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1953792, "start_va": 140716994985984, "type": "region", "version": 1 }, "end_va": 140716996939775, "entry_point": 140716994985984, "filename": "\\Windows\\System32\\KernelBase.dll", "id": "region_2959", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\system32\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 140716994985984, "timestamp": "00:01:18.932", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 708608, "start_va": 140717039419392, "type": "region", "version": 1 }, "end_va": 140717040127999, "entry_point": 140717039419392, "filename": "\\Windows\\System32\\kernel32.dll", "id": "region_2960", "name": "kernel32.dll", "norm_filename": "c:\\windows\\system32\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 140717039419392, "timestamp": "00:01:18.933", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 198735757312, "type": "region", "version": 1 }, "end_va": 198735785983, "entry_point": 0, "filename": null, "id": "region_3010", "name": "private_0x0000002e45930000", "norm_filename": null, "region_type": "private_memory", "start_va": 198735757312, "timestamp": "00:01:19.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 198739296256, "type": "region", "version": 1 }, "end_va": 198740344831, "entry_point": 0, "filename": null, "id": "region_3011", "name": "private_0x0000002e45c90000", "norm_filename": null, "region_type": "private_memory", "start_va": 198739296256, "timestamp": "00:01:19.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 198740606976, "type": "region", "version": 1 }, "end_va": 198740672511, "entry_point": 0, "filename": null, "id": "region_3012", "name": "private_0x0000002e45dd0000", "norm_filename": null, "region_type": "private_memory", "start_va": 198740606976, "timestamp": "00:01:19.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140697119408128, "type": "region", "version": 1 }, "end_va": 140697119416319, "entry_point": 0, "filename": null, "id": "region_3013", "name": "private_0x00007ff699d2c000", "norm_filename": null, "region_type": "private_memory", "start_va": 140697119408128, "timestamp": "00:01:19.558", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 643072, "start_va": 140717035945984, "type": "region", "version": 1 }, "end_va": 140717036589055, "entry_point": 140717035945984, "filename": "\\Windows\\System32\\msvcrt.dll", "id": "region_3014", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\system32\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 140717035945984, "timestamp": "00:01:19.559", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 198737985536, "type": "region", "version": 1 }, "end_va": 198738014207, "entry_point": 0, "filename": null, "id": "region_3029", "name": "private_0x0000002e45b50000", "norm_filename": null, "region_type": "private_memory", "start_va": 198737985536, "timestamp": "00:01:20.266", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 198740672512, "type": "region", "version": 1 }, "end_va": 198744043519, "entry_point": 198740672512, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_3034", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 198740672512, "timestamp": "00:01:20.407", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "nslookup myip.opendns.com resolver1.opendns.com ", "filename": "c:\\windows\\system32\\nslookup.exe", "id": "proc_13", "image_name": "nslookup.exe", "monitor_reason": "child_process", "monitored_id": 13, "origin_monitor_id": 11, "ref_parent_process": { "ref_id": "proc_11", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_3035", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:01:20.425", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 131072, "start_va": 331253350400, "type": "region", "version": 1 }, "end_va": 331253481471, "entry_point": 0, "filename": null, "id": "region_3036", "name": "private_0x0000004d203d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 331253350400, "timestamp": "00:01:20.425", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 331253481472, "type": "region", "version": 1 }, "end_va": 331253563391, "entry_point": 0, "filename": null, "id": "region_3037", "name": "pagefile_0x0000004d203f0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 331253481472, "timestamp": "00:01:20.425", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 331253612544, "type": "region", "version": 1 }, "end_va": 331254136831, "entry_point": 0, "filename": null, "id": "region_3038", "name": "private_0x0000004d20410000", "norm_filename": null, "region_type": "private_memory", "start_va": 331253612544, "timestamp": "00:01:20.425", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 331254136832, "type": "region", "version": 1 }, "end_va": 331254153215, "entry_point": 0, "filename": null, "id": "region_3039", "name": "pagefile_0x0000004d20490000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 331254136832, "timestamp": "00:01:20.425", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 331254202368, "type": "region", "version": 1 }, "end_va": 331254206463, "entry_point": 0, "filename": null, "id": "region_3040", "name": "pagefile_0x0000004d204a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 331254202368, "timestamp": "00:01:20.425", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 331254267904, "type": "region", "version": 1 }, "end_va": 331254276095, "entry_point": 0, "filename": null, "id": "region_3041", "name": "private_0x0000004d204b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 331254267904, "timestamp": "00:01:20.425", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "" ], "ref_process_dump": null, "size": 2199023255552, "start_va": 138495506513920, "type": "region", "version": 1 }, "end_va": 140694529769471, "entry_point": 0, "filename": null, "id": "region_3042", "name": "pagefile_0x00007df5ff780000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 138495506513920, "timestamp": "00:01:20.425", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 140695154458624, "type": "region", "version": 1 }, "end_va": 140695154601983, "entry_point": 0, "filename": null, "id": "region_3043", "name": "pagefile_0x00007ff624b40000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140695154458624, "timestamp": "00:01:20.425", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140695154638848, "type": "region", "version": 1 }, "end_va": 140695154647039, "entry_point": 0, "filename": null, "id": "region_3044", "name": "private_0x00007ff624b6c000", "norm_filename": null, "region_type": "private_memory", "start_va": 140695154638848, "timestamp": "00:01:20.425", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 140695154647040, "type": "region", "version": 1 }, "end_va": 140695154651135, "entry_point": 0, "filename": null, "id": "region_3045", "name": "private_0x00007ff624b6e000", "norm_filename": null, "region_type": "private_memory", "start_va": 140695154647040, "timestamp": "00:01:20.425", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 110592, "start_va": 140695167893504, "type": "region", "version": 1 }, "end_va": 140695168004095, "entry_point": 140695167893504, "filename": "\\Windows\\System32\\nslookup.exe", "id": "region_3046", "name": "nslookup.exe", "norm_filename": "c:\\windows\\system32\\nslookup.exe", "region_type": "memory_mapped_file", "start_va": 140695167893504, "timestamp": "00:01:20.425", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140717040140288, "type": "region", "version": 1 }, "end_va": 140717041983487, "entry_point": 140717040140288, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_3047", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140717040140288, "timestamp": "00:01:20.544", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 331253350400, "type": "region", "version": 1 }, "end_va": 331253415935, "entry_point": 0, "filename": null, "id": "region_3056", "name": "pagefile_0x0000004d203d0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 331253350400, "timestamp": "00:01:20.899", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 331253415936, "type": "region", "version": 1 }, "end_va": 331253444607, "entry_point": 0, "filename": null, "id": "region_3057", "name": "private_0x0000004d203e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 331253415936, "timestamp": "00:01:20.899", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 331254464512, "type": "region", "version": 1 }, "end_va": 331255513087, "entry_point": 0, "filename": null, "id": "region_3058", "name": "private_0x0000004d204e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 331254464512, "timestamp": "00:01:20.900", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 331255513088, "type": "region", "version": 1 }, "end_va": 331256291327, "entry_point": 331255513088, "filename": "\\Windows\\System32\\locale.nls", "id": "region_3059", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 331255513088, "timestamp": "00:01:20.900", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 331256299520, "type": "region", "version": 1 }, "end_va": 331256823807, "entry_point": 0, "filename": null, "id": "region_3060", "name": "private_0x0000004d206a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 331256299520, "timestamp": "00:01:20.900", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 331257741312, "type": "region", "version": 1 }, "end_va": 331257806847, "entry_point": 0, "filename": null, "id": "region_3061", "name": "private_0x0000004d20800000", "norm_filename": null, "region_type": "private_memory", "start_va": 331257741312, "timestamp": "00:01:20.900", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 140695153410048, "type": "region", "version": 1 }, "end_va": 140695154458623, "entry_point": 0, "filename": null, "id": "region_3062", "name": "pagefile_0x00007ff624a40000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140695153410048, "timestamp": "00:01:20.900", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140695154630656, "type": "region", "version": 1 }, "end_va": 140695154638847, "entry_point": 0, "filename": null, "id": "region_3063", "name": "private_0x00007ff624b6a000", "norm_filename": null, "region_type": "private_memory", "start_va": 140695154630656, "timestamp": "00:01:20.900", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 688128, "start_va": 140716973686784, "type": "region", "version": 1 }, "end_va": 140716974374911, "entry_point": 140716973686784, "filename": "\\Windows\\System32\\dnsapi.dll", "id": "region_3064", "name": "dnsapi.dll", "norm_filename": "c:\\windows\\system32\\dnsapi.dll", "region_type": "memory_mapped_file", "start_va": 140716973686784, "timestamp": "00:01:20.900", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 380928, "start_va": 140716975783936, "type": "region", "version": 1 }, "end_va": 140716976164863, "entry_point": 140716975783936, "filename": "\\Windows\\System32\\mswsock.dll", "id": "region_3065", "name": "mswsock.dll", "norm_filename": "c:\\windows\\system32\\mswsock.dll", "region_type": "memory_mapped_file", "start_va": 140716975783936, "timestamp": "00:01:20.900", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1953792, "start_va": 140716994985984, "type": "region", "version": 1 }, "end_va": 140716996939775, "entry_point": 140716994985984, "filename": "\\Windows\\System32\\KernelBase.dll", "id": "region_3066", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\system32\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 140716994985984, "timestamp": "00:01:20.900", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 140716996952064, "type": "region", "version": 1 }, "end_va": 140716996984831, "entry_point": 140716996952064, "filename": "\\Windows\\System32\\nsi.dll", "id": "region_3067", "name": "nsi.dll", "norm_filename": "c:\\windows\\system32\\nsi.dll", "region_type": "memory_mapped_file", "start_va": 140716996952064, "timestamp": "00:01:20.900", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1204224, "start_va": 140717019627520, "type": "region", "version": 1 }, "end_va": 140717020831743, "entry_point": 140717019627520, "filename": "\\Windows\\System32\\rpcrt4.dll", "id": "region_3068", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\system32\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 140717019627520, "timestamp": "00:01:20.900", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 430080, "start_va": 140717025853440, "type": "region", "version": 1 }, "end_va": 140717026283519, "entry_point": 140717025853440, "filename": "\\Windows\\System32\\ws2_32.dll", "id": "region_3069", "name": "ws2_32.dll", "norm_filename": "c:\\windows\\system32\\ws2_32.dll", "region_type": "memory_mapped_file", "start_va": 140717025853440, "timestamp": "00:01:20.900", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 372736, "start_va": 140717029916672, "type": "region", "version": 1 }, "end_va": 140717030289407, "entry_point": 140717029916672, "filename": "\\Windows\\System32\\sechost.dll", "id": "region_3070", "name": "sechost.dll", "norm_filename": "c:\\windows\\system32\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 140717029916672, "timestamp": "00:01:20.900", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 643072, "start_va": 140717035945984, "type": "region", "version": 1 }, "end_va": 140717036589055, "entry_point": 140717035945984, "filename": "\\Windows\\System32\\msvcrt.dll", "id": "region_3071", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\system32\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 140717035945984, "timestamp": "00:01:20.900", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 708608, "start_va": 140717039419392, "type": "region", "version": 1 }, "end_va": 140717040127999, "entry_point": 140717039419392, "filename": "\\Windows\\System32\\kernel32.dll", "id": "region_3072", "name": "kernel32.dll", "norm_filename": "c:\\windows\\system32\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 140717039419392, "timestamp": "00:01:20.900", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 331254333440, "type": "region", "version": 1 }, "end_va": 331254362111, "entry_point": 0, "filename": null, "id": "region_3073", "name": "private_0x0000004d204c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 331254333440, "timestamp": "00:01:20.903", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 86016, "start_va": 140716789792768, "type": "region", "version": 1 }, "end_va": 140716789878783, "entry_point": 140716789792768, "filename": "\\Windows\\System32\\NapiNSP.dll", "id": "region_3076", "name": "napinsp.dll", "norm_filename": "c:\\windows\\system32\\napinsp.dll", "region_type": "memory_mapped_file", "start_va": 140716789792768, "timestamp": "00:01:20.995", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 106496, "start_va": 140716789923840, "type": "region", "version": 1 }, "end_va": 140716790030335, "entry_point": 140716789923840, "filename": "\\Windows\\System32\\pnrpnsp.dll", "id": "region_3078", "name": "pnrpnsp.dll", "norm_filename": "c:\\windows\\system32\\pnrpnsp.dll", "region_type": "memory_mapped_file", "start_va": 140716789923840, "timestamp": "00:01:21.138", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 98304, "start_va": 140716940918784, "type": "region", "version": 1 }, "end_va": 140716941017087, "entry_point": 140716940918784, "filename": "\\Windows\\System32\\nlaapi.dll", "id": "region_3080", "name": "nlaapi.dll", "norm_filename": "c:\\windows\\system32\\nlaapi.dll", "region_type": "memory_mapped_file", "start_va": 140716940918784, "timestamp": "00:01:21.238", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1368064, "start_va": 140717026770944, "type": "region", "version": 1 }, "end_va": 140717028139007, "entry_point": 140717026770944, "filename": "\\Windows\\System32\\user32.dll", "id": "region_3081", "name": "user32.dll", "norm_filename": "c:\\windows\\system32\\user32.dll", "region_type": "memory_mapped_file", "start_va": 140717026770944, "timestamp": "00:01:21.239", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1593344, "start_va": 140717024215040, "type": "region", "version": 1 }, "end_va": 140717025808383, "entry_point": 140717024215040, "filename": "\\Windows\\System32\\gdi32.dll", "id": "region_3082", "name": "gdi32.dll", "norm_filename": "c:\\windows\\system32\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 140717024215040, "timestamp": "00:01:21.241", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 212992, "start_va": 331256823808, "type": "region", "version": 1 }, "end_va": 331257036799, "entry_point": 331256823808, "filename": "\\Windows\\System32\\imm32.dll", "id": "region_3083", "name": "imm32.dll", "norm_filename": "c:\\windows\\system32\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 331256823808, "timestamp": "00:01:21.244", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 331257806848, "type": "region", "version": 1 }, "end_va": 331259412479, "entry_point": 0, "filename": null, "id": "region_3084", "name": "pagefile_0x0000004d20810000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 331257806848, "timestamp": "00:01:21.244", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 221184, "start_va": 140717022838784, "type": "region", "version": 1 }, "end_va": 140717023059967, "entry_point": 140717022838784, "filename": "\\Windows\\System32\\imm32.dll", "id": "region_3085", "name": "imm32.dll", "norm_filename": "c:\\windows\\system32\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 140717022838784, "timestamp": "00:01:21.244", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1425408, "start_va": 140717037060096, "type": "region", "version": 1 }, "end_va": 140717038485503, "entry_point": 140717037060096, "filename": "\\Windows\\System32\\msctf.dll", "id": "region_3086", "name": "msctf.dll", "norm_filename": "c:\\windows\\system32\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 140717037060096, "timestamp": "00:01:21.246", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20480, "start_va": 331254398976, "type": "region", "version": 1 }, "end_va": 331254419455, "entry_point": 331254398976, "filename": "\\Windows\\System32\\en-US\\nslookup.exe.mui", "id": "region_3087", "name": "nslookup.exe.mui", "norm_filename": "c:\\windows\\system32\\en-us\\nslookup.exe.mui", "region_type": "memory_mapped_file", "start_va": 331254398976, "timestamp": "00:01:21.252", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 331259445248, "type": "region", "version": 1 }, "end_va": 331261022207, "entry_point": 0, "filename": null, "id": "region_3088", "name": "pagefile_0x0000004d209a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 331259445248, "timestamp": "00:01:21.258", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 331261083648, "type": "region", "version": 1 }, "end_va": 331282055167, "entry_point": 0, "filename": null, "id": "region_3089", "name": "pagefile_0x0000004d20b30000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 331261083648, "timestamp": "00:01:21.258", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 331256823808, "type": "region", "version": 1 }, "end_va": 331256827903, "entry_point": 0, "filename": null, "id": "region_3090", "name": "private_0x0000004d20720000", "norm_filename": null, "region_type": "private_memory", "start_va": 331256823808, "timestamp": "00:01:21.263", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 331256889344, "type": "region", "version": 1 }, "end_va": 331256893439, "entry_point": 0, "filename": null, "id": "region_3091", "name": "private_0x0000004d20730000", "norm_filename": null, "region_type": "private_memory", "start_va": 331256889344, "timestamp": "00:01:21.263", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 53248, "start_va": 140716790054912, "type": "region", "version": 1 }, "end_va": 140716790108159, "entry_point": 140716790054912, "filename": "\\Windows\\System32\\winrnr.dll", "id": "region_3092", "name": "winrnr.dll", "norm_filename": "c:\\windows\\system32\\winrnr.dll", "region_type": "memory_mapped_file", "start_va": 140716790054912, "timestamp": "00:01:21.264", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 140716828000256, "type": "region", "version": 1 }, "end_va": 140716828041215, "entry_point": 140716828000256, "filename": "\\Windows\\System32\\rasadhlp.dll", "id": "region_3094", "name": "rasadhlp.dll", "norm_filename": "c:\\windows\\system32\\rasadhlp.dll", "region_type": "memory_mapped_file", "start_va": 140716828000256, "timestamp": "00:01:21.470", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 229376, "start_va": 140716940525568, "type": "region", "version": 1 }, "end_va": 140716940754943, "entry_point": 140716940525568, "filename": "\\Windows\\System32\\IPHLPAPI.DLL", "id": "region_3095", "name": "iphlpapi.dll", "norm_filename": "c:\\windows\\system32\\iphlpapi.dll", "region_type": "memory_mapped_file", "start_va": 140716940525568, "timestamp": "00:01:21.472", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 45056, "start_va": 140716940394496, "type": "region", "version": 1 }, "end_va": 140716940439551, "entry_point": 140716940394496, "filename": "\\Windows\\System32\\winnsi.dll", "id": "region_3096", "name": "winnsi.dll", "norm_filename": "c:\\windows\\system32\\winnsi.dll", "region_type": "memory_mapped_file", "start_va": 140716940394496, "timestamp": "00:01:21.473", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 425984, "start_va": 140716921454592, "type": "region", "version": 1 }, "end_va": 140716921880575, "entry_point": 140716921454592, "filename": "\\Windows\\System32\\FWPUCLNT.DLL", "id": "region_3099", "name": "fwpuclnt.dll", "norm_filename": "c:\\windows\\system32\\fwpuclnt.dll", "region_type": "memory_mapped_file", "start_va": 140716921454592, "timestamp": "00:01:21.575", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 163840, "start_va": 140716981747712, "type": "region", "version": 1 }, "end_va": 140716981911551, "entry_point": 140716981747712, "filename": "\\Windows\\System32\\bcrypt.dll", "id": "region_3100", "name": "bcrypt.dll", "norm_filename": "c:\\windows\\system32\\bcrypt.dll", "region_type": "memory_mapped_file", "start_va": 140716981747712, "timestamp": "00:01:21.576", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "cmd /C \"echo -------- >> C:\\Users\\CIIHMN~1\\AppData\\Local\\Temp\\A7BD.bi1\"", "filename": "c:\\windows\\system32\\cmd.exe", "id": "proc_14", "image_name": "cmd.exe", "monitor_reason": "child_process", "monitored_id": 14, "origin_monitor_id": 9, "ref_parent_process": { "ref_id": "proc_9", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_3129", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:01:22.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 131072, "start_va": 408809046016, "type": "region", "version": 1 }, "end_va": 408809177087, "entry_point": 0, "filename": null, "id": "region_3130", "name": "private_0x0000005f2eeb0000", "norm_filename": null, "region_type": "private_memory", "start_va": 408809046016, "timestamp": "00:01:22.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 408809177088, "type": "region", "version": 1 }, "end_va": 408809259007, "entry_point": 0, "filename": null, "id": "region_3131", "name": "pagefile_0x0000005f2eed0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 408809177088, "timestamp": "00:01:22.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 408809308160, "type": "region", "version": 1 }, "end_va": 408810356735, "entry_point": 0, "filename": null, "id": "region_3132", "name": "private_0x0000005f2eef0000", "norm_filename": null, "region_type": "private_memory", "start_va": 408809308160, "timestamp": "00:01:22.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 408810356736, "type": "region", "version": 1 }, "end_va": 408810373119, "entry_point": 0, "filename": null, "id": "region_3133", "name": "pagefile_0x0000005f2eff0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 408810356736, "timestamp": "00:01:22.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 408810422272, "type": "region", "version": 1 }, "end_va": 408810426367, "entry_point": 0, "filename": null, "id": "region_3134", "name": "pagefile_0x0000005f2f000000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 408810422272, "timestamp": "00:01:22.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 408810487808, "type": "region", "version": 1 }, "end_va": 408810495999, "entry_point": 0, "filename": null, "id": "region_3135", "name": "private_0x0000005f2f010000", "norm_filename": null, "region_type": "private_memory", "start_va": 408810487808, "timestamp": "00:01:22.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "" ], "ref_process_dump": null, "size": 2199023255552, "start_va": 138495504613376, "type": "region", "version": 1 }, "end_va": 140694527868927, "entry_point": 0, "filename": null, "id": "region_3136", "name": "pagefile_0x00007df5ff5b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 138495504613376, "timestamp": "00:01:22.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 140697118244864, "type": "region", "version": 1 }, "end_va": 140697118388223, "entry_point": 0, "filename": null, "id": "region_3137", "name": "pagefile_0x00007ff699c10000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140697118244864, "timestamp": "00:01:22.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 140697118408704, "type": "region", "version": 1 }, "end_va": 140697118412799, "entry_point": 0, "filename": null, "id": "region_3138", "name": "private_0x00007ff699c38000", "norm_filename": null, "region_type": "private_memory", "start_va": 140697118408704, "timestamp": "00:01:22.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140697118433280, "type": "region", "version": 1 }, "end_va": 140697118441471, "entry_point": 0, "filename": null, "id": "region_3139", "name": "private_0x00007ff699c3e000", "norm_filename": null, "region_type": "private_memory", "start_va": 140697118433280, "timestamp": "00:01:22.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 364544, "start_va": 140697124470784, "type": "region", "version": 1 }, "end_va": 140697124835327, "entry_point": 140697124470784, "filename": "\\Windows\\System32\\cmd.exe", "id": "region_3140", "name": "cmd.exe", "norm_filename": "c:\\windows\\system32\\cmd.exe", "region_type": "memory_mapped_file", "start_va": 140697124470784, "timestamp": "00:01:22.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140717040140288, "type": "region", "version": 1 }, "end_va": 140717041983487, "entry_point": 140717040140288, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_3141", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140717040140288, "timestamp": "00:01:22.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 408811274240, "type": "region", "version": 1 }, "end_va": 408812322815, "entry_point": 0, "filename": null, "id": "region_3142", "name": "private_0x0000005f2f0d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 408811274240, "timestamp": "00:01:22.921", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1953792, "start_va": 140716994985984, "type": "region", "version": 1 }, "end_va": 140716996939775, "entry_point": 140716994985984, "filename": "\\Windows\\System32\\KernelBase.dll", "id": "region_3143", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\system32\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 140716994985984, "timestamp": "00:01:22.921", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 708608, "start_va": 140717039419392, "type": "region", "version": 1 }, "end_va": 140717040127999, "entry_point": 140717039419392, "filename": "\\Windows\\System32\\kernel32.dll", "id": "region_3144", "name": "kernel32.dll", "norm_filename": "c:\\windows\\system32\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 140717039419392, "timestamp": "00:01:22.922", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 408809046016, "type": "region", "version": 1 }, "end_va": 408809111551, "entry_point": 0, "filename": null, "id": "region_3192", "name": "pagefile_0x0000005f2eeb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 408809046016, "timestamp": "00:01:23.363", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 408809111552, "type": "region", "version": 1 }, "end_va": 408809140223, "entry_point": 0, "filename": null, "id": "region_3193", "name": "private_0x0000005f2eec0000", "norm_filename": null, "region_type": "private_memory", "start_va": 408809111552, "timestamp": "00:01:23.363", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 408812322816, "type": "region", "version": 1 }, "end_va": 408813101055, "entry_point": 408812322816, "filename": "\\Windows\\System32\\locale.nls", "id": "region_3194", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 408812322816, "timestamp": "00:01:23.363", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 408813109248, "type": "region", "version": 1 }, "end_va": 408814157823, "entry_point": 0, "filename": null, "id": "region_3195", "name": "private_0x0000005f2f290000", "norm_filename": null, "region_type": "private_memory", "start_va": 408813109248, "timestamp": "00:01:23.363", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 408815796224, "type": "region", "version": 1 }, "end_va": 408815861759, "entry_point": 0, "filename": null, "id": "region_3196", "name": "private_0x0000005f2f520000", "norm_filename": null, "region_type": "private_memory", "start_va": 408815796224, "timestamp": "00:01:23.363", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 140697117196288, "type": "region", "version": 1 }, "end_va": 140697118244863, "entry_point": 0, "filename": null, "id": "region_3197", "name": "pagefile_0x00007ff699b10000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140697117196288, "timestamp": "00:01:23.363", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140697118425088, "type": "region", "version": 1 }, "end_va": 140697118433279, "entry_point": 0, "filename": null, "id": "region_3198", "name": "private_0x00007ff699c3c000", "norm_filename": null, "region_type": "private_memory", "start_va": 140697118425088, "timestamp": "00:01:23.363", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 643072, "start_va": 140717035945984, "type": "region", "version": 1 }, "end_va": 140717036589055, "entry_point": 140717035945984, "filename": "\\Windows\\System32\\msvcrt.dll", "id": "region_3199", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\system32\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 140717035945984, "timestamp": "00:01:23.363", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 408810553344, "type": "region", "version": 1 }, "end_va": 408810582015, "entry_point": 0, "filename": null, "id": "region_3203", "name": "private_0x0000005f2f020000", "norm_filename": null, "region_type": "private_memory", "start_va": 408810553344, "timestamp": "00:01:24.015", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "\"C:\\Program Files\\Windows Mail\\WinMail\" OCInstallUserConfigOE", "filename": "c:\\program files\\windows mail\\winmail.exe", "id": "proc_16", "image_name": "winmail.exe", "monitor_reason": "child_process", "monitored_id": 16, "origin_monitor_id": 9, "ref_parent_process": { "ref_id": "proc_9", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_3282", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:01:25.447", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 131072, "start_va": 544056737792, "type": "region", "version": 1 }, "end_va": 544056868863, "entry_point": 0, "filename": null, "id": "region_3283", "name": "private_0x0000007eac4f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 544056737792, "timestamp": "00:01:25.447", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 544056868864, "type": "region", "version": 1 }, "end_va": 544056950783, "entry_point": 0, "filename": null, "id": "region_3284", "name": "pagefile_0x0000007eac510000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 544056868864, "timestamp": "00:01:25.447", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 544056999936, "type": "region", "version": 1 }, "end_va": 544057524223, "entry_point": 0, "filename": null, "id": "region_3285", "name": "private_0x0000007eac530000", "norm_filename": null, "region_type": "private_memory", "start_va": 544056999936, "timestamp": "00:01:25.447", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 544057524224, "type": "region", "version": 1 }, "end_va": 544057540607, "entry_point": 0, "filename": null, "id": "region_3286", "name": "pagefile_0x0000007eac5b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 544057524224, "timestamp": "00:01:25.447", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 544057589760, "type": "region", "version": 1 }, "end_va": 544057597951, "entry_point": 0, "filename": null, "id": "region_3287", "name": "pagefile_0x0000007eac5c0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 544057589760, "timestamp": "00:01:25.447", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 544057655296, "type": "region", "version": 1 }, "end_va": 544057663487, "entry_point": 0, "filename": null, "id": "region_3288", "name": "private_0x0000007eac5d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 544057655296, "timestamp": "00:01:25.447", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "" ], "ref_process_dump": null, "size": 2199023255552, "start_va": 138495500091392, "type": "region", "version": 1 }, "end_va": 140694523346943, "entry_point": 0, "filename": null, "id": "region_3289", "name": "pagefile_0x00007df5ff160000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 138495500091392, "timestamp": "00:01:25.447", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 140699546943488, "type": "region", "version": 1 }, "end_va": 140699547086847, "entry_point": 0, "filename": null, "id": "region_3290", "name": "pagefile_0x00007ff72a840000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140699546943488, "timestamp": "00:01:25.447", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140699547127808, "type": "region", "version": 1 }, "end_va": 140699547135999, "entry_point": 0, "filename": null, "id": "region_3291", "name": "private_0x00007ff72a86d000", "norm_filename": null, "region_type": "private_memory", "start_va": 140699547127808, "timestamp": "00:01:25.447", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 140699547136000, "type": "region", "version": 1 }, "end_va": 140699547140095, "entry_point": 0, "filename": null, "id": "region_3292", "name": "private_0x00007ff72a86f000", "norm_filename": null, "region_type": "private_memory", "start_va": 140699547136000, "timestamp": "00:01:25.447", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 434176, "start_va": 140699560312832, "type": "region", "version": 1 }, "end_va": 140699560747007, "entry_point": 140699560312832, "filename": "\\Program Files\\Windows Mail\\WinMail.exe", "id": "region_3293", "name": "winmail.exe", "norm_filename": "c:\\program files\\windows mail\\winmail.exe", "region_type": "memory_mapped_file", "start_va": 140699560312832, "timestamp": "00:01:25.448", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140717040140288, "type": "region", "version": 1 }, "end_va": 140717041983487, "entry_point": 140717040140288, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_3294", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140717040140288, "timestamp": "00:01:25.537", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 544056737792, "type": "region", "version": 1 }, "end_va": 544056803327, "entry_point": 0, "filename": null, "id": "region_3305", "name": "pagefile_0x0000007eac4f0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 544056737792, "timestamp": "00:01:26.074", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 544056803328, "type": "region", "version": 1 }, "end_va": 544056831999, "entry_point": 0, "filename": null, "id": "region_3306", "name": "private_0x0000007eac500000", "norm_filename": null, "region_type": "private_memory", "start_va": 544056803328, "timestamp": "00:01:26.074", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 544057720832, "type": "region", "version": 1 }, "end_va": 544058245119, "entry_point": 0, "filename": null, "id": "region_3307", "name": "private_0x0000007eac5e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 544057720832, "timestamp": "00:01:26.074", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 544058245120, "type": "region", "version": 1 }, "end_va": 544058273791, "entry_point": 0, "filename": null, "id": "region_3308", "name": "private_0x0000007eac660000", "norm_filename": null, "region_type": "private_memory", "start_va": 544058245120, "timestamp": "00:01:26.074", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 544058310656, "type": "region", "version": 1 }, "end_va": 544058318847, "entry_point": 544058310656, "filename": "\\Program Files\\Windows Mail\\en-US\\WinMail.exe.mui", "id": "region_3309", "name": "winmail.exe.mui", "norm_filename": "c:\\program files\\windows mail\\en-us\\winmail.exe.mui", "region_type": "memory_mapped_file", "start_va": 544058310656, "timestamp": "00:01:26.075", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 544058376192, "type": "region", "version": 1 }, "end_va": 544058380287, "entry_point": 0, "filename": null, "id": "region_3310", "name": "private_0x0000007eac680000", "norm_filename": null, "region_type": "private_memory", "start_va": 544058376192, "timestamp": "00:01:26.075", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 544058441728, "type": "region", "version": 1 }, "end_va": 544059490303, "entry_point": 0, "filename": null, "id": "region_3311", "name": "private_0x0000007eac690000", "norm_filename": null, "region_type": "private_memory", "start_va": 544058441728, "timestamp": "00:01:26.075", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 544059490304, "type": "region", "version": 1 }, "end_va": 544060268543, "entry_point": 544059490304, "filename": "\\Windows\\System32\\locale.nls", "id": "region_3312", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 544059490304, "timestamp": "00:01:26.075", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 544060276736, "type": "region", "version": 1 }, "end_va": 544060280831, "entry_point": 0, "filename": null, "id": "region_3313", "name": "private_0x0000007eac850000", "norm_filename": null, "region_type": "private_memory", "start_va": 544060276736, "timestamp": "00:01:26.075", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 544061784064, "type": "region", "version": 1 }, "end_va": 544061849599, "entry_point": 0, "filename": null, "id": "region_3314", "name": "private_0x0000007eac9c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 544061784064, "timestamp": "00:01:26.075", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 544061849600, "type": "region", "version": 1 }, "end_va": 544063455231, "entry_point": 0, "filename": null, "id": "region_3315", "name": "pagefile_0x0000007eac9d0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 544061849600, "timestamp": "00:01:26.075", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 544063488000, "type": "region", "version": 1 }, "end_va": 544065064959, "entry_point": 0, "filename": null, "id": "region_3316", "name": "pagefile_0x0000007eacb60000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 544063488000, "timestamp": "00:01:26.075", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 544065126400, "type": "region", "version": 1 }, "end_va": 544086097919, "entry_point": 0, "filename": null, "id": "region_3317", "name": "pagefile_0x0000007eaccf0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 544065126400, "timestamp": "00:01:26.075", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 140699545894912, "type": "region", "version": 1 }, "end_va": 140699546943487, "entry_point": 0, "filename": null, "id": "region_3318", "name": "pagefile_0x00007ff72a740000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140699545894912, "timestamp": "00:01:26.075", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140699547119616, "type": "region", "version": 1 }, "end_va": 140699547127807, "entry_point": 0, "filename": null, "id": "region_3319", "name": "private_0x00007ff72a86b000", "norm_filename": null, "region_type": "private_memory", "start_va": 140699547119616, "timestamp": "00:01:26.075", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 163840, "start_va": 140716635848704, "type": "region", "version": 1 }, "end_va": 140716636012543, "entry_point": 140716635848704, "filename": "\\Windows\\System32\\msoert2.dll", "id": "region_3320", "name": "msoert2.dll", "norm_filename": "c:\\windows\\system32\\msoert2.dll", "region_type": "memory_mapped_file", "start_va": 140716635848704, "timestamp": "00:01:26.075", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 61440, "start_va": 140716983844864, "type": "region", "version": 1 }, "end_va": 140716983906303, "entry_point": 140716983844864, "filename": "\\Windows\\System32\\kernel.appcore.dll", "id": "region_3321", "name": "kernel.appcore.dll", "norm_filename": "c:\\windows\\system32\\kernel.appcore.dll", "region_type": "memory_mapped_file", "start_va": 140716983844864, "timestamp": "00:01:26.075", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 77824, "start_va": 140716983910400, "type": "region", "version": 1 }, "end_va": 140716983988223, "entry_point": 140716983910400, "filename": "\\Windows\\System32\\profapi.dll", "id": "region_3322", "name": "profapi.dll", "norm_filename": "c:\\windows\\system32\\profapi.dll", "region_type": "memory_mapped_file", "start_va": 140716983910400, "timestamp": "00:01:26.075", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 303104, "start_va": 140716984041472, "type": "region", "version": 1 }, "end_va": 140716984344575, "entry_point": 140716984041472, "filename": "\\Windows\\System32\\powrprof.dll", "id": "region_3323", "name": "powrprof.dll", "norm_filename": "c:\\windows\\system32\\powrprof.dll", "region_type": "memory_mapped_file", "start_va": 140716984041472, "timestamp": "00:01:26.075", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 6455296, "start_va": 140716984369152, "type": "region", "version": 1 }, "end_va": 140716990824447, "entry_point": 140716984369152, "filename": "\\Windows\\System32\\windows.storage.dll", "id": "region_3324", "name": "windows.storage.dll", "norm_filename": "c:\\windows\\system32\\windows.storage.dll", "region_type": "memory_mapped_file", "start_va": 140716984369152, "timestamp": "00:01:26.075", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 733184, "start_va": 140716992299008, "type": "region", "version": 1 }, "end_va": 140716993032191, "entry_point": 140716992299008, "filename": "\\Windows\\System32\\SHCore.dll", "id": "region_3325", "name": "shcore.dll", "norm_filename": "c:\\windows\\system32\\shcore.dll", "region_type": "memory_mapped_file", "start_va": 140716992299008, "timestamp": "00:01:26.076", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1953792, "start_va": 140716994985984, "type": "region", "version": 1 }, "end_va": 140716996939775, "entry_point": 140716994985984, "filename": "\\Windows\\System32\\KernelBase.dll", "id": "region_3326", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\system32\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 140716994985984, "timestamp": "00:01:26.076", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 331776, "start_va": 140716997017600, "type": "region", "version": 1 }, "end_va": 140716997349375, "entry_point": 140716997017600, "filename": "\\Windows\\System32\\shlwapi.dll", "id": "region_3327", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\system32\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 140716997017600, "timestamp": "00:01:26.076", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 22171648, "start_va": 140716997410816, "type": "region", "version": 1 }, "end_va": 140717019582463, "entry_point": 140716997410816, "filename": "\\Windows\\System32\\shell32.dll", "id": "region_3328", "name": "shell32.dll", "norm_filename": "c:\\windows\\system32\\shell32.dll", "region_type": "memory_mapped_file", "start_va": 140716997410816, "timestamp": "00:01:26.076", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1204224, "start_va": 140717019627520, "type": "region", "version": 1 }, "end_va": 140717020831743, "entry_point": 140717019627520, "filename": "\\Windows\\System32\\rpcrt4.dll", "id": "region_3329", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\system32\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 140717019627520, "timestamp": "00:01:26.076", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 221184, "start_va": 140717022838784, "type": "region", "version": 1 }, "end_va": 140717023059967, "entry_point": 140717022838784, "filename": "\\Windows\\System32\\imm32.dll", "id": "region_3330", "name": "imm32.dll", "norm_filename": "c:\\windows\\system32\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 140717022838784, "timestamp": "00:01:26.076", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 679936, "start_va": 140717023100928, "type": "region", "version": 1 }, "end_va": 140717023780863, "entry_point": 140717023100928, "filename": "\\Windows\\System32\\advapi32.dll", "id": "region_3331", "name": "advapi32.dll", "norm_filename": "c:\\windows\\system32\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 140717023100928, "timestamp": "00:01:26.076", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1593344, "start_va": 140717024215040, "type": "region", "version": 1 }, "end_va": 140717025808383, "entry_point": 140717024215040, "filename": "\\Windows\\System32\\gdi32.dll", "id": "region_3332", "name": "gdi32.dll", "norm_filename": "c:\\windows\\system32\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 140717024215040, "timestamp": "00:01:26.076", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1368064, "start_va": 140717026770944, "type": "region", "version": 1 }, "end_va": 140717028139007, "entry_point": 140717026770944, "filename": "\\Windows\\System32\\user32.dll", "id": "region_3333", "name": "user32.dll", "norm_filename": "c:\\windows\\system32\\user32.dll", "region_type": "memory_mapped_file", "start_va": 140717026770944, "timestamp": "00:01:26.076", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 372736, "start_va": 140717029916672, "type": "region", "version": 1 }, "end_va": 140717030289407, "entry_point": 140717029916672, "filename": "\\Windows\\System32\\sechost.dll", "id": "region_3334", "name": "sechost.dll", "norm_filename": "c:\\windows\\system32\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 140717029916672, "timestamp": "00:01:26.076", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 140717030309888, "type": "region", "version": 1 }, "end_va": 140717031088127, "entry_point": 140717030309888, "filename": "\\Windows\\System32\\oleaut32.dll", "id": "region_3335", "name": "oleaut32.dll", "norm_filename": "c:\\windows\\system32\\oleaut32.dll", "region_type": "memory_mapped_file", "start_va": 140717030309888, "timestamp": "00:01:26.076", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1314816, "start_va": 140717031817216, "type": "region", "version": 1 }, "end_va": 140717033132031, "entry_point": 140717031817216, "filename": "\\Windows\\System32\\ole32.dll", "id": "region_3336", "name": "ole32.dll", "norm_filename": "c:\\windows\\system32\\ole32.dll", "region_type": "memory_mapped_file", "start_va": 140717031817216, "timestamp": "00:01:26.077", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2605056, "start_va": 140717033193472, "type": "region", "version": 1 }, "end_va": 140717035798527, "entry_point": 140717033193472, "filename": "\\Windows\\System32\\combase.dll", "id": "region_3337", "name": "combase.dll", "norm_filename": "c:\\windows\\system32\\combase.dll", "region_type": "memory_mapped_file", "start_va": 140717033193472, "timestamp": "00:01:26.077", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 643072, "start_va": 140717035945984, "type": "region", "version": 1 }, "end_va": 140717036589055, "entry_point": 140717035945984, "filename": "\\Windows\\System32\\msvcrt.dll", "id": "region_3338", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\system32\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 140717035945984, "timestamp": "00:01:26.077", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1425408, "start_va": 140717037060096, "type": "region", "version": 1 }, "end_va": 140717038485503, "entry_point": 140717037060096, "filename": "\\Windows\\System32\\msctf.dll", "id": "region_3339", "name": "msctf.dll", "norm_filename": "c:\\windows\\system32\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 140717037060096, "timestamp": "00:01:26.077", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 708608, "start_va": 140717039419392, "type": "region", "version": 1 }, "end_va": 140717040127999, "entry_point": 140717039419392, "filename": "\\Windows\\System32\\kernel32.dll", "id": "region_3340", "name": "kernel32.dll", "norm_filename": "c:\\windows\\system32\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 140717039419392, "timestamp": "00:01:26.077", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 544060407808, "type": "region", "version": 1 }, "end_va": 544060415999, "entry_point": 0, "filename": null, "id": "region_3342", "name": "pagefile_0x0000007eac870000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 544060407808, "timestamp": "00:01:26.258", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 544060473344, "type": "region", "version": 1 }, "end_va": 544060481535, "entry_point": 0, "filename": null, "id": "region_3343", "name": "pagefile_0x0000007eac880000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 544060473344, "timestamp": "00:01:26.258", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 598016, "start_va": 544060538880, "type": "region", "version": 1 }, "end_va": 544061136895, "entry_point": 0, "filename": null, "id": "region_3344", "name": "pagefile_0x0000007eac890000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 544060538880, "timestamp": "00:01:26.258", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2572288, "start_va": 140716899303424, "type": "region", "version": 1 }, "end_va": 140716901875711, "entry_point": 140716899303424, "filename": "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll", "id": "region_3345", "name": "comctl32.dll", "norm_filename": "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_f41f7b285750ef43\\comctl32.dll", "region_type": "memory_mapped_file", "start_va": 140716899303424, "timestamp": "00:01:26.259", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 4096, "start_va": 544060342272, "type": "region", "version": 1 }, "end_va": 544060346367, "entry_point": 0, "filename": null, "id": "region_3346", "name": "private_0x0000007eac860000", "norm_filename": null, "region_type": "private_memory", "start_va": 544060342272, "timestamp": "00:01:26.361", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4325376, "start_va": 544086097920, "type": "region", "version": 1 }, "end_va": 544090423295, "entry_point": 0, "filename": null, "id": "region_3347", "name": "private_0x0000007eae0f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 544086097920, "timestamp": "00:01:26.383", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 544061194240, "type": "region", "version": 1 }, "end_va": 544061202431, "entry_point": 0, "filename": null, "id": "region_3348", "name": "private_0x0000007eac930000", "norm_filename": null, "region_type": "private_memory", "start_va": 544061194240, "timestamp": "00:01:26.391", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 180224, "start_va": 140716979650560, "type": "region", "version": 1 }, "end_va": 140716979830783, "entry_point": 140716979650560, "filename": "\\Windows\\System32\\sspicli.dll", "id": "region_3349", "name": "sspicli.dll", "norm_filename": "c:\\windows\\system32\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 140716979650560, "timestamp": "00:01:26.405", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 544090423296, "type": "region", "version": 1 }, "end_va": 544093794303, "entry_point": 544090423296, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_3351", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 544090423296, "timestamp": "00:01:26.478", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 140717036601344, "type": "region", "version": 1 }, "end_va": 140717036634111, "entry_point": 140717036601344, "filename": "\\Windows\\System32\\psapi.dll", "id": "region_3352", "name": "psapi.dll", "norm_filename": "c:\\windows\\system32\\psapi.dll", "region_type": "memory_mapped_file", "start_va": 140717036601344, "timestamp": "00:01:26.501", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 544061194240, "type": "region", "version": 1 }, "end_va": 544061222911, "entry_point": 0, "filename": null, "id": "region_3353", "name": "private_0x0000007eac930000", "norm_filename": null, "region_type": "private_memory", "start_va": 544061194240, "timestamp": "00:01:26.599", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "\"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Amsisigd\\Chakmcat.exe\" ", "filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\amsisigd\\chakmcat.exe", "id": "proc_17", "image_name": "chakmcat.exe", "monitor_reason": "autostart", "monitored_id": 17, "origin_monitor_id": 0, "ref_parent_process": null, "regions": [ { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 131072, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 196607, "entry_point": 0, "filename": null, "id": "region_3422", "name": "private_0x0000000000010000", "norm_filename": null, "region_type": "private_memory", "start_va": 65536, "timestamp": "00:02:00.294", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 204799, "entry_point": 0, "filename": null, "id": "region_3423", "name": "private_0x0000000000030000", "norm_filename": null, "region_type": "private_memory", "start_va": 196608, "timestamp": "00:02:00.294", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 262144, "type": "region", "version": 1 }, "end_va": 344063, "entry_point": 0, "filename": null, "id": "region_3424", "name": "pagefile_0x0000000000040000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 262144, "timestamp": "00:02:00.294", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 393216, "type": "region", "version": 1 }, "end_va": 655359, "entry_point": 0, "filename": null, "id": "region_3425", "name": "private_0x0000000000060000", "norm_filename": null, "region_type": "private_memory", "start_va": 393216, "timestamp": "00:02:00.294", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 655360, "type": "region", "version": 1 }, "end_va": 1703935, "entry_point": 0, "filename": null, "id": "region_3426", "name": "private_0x00000000000a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 655360, "timestamp": "00:02:00.295", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 663552, "start_va": 4194304, "type": "region", "version": 1 }, "end_va": 4857855, "entry_point": 4194304, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Amsisigd\\Chakmcat.exe", "id": "region_3427", "name": "chakmcat.exe", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\amsisigd\\chakmcat.exe", "region_type": "memory_mapped_file", "start_va": 4194304, "timestamp": "00:02:00.295", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1544192, "start_va": 2000420864, "type": "region", "version": 1 }, "end_va": 2001965055, "entry_point": 2000420864, "filename": "\\Windows\\SysWOW64\\ntdll.dll", "id": "region_3428", "name": "ntdll.dll", "norm_filename": "c:\\windows\\syswow64\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 2000420864, "timestamp": "00:02:00.320", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 2147155968, "type": "region", "version": 1 }, "end_va": 2147299327, "entry_point": 0, "filename": null, "id": "region_3429", "name": "pagefile_0x000000007ffb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2147155968, "timestamp": "00:02:00.320", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2147332096, "type": "region", "version": 1 }, "end_va": 2147344383, "entry_point": 0, "filename": null, "id": "region_3430", "name": "private_0x000000007ffdb000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147332096, "timestamp": "00:02:00.320", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2147344384, "type": "region", "version": 1 }, "end_va": 2147348479, "entry_point": 0, "filename": null, "id": "region_3431", "name": "private_0x000000007ffde000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147344384, "timestamp": "00:02:00.320", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2147348480, "type": "region", "version": 1 }, "end_va": 2147352575, "entry_point": 0, "filename": null, "id": "region_3432", "name": "private_0x000000007ffdf000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147348480, "timestamp": "00:02:00.320", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_3433", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:02:00.320", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 140715600576512, "start_va": 2147418112, "type": "region", "version": 1 }, "end_va": 140717747994623, "entry_point": 0, "filename": null, "id": "region_3434", "name": "private_0x000000007fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147418112, "timestamp": "00:02:00.320", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140717747994624, "type": "region", "version": 1 }, "end_va": 140717749837823, "entry_point": 140717747994624, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_3435", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140717747994624, "timestamp": "00:02:00.320", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 19738451968, "start_va": 140717749837824, "type": "region", "version": 1 }, "end_va": 140737488289791, "entry_point": 0, "filename": null, "id": "region_3436", "name": "private_0x00007ffb677e2000", "norm_filename": null, "region_type": "private_memory", "start_va": 140717749837824, "timestamp": "00:02:00.320", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 1703936, "type": "region", "version": 1 }, "end_va": 1720319, "entry_point": 0, "filename": null, "id": "region_3575", "name": "pagefile_0x00000000001a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1703936, "timestamp": "00:02:00.522", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 1769472, "type": "region", "version": 1 }, "end_va": 1773567, "entry_point": 0, "filename": null, "id": "region_3576", "name": "pagefile_0x00000000001b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1769472, "timestamp": "00:02:00.522", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 1835008, "type": "region", "version": 1 }, "end_va": 1843199, "entry_point": 0, "filename": null, "id": "region_3577", "name": "private_0x00000000001c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1835008, "timestamp": "00:02:00.522", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 3866624, "type": "region", "version": 1 }, "end_va": 3932159, "entry_point": 0, "filename": null, "id": "region_3578", "name": "private_0x00000000003b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 3866624, "timestamp": "00:02:00.522", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 471040, "start_va": 1695481856, "type": "region", "version": 1 }, "end_va": 1695952895, "entry_point": 1695481856, "filename": "\\Windows\\System32\\wow64win.dll", "id": "region_3579", "name": "wow64win.dll", "norm_filename": "c:\\windows\\system32\\wow64win.dll", "region_type": "memory_mapped_file", "start_va": 1695481856, "timestamp": "00:02:00.522", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 323584, "start_va": 1696071680, "type": "region", "version": 1 }, "end_va": 1696395263, "entry_point": 1696071680, "filename": "\\Windows\\System32\\wow64.dll", "id": "region_3580", "name": "wow64.dll", "norm_filename": "c:\\windows\\system32\\wow64.dll", "region_type": "memory_mapped_file", "start_va": 1696071680, "timestamp": "00:02:00.522", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1696006144, "type": "region", "version": 1 }, "end_va": 1696038911, "entry_point": 1696006144, "filename": "\\Windows\\System32\\wow64cpu.dll", "id": "region_3581", "name": "wow64cpu.dll", "norm_filename": "c:\\windows\\system32\\wow64cpu.dll", "region_type": "memory_mapped_file", "start_va": 1696006144, "timestamp": "00:02:00.534", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 6356992, "type": "region", "version": 1 }, "end_va": 7405567, "entry_point": 0, "filename": null, "id": "region_3582", "name": "private_0x0000000000610000", "norm_filename": null, "region_type": "private_memory", "start_va": 6356992, "timestamp": "00:02:00.681", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1531904, "start_va": 1951727616, "type": "region", "version": 1 }, "end_va": 1953259519, "entry_point": 1951727616, "filename": "\\Windows\\SysWOW64\\KernelBase.dll", "id": "region_3583", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\syswow64\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 1951727616, "timestamp": "00:02:00.681", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 983040, "start_va": 1981022208, "type": "region", "version": 1 }, "end_va": 1982005247, "entry_point": 1981022208, "filename": "\\Windows\\SysWOW64\\kernel32.dll", "id": "region_3584", "name": "kernel32.dll", "norm_filename": "c:\\windows\\syswow64\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1981022208, "timestamp": "00:02:00.681", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 65536, "type": "region", "version": 1 }, "end_va": 131071, "entry_point": 0, "filename": null, "id": "region_3585", "name": "pagefile_0x0000000000010000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 65536, "timestamp": "00:02:00.723", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 1900544, "type": "region", "version": 1 }, "end_va": 2678783, "entry_point": 1900544, "filename": "\\Windows\\System32\\locale.nls", "id": "region_3586", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 1900544, "timestamp": "00:02:00.723", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 593920, "start_va": 1950089216, "type": "region", "version": 1 }, "end_va": 1950683135, "entry_point": 1950089216, "filename": "\\Windows\\SysWOW64\\apphelp.dll", "id": "region_3587", "name": "apphelp.dll", "norm_filename": "c:\\windows\\syswow64\\apphelp.dll", "region_type": "memory_mapped_file", "start_va": 1950089216, "timestamp": "00:02:00.723", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2146107392, "type": "region", "version": 1 }, "end_va": 2147155967, "entry_point": 0, "filename": null, "id": "region_3588", "name": "pagefile_0x000000007feb0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2146107392, "timestamp": "00:02:00.723", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 131072, "type": "region", "version": 1 }, "end_va": 147455, "entry_point": 0, "filename": null, "id": "region_3589", "name": "private_0x0000000000020000", "norm_filename": null, "region_type": "private_memory", "start_va": 131072, "timestamp": "00:02:00.768", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 2686976, "type": "region", "version": 1 }, "end_va": 2949119, "entry_point": 0, "filename": null, "id": "region_3590", "name": "private_0x0000000000290000", "norm_filename": null, "region_type": "private_memory", "start_va": 2686976, "timestamp": "00:02:00.768", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 4915200, "type": "region", "version": 1 }, "end_va": 5963775, "entry_point": 0, "filename": null, "id": "region_3591", "name": "private_0x00000000004b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 4915200, "timestamp": "00:02:00.768", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1310720, "start_va": 1977352192, "type": "region", "version": 1 }, "end_va": 1978662911, "entry_point": 1977352192, "filename": "\\Windows\\SysWOW64\\user32.dll", "id": "region_3592", "name": "user32.dll", "norm_filename": "c:\\windows\\syswow64\\user32.dll", "region_type": "memory_mapped_file", "start_va": 1977352192, "timestamp": "00:02:00.768", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1363968, "start_va": 1979318272, "type": "region", "version": 1 }, "end_va": 1980682239, "entry_point": 1979318272, "filename": "\\Windows\\SysWOW64\\gdi32.dll", "id": "region_3593", "name": "gdi32.dll", "norm_filename": "c:\\windows\\syswow64\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 1979318272, "timestamp": "00:02:00.768", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2147319808, "type": "region", "version": 1 }, "end_va": 2147332095, "entry_point": 0, "filename": null, "id": "region_3594", "name": "private_0x000000007ffd8000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147319808, "timestamp": "00:02:00.768", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 7405568, "type": "region", "version": 1 }, "end_va": 9011199, "entry_point": 0, "filename": null, "id": "region_3595", "name": "pagefile_0x0000000000710000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 7405568, "timestamp": "00:02:00.776", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 176128, "start_va": 1977155584, "type": "region", "version": 1 }, "end_va": 1977331711, "entry_point": 1977155584, "filename": "\\Windows\\SysWOW64\\imm32.dll", "id": "region_3596", "name": "imm32.dll", "norm_filename": "c:\\windows\\syswow64\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 1977155584, "timestamp": "00:02:00.777", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1179648, "start_va": 1982005248, "type": "region", "version": 1 }, "end_va": 1983184895, "entry_point": 1982005248, "filename": "\\Windows\\SysWOW64\\msctf.dll", "id": "region_3597", "name": "msctf.dll", "norm_filename": "c:\\windows\\syswow64\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 1982005248, "timestamp": "00:02:00.777", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 1992556544, "type": "region", "version": 1 }, "end_va": 1993334783, "entry_point": 1992556544, "filename": "\\Windows\\SysWOW64\\msvcrt.dll", "id": "region_3598", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\syswow64\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 1992556544, "timestamp": "00:02:00.777", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 196608, "type": "region", "version": 1 }, "end_va": 200703, "entry_point": 0, "filename": null, "id": "region_3599", "name": "private_0x0000000000030000", "norm_filename": null, "region_type": "private_memory", "start_va": 196608, "timestamp": "00:02:00.784", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2949120, "type": "region", "version": 1 }, "end_va": 2953215, "entry_point": 0, "filename": null, "id": "region_3600", "name": "private_0x00000000002d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2949120, "timestamp": "00:02:00.784", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 10092544, "type": "region", "version": 1 }, "end_va": 10158079, "entry_point": 0, "filename": null, "id": "region_3601", "name": "private_0x00000000009a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 10092544, "timestamp": "00:02:00.784", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 10158080, "type": "region", "version": 1 }, "end_va": 11735039, "entry_point": 0, "filename": null, "id": "region_3602", "name": "pagefile_0x00000000009b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 10158080, "timestamp": "00:02:00.784", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 11796480, "type": "region", "version": 1 }, "end_va": 32767999, "entry_point": 0, "filename": null, "id": "region_3603", "name": "pagefile_0x0000000000b40000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 11796480, "timestamp": "00:02:00.784", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1114112, "start_va": 32768000, "type": "region", "version": 1 }, "end_va": 33882111, "entry_point": 0, "filename": null, "id": "region_3604", "name": "private_0x0000000001f40000", "norm_filename": null, "region_type": "private_memory", "start_va": 32768000, "timestamp": "00:02:00.784", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 380928, "start_va": 3014656, "type": "region", "version": 1 }, "end_va": 3395583, "entry_point": 0, "filename": null, "id": "region_3605", "name": "private_0x00000000002e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 3014656, "timestamp": "00:02:01.803", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 233472, "start_va": 3407872, "type": "region", "version": 1 }, "end_va": 3641343, "entry_point": 0, "filename": null, "id": "region_3606", "name": "private_0x0000000000340000", "norm_filename": null, "region_type": "private_memory", "start_va": 3407872, "timestamp": "00:02:01.817", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 4096, "start_va": 3670016, "type": "region", "version": 1 }, "end_va": 3674111, "entry_point": 0, "filename": null, "id": "region_3607", "name": "private_0x0000000000380000", "norm_filename": null, "region_type": "private_memory", "start_va": 3670016, "timestamp": "00:02:01.820", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 233472, "start_va": 3932160, "type": "region", "version": 1 }, "end_va": 4165631, "entry_point": 0, "filename": null, "id": "region_3608", "name": "private_0x00000000003c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 3932160, "timestamp": "00:02:01.821", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 1984823296, "type": "region", "version": 1 }, "end_va": 1985101823, "entry_point": 1984823296, "filename": "\\Windows\\SysWOW64\\shlwapi.dll", "id": "region_3609", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\syswow64\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 1984823296, "timestamp": "00:02:01.842", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1810432, "start_va": 1995440128, "type": "region", "version": 1 }, "end_va": 1997250559, "entry_point": 1995440128, "filename": "\\Windows\\SysWOW64\\combase.dll", "id": "region_3610", "name": "combase.dll", "norm_filename": "c:\\windows\\syswow64\\combase.dll", "region_type": "memory_mapped_file", "start_va": 1995440128, "timestamp": "00:02:01.844", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 704512, "start_va": 1999044608, "type": "region", "version": 1 }, "end_va": 1999749119, "entry_point": 1999044608, "filename": "\\Windows\\SysWOW64\\rpcrt4.dll", "id": "region_3611", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\syswow64\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 1999044608, "timestamp": "00:02:01.845", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 122880, "start_va": 1951203328, "type": "region", "version": 1 }, "end_va": 1951326207, "entry_point": 1951203328, "filename": "\\Windows\\SysWOW64\\sspicli.dll", "id": "region_3612", "name": "sspicli.dll", "norm_filename": "c:\\windows\\syswow64\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 1951203328, "timestamp": "00:02:01.846", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 1951137792, "type": "region", "version": 1 }, "end_va": 1951178751, "entry_point": 1951137792, "filename": "\\Windows\\SysWOW64\\cryptbase.dll", "id": "region_3613", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\syswow64\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 1951137792, "timestamp": "00:02:01.847", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 364544, "start_va": 1950744576, "type": "region", "version": 1 }, "end_va": 1951109119, "entry_point": 1950744576, "filename": "\\Windows\\SysWOW64\\bcryptprimitives.dll", "id": "region_3614", "name": "bcryptprimitives.dll", "norm_filename": "c:\\windows\\syswow64\\bcryptprimitives.dll", "region_type": "memory_mapped_file", "start_va": 1950744576, "timestamp": "00:02:01.848", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 274432, "start_va": 1999765504, "type": "region", "version": 1 }, "end_va": 2000039935, "entry_point": 1999765504, "filename": "\\Windows\\SysWOW64\\sechost.dll", "id": "region_3615", "name": "sechost.dll", "norm_filename": "c:\\windows\\syswow64\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 1999765504, "timestamp": "00:02:01.849", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 503808, "start_va": 1976631296, "type": "region", "version": 1 }, "end_va": 1977135103, "entry_point": 1976631296, "filename": "\\Windows\\SysWOW64\\advapi32.dll", "id": "region_3616", "name": "advapi32.dll", "norm_filename": "c:\\windows\\syswow64\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 1976631296, "timestamp": "00:02:01.883", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 20705280, "start_va": 1955135488, "type": "region", "version": 1 }, "end_va": 1975840767, "entry_point": 1955135488, "filename": "\\Windows\\SysWOW64\\shell32.dll", "id": "region_3617", "name": "shell32.dll", "norm_filename": "c:\\windows\\syswow64\\shell32.dll", "region_type": "memory_mapped_file", "start_va": 1955135488, "timestamp": "00:02:01.886", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 5099520, "start_va": 1987379200, "type": "region", "version": 1 }, "end_va": 1992478719, "entry_point": 1987379200, "filename": "\\Windows\\SysWOW64\\windows.storage.dll", "id": "region_3618", "name": "windows.storage.dll", "norm_filename": "c:\\windows\\syswow64\\windows.storage.dll", "region_type": "memory_mapped_file", "start_va": 1987379200, "timestamp": "00:02:01.887", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 1985150976, "type": "region", "version": 1 }, "end_va": 1985200127, "entry_point": 1985150976, "filename": "\\Windows\\SysWOW64\\kernel.appcore.dll", "id": "region_3619", "name": "kernel.appcore.dll", "norm_filename": "c:\\windows\\syswow64\\kernel.appcore.dll", "region_type": "memory_mapped_file", "start_va": 1985150976, "timestamp": "00:02:01.888", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 577536, "start_va": 1998454784, "type": "region", "version": 1 }, "end_va": 1999032319, "entry_point": 1998454784, "filename": "\\Windows\\SysWOW64\\SHCore.dll", "id": "region_3620", "name": "shcore.dll", "norm_filename": "c:\\windows\\syswow64\\shcore.dll", "region_type": "memory_mapped_file", "start_va": 1998454784, "timestamp": "00:02:01.889", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 1975844864, "type": "region", "version": 1 }, "end_va": 1976123391, "entry_point": 1975844864, "filename": "\\Windows\\SysWOW64\\powrprof.dll", "id": "region_3621", "name": "powrprof.dll", "norm_filename": "c:\\windows\\syswow64\\powrprof.dll", "region_type": "memory_mapped_file", "start_va": 1975844864, "timestamp": "00:02:01.890", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 61440, "start_va": 1992491008, "type": "region", "version": 1 }, "end_va": 1992552447, "entry_point": 1992491008, "filename": "\\Windows\\SysWOW64\\profapi.dll", "id": "region_3622", "name": "profapi.dll", "norm_filename": "c:\\windows\\syswow64\\profapi.dll", "region_type": "memory_mapped_file", "start_va": 1992491008, "timestamp": "00:02:01.891", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 958464, "start_va": 1983184896, "type": "region", "version": 1 }, "end_va": 1984143359, "entry_point": 1983184896, "filename": "\\Windows\\SysWOW64\\ole32.dll", "id": "region_3623", "name": "ole32.dll", "norm_filename": "c:\\windows\\syswow64\\ole32.dll", "region_type": "memory_mapped_file", "start_va": 1983184896, "timestamp": "00:02:01.897", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 593920, "start_va": 9043968, "type": "region", "version": 1 }, "end_va": 9637887, "entry_point": 9043968, "filename": "\\Windows\\SysWOW64\\oleaut32.dll", "id": "region_3624", "name": "oleaut32.dll", "norm_filename": "c:\\windows\\syswow64\\oleaut32.dll", "region_type": "memory_mapped_file", "start_va": 9043968, "timestamp": "00:02:01.900", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4849664, "start_va": 33882112, "type": "region", "version": 1 }, "end_va": 38731775, "entry_point": 0, "filename": null, "id": "region_3625", "name": "private_0x0000000002050000", "norm_filename": null, "region_type": "private_memory", "start_va": 33882112, "timestamp": "00:02:01.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 3735552, "type": "region", "version": 1 }, "end_va": 3739647, "entry_point": 0, "filename": null, "id": "region_3626", "name": "private_0x0000000000390000", "norm_filename": null, "region_type": "private_memory", "start_va": 3735552, "timestamp": "00:02:01.919", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 38731776, "type": "region", "version": 1 }, "end_va": 42102783, "entry_point": 38731776, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_4019", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 38731776, "timestamp": "00:02:03.117", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 9043968, "type": "region", "version": 1 }, "end_va": 10092543, "entry_point": 0, "filename": null, "id": "region_4020", "name": "private_0x00000000008a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 9043968, "timestamp": "00:02:03.138", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1843200, "start_va": 42139648, "type": "region", "version": 1 }, "end_va": 43982847, "entry_point": 0, "filename": null, "id": "region_4036", "name": "private_0x0000000002830000", "norm_filename": null, "region_type": "private_memory", "start_va": 42139648, "timestamp": "00:02:03.144", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 598016, "start_va": 32768000, "type": "region", "version": 1 }, "end_va": 33366015, "entry_point": 0, "filename": null, "id": "region_4054", "name": "pagefile_0x0000000001f40000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 32768000, "timestamp": "00:02:03.473", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 33816576, "type": "region", "version": 1 }, "end_va": 33882111, "entry_point": 0, "filename": null, "id": "region_4055", "name": "private_0x0000000002040000", "norm_filename": null, "region_type": "private_memory", "start_va": 33816576, "timestamp": "00:02:03.473", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "C:\\Windows\\system32\\svchost.exe", "filename": "c:\\windows\\system32\\svchost.exe", "id": "proc_18", "image_name": "svchost.exe", "monitor_reason": "child_process", "monitored_id": 18, "origin_monitor_id": 17, "ref_parent_process": { "ref_id": "proc_17", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2147155968, "type": "region", "version": 1 }, "end_va": 2147160063, "entry_point": 0, "filename": null, "id": "region_4021", "name": "private_0x000000007ffb0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147155968, "timestamp": "00:02:03.141", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_4022", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:02:03.141", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 131072, "start_va": 1097662398464, "type": "region", "version": 1 }, "end_va": 1097662529535, "entry_point": 0, "filename": null, "id": "region_4023", "name": "private_0x000000ff91c70000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097662398464, "timestamp": "00:02:03.141", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 1097662529536, "type": "region", "version": 1 }, "end_va": 1097662611455, "entry_point": 0, "filename": null, "id": "region_4024", "name": "pagefile_0x000000ff91c90000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1097662529536, "timestamp": "00:02:03.141", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 1097662660608, "type": "region", "version": 1 }, "end_va": 1097663184895, "entry_point": 0, "filename": null, "id": "region_4025", "name": "private_0x000000ff91cb0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097662660608, "timestamp": "00:02:03.141", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 1097663184896, "type": "region", "version": 1 }, "end_va": 1097663201279, "entry_point": 0, "filename": null, "id": "region_4026", "name": "pagefile_0x000000ff91d30000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1097663184896, "timestamp": "00:02:03.141", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 1097663250432, "type": "region", "version": 1 }, "end_va": 1097663254527, "entry_point": 0, "filename": null, "id": "region_4027", "name": "pagefile_0x000000ff91d40000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1097663250432, "timestamp": "00:02:03.141", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 1097663315968, "type": "region", "version": 1 }, "end_va": 1097663324159, "entry_point": 0, "filename": null, "id": "region_4028", "name": "private_0x000000ff91d50000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097663315968, "timestamp": "00:02:03.141", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "" ], "ref_process_dump": null, "size": 2199023255552, "start_va": 138495500222464, "type": "region", "version": 1 }, "end_va": 140694523478015, "entry_point": 0, "filename": null, "id": "region_4029", "name": "pagefile_0x00007df5ff180000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 138495500222464, "timestamp": "00:02:03.141", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 140700887547904, "type": "region", "version": 1 }, "end_va": 140700887691263, "entry_point": 0, "filename": null, "id": "region_4030", "name": "pagefile_0x00007ff77a6c0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140700887547904, "timestamp": "00:02:03.141", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 140700887724032, "type": "region", "version": 1 }, "end_va": 140700887728127, "entry_point": 0, "filename": null, "id": "region_4031", "name": "private_0x00007ff77a6eb000", "norm_filename": null, "region_type": "private_memory", "start_va": 140700887724032, "timestamp": "00:02:03.141", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140700887736320, "type": "region", "version": 1 }, "end_va": 140700887744511, "entry_point": 0, "filename": null, "id": "region_4032", "name": "private_0x00007ff77a6ee000", "norm_filename": null, "region_type": "private_memory", "start_va": 140700887736320, "timestamp": "00:02:03.141", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 53248, "start_va": 140700887744512, "type": "region", "version": 1 }, "end_va": 140700887797759, "entry_point": 140700887744512, "filename": "\\Windows\\System32\\svchost.exe", "id": "region_4033", "name": "svchost.exe", "norm_filename": "c:\\windows\\system32\\svchost.exe", "region_type": "memory_mapped_file", "start_va": 140700887744512, "timestamp": "00:02:03.142", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140717747994624, "type": "region", "version": 1 }, "end_va": 140717749837823, "entry_point": 140717747994624, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_4034", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140717747994624, "timestamp": "00:02:03.142", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 1097664036864, "type": "region", "version": 1 }, "end_va": 1097664065535, "entry_point": 0, "filename": null, "id": "region_4043", "name": "private_0x000000ff91e00000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097664036864, "timestamp": "00:02:03.342", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 1097665085440, "type": "region", "version": 1 }, "end_va": 1097666134015, "entry_point": 0, "filename": null, "id": "region_4044", "name": "private_0x000000ff91f00000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097665085440, "timestamp": "00:02:03.342", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1953792, "start_va": 140717702053888, "type": "region", "version": 1 }, "end_va": 140717704007679, "entry_point": 140717702053888, "filename": "\\Windows\\System32\\KernelBase.dll", "id": "region_4045", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\system32\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 140717702053888, "timestamp": "00:02:03.342", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 708608, "start_va": 140717742424064, "type": "region", "version": 1 }, "end_va": 140717743132671, "entry_point": 140717742424064, "filename": "\\Windows\\System32\\kernel32.dll", "id": "region_4046", "name": "kernel32.dll", "norm_filename": "c:\\windows\\system32\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 140717742424064, "timestamp": "00:02:03.343", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 1097662398464, "type": "region", "version": 1 }, "end_va": 1097662463999, "entry_point": 0, "filename": null, "id": "region_4047", "name": "pagefile_0x000000ff91c70000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1097662398464, "timestamp": "00:02:03.349", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 1097663381504, "type": "region", "version": 1 }, "end_va": 1097663905791, "entry_point": 0, "filename": null, "id": "region_4048", "name": "private_0x000000ff91d60000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097663381504, "timestamp": "00:02:03.349", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 1097664102400, "type": "region", "version": 1 }, "end_va": 1097664880639, "entry_point": 1097664102400, "filename": "\\Windows\\System32\\locale.nls", "id": "region_4049", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 1097664102400, "timestamp": "00:02:03.349", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 140700886499328, "type": "region", "version": 1 }, "end_va": 140700887547903, "entry_point": 0, "filename": null, "id": "region_4050", "name": "pagefile_0x00007ff77a5c0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140700886499328, "timestamp": "00:02:03.349", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140700887728128, "type": "region", "version": 1 }, "end_va": 140700887736319, "entry_point": 0, "filename": null, "id": "region_4051", "name": "private_0x00007ff77a6ec000", "norm_filename": null, "region_type": "private_memory", "start_va": 140700887728128, "timestamp": "00:02:03.349", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1204224, "start_va": 140717731348480, "type": "region", "version": 1 }, "end_va": 140717732552703, "entry_point": 140717731348480, "filename": "\\Windows\\System32\\rpcrt4.dll", "id": "region_4052", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\system32\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 140717731348480, "timestamp": "00:02:03.350", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 372736, "start_va": 140717747601408, "type": "region", "version": 1 }, "end_va": 140717747974143, "entry_point": 140717747601408, "filename": "\\Windows\\System32\\sechost.dll", "id": "region_4053", "name": "sechost.dll", "norm_filename": "c:\\windows\\system32\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 140717747601408, "timestamp": "00:02:03.350", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 598016, "start_va": 13041664, "type": "region", "version": 1 }, "end_va": 13639679, "entry_point": 0, "filename": null, "id": "region_4056", "name": "pagefile_0x0000000000c70000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 13041664, "timestamp": "00:02:03.475", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 4096, "start_va": 13697024, "type": "region", "version": 1 }, "end_va": 13701119, "entry_point": 0, "filename": null, "id": "region_4063", "name": "private_0x0000000000d10000", "norm_filename": null, "region_type": "private_memory", "start_va": 13697024, "timestamp": "00:02:03.636", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 140717704806400, "type": "region", "version": 1 }, "end_va": 140717705584639, "entry_point": 140717704806400, "filename": "\\Windows\\System32\\oleaut32.dll", "id": "region_4064", "name": "oleaut32.dll", "norm_filename": "c:\\windows\\system32\\oleaut32.dll", "region_type": "memory_mapped_file", "start_va": 140717704806400, "timestamp": "00:02:03.648", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 643072, "start_va": 140717744521216, "type": "region", "version": 1 }, "end_va": 140717745164287, "entry_point": 140717744521216, "filename": "\\Windows\\System32\\msvcrt.dll", "id": "region_4065", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\system32\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 140717744521216, "timestamp": "00:02:03.649", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2605056, "start_va": 140717737312256, "type": "region", "version": 1 }, "end_va": 140717739917311, "entry_point": 140717737312256, "filename": "\\Windows\\System32\\combase.dll", "id": "region_4066", "name": "combase.dll", "norm_filename": "c:\\windows\\system32\\combase.dll", "region_type": "memory_mapped_file", "start_va": 140717737312256, "timestamp": "00:02:03.650", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1740800, "start_va": 1097666134016, "type": "region", "version": 1 }, "end_va": 1097667874815, "entry_point": 0, "filename": null, "id": "region_4067", "name": "private_0x000000ff92000000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097666134016, "timestamp": "00:02:03.652", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 2097152, "start_va": 1097667903488, "type": "region", "version": 1 }, "end_va": 1097670000639, "entry_point": 0, "filename": null, "id": "region_4068", "name": "private_0x000000ff921b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097667903488, "timestamp": "00:02:03.652", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 1097668231168, "type": "region", "version": 1 }, "end_va": 1097669279743, "entry_point": 0, "filename": null, "id": "region_4069", "name": "private_0x000000ff92200000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097668231168, "timestamp": "00:02:03.652", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1314816, "start_va": 1097666134016, "type": "region", "version": 1 }, "end_va": 1097667448831, "entry_point": 1097666134016, "filename": "\\Windows\\System32\\ole32.dll", "id": "region_4070", "name": "ole32.dll", "norm_filename": "c:\\windows\\system32\\ole32.dll", "region_type": "memory_mapped_file", "start_va": 1097666134016, "timestamp": "00:02:03.657", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 36864, "start_va": 1097667837952, "type": "region", "version": 1 }, "end_va": 1097667874815, "entry_point": 0, "filename": null, "id": "region_4071", "name": "private_0x000000ff921a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097667837952, "timestamp": "00:02:03.657", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1216512, "start_va": 1097666134016, "type": "region", "version": 1 }, "end_va": 1097667350527, "entry_point": 0, "filename": null, "id": "region_4072", "name": "private_0x000000ff92000000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097666134016, "timestamp": "00:02:03.661", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 2097152, "start_va": 1097669279744, "type": "region", "version": 1 }, "end_va": 1097671376895, "entry_point": 0, "filename": null, "id": "region_4073", "name": "private_0x000000ff92300000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097669279744, "timestamp": "00:02:03.661", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 1097669279744, "type": "region", "version": 1 }, "end_va": 1097670328319, "entry_point": 0, "filename": null, "id": "region_4074", "name": "private_0x000000ff92300000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097669279744, "timestamp": "00:02:03.661", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 2097152, "start_va": 1097670328320, "type": "region", "version": 1 }, "end_va": 1097672425471, "entry_point": 0, "filename": null, "id": "region_4075", "name": "private_0x000000ff92400000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097670328320, "timestamp": "00:02:03.661", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 1097670328320, "type": "region", "version": 1 }, "end_va": 1097671376895, "entry_point": 0, "filename": null, "id": "region_4076", "name": "private_0x000000ff92400000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097670328320, "timestamp": "00:02:03.661", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 2097152, "start_va": 1097671376896, "type": "region", "version": 1 }, "end_va": 1097673474047, "entry_point": 0, "filename": null, "id": "region_4077", "name": "private_0x000000ff92500000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097671376896, "timestamp": "00:02:03.661", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 1097671376896, "type": "region", "version": 1 }, "end_va": 1097672425471, "entry_point": 0, "filename": null, "id": "region_4078", "name": "private_0x000000ff92500000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097671376896, "timestamp": "00:02:03.661", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 2097152, "start_va": 1097672425472, "type": "region", "version": 1 }, "end_va": 1097674522623, "entry_point": 0, "filename": null, "id": "region_4079", "name": "private_0x000000ff92600000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097672425472, "timestamp": "00:02:03.662", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 1097672425472, "type": "region", "version": 1 }, "end_va": 1097673474047, "entry_point": 0, "filename": null, "id": "region_4080", "name": "private_0x000000ff92600000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097672425472, "timestamp": "00:02:03.662", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 1097662464000, "type": "region", "version": 1 }, "end_va": 1097662472191, "entry_point": 0, "filename": null, "id": "region_4081", "name": "private_0x000000ff91c80000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097662464000, "timestamp": "00:02:03.662", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 679936, "start_va": 140717745373184, "type": "region", "version": 1 }, "end_va": 140717746053119, "entry_point": 140717745373184, "filename": "\\Windows\\System32\\advapi32.dll", "id": "region_4082", "name": "advapi32.dll", "norm_filename": "c:\\windows\\system32\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 140717745373184, "timestamp": "00:02:03.664", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 331776, "start_va": 140717736525824, "type": "region", "version": 1 }, "end_va": 140717736857599, "entry_point": 140717736525824, "filename": "\\Windows\\System32\\shlwapi.dll", "id": "region_4083", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\system32\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 140717736525824, "timestamp": "00:02:03.670", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1593344, "start_va": 140717707493376, "type": "region", "version": 1 }, "end_va": 140717709086719, "entry_point": 140717707493376, "filename": "\\Windows\\System32\\gdi32.dll", "id": "region_4084", "name": "gdi32.dll", "norm_filename": "c:\\windows\\system32\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 140717707493376, "timestamp": "00:02:03.671", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1368064, "start_va": 140717732921344, "type": "region", "version": 1 }, "end_va": 140717734289407, "entry_point": 140717732921344, "filename": "\\Windows\\System32\\user32.dll", "id": "region_4085", "name": "user32.dll", "norm_filename": "c:\\windows\\system32\\user32.dll", "region_type": "memory_mapped_file", "start_va": 140717732921344, "timestamp": "00:02:03.672", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 212992, "start_va": 1097666134016, "type": "region", "version": 1 }, "end_va": 1097666347007, "entry_point": 1097666134016, "filename": "\\Windows\\System32\\imm32.dll", "id": "region_4086", "name": "imm32.dll", "norm_filename": "c:\\windows\\system32\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 1097666134016, "timestamp": "00:02:03.674", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 36864, "start_va": 1097667313664, "type": "region", "version": 1 }, "end_va": 1097667350527, "entry_point": 0, "filename": null, "id": "region_4087", "name": "private_0x000000ff92120000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097667313664, "timestamp": "00:02:03.674", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 1097673474048, "type": "region", "version": 1 }, "end_va": 1097675079679, "entry_point": 0, "filename": null, "id": "region_4088", "name": "pagefile_0x000000ff92700000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1097673474048, "timestamp": "00:02:03.674", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 221184, "start_va": 140717732659200, "type": "region", "version": 1 }, "end_va": 140717732880383, "entry_point": 140717732659200, "filename": "\\Windows\\System32\\imm32.dll", "id": "region_4089", "name": "imm32.dll", "norm_filename": "c:\\windows\\system32\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 140717732659200, "timestamp": "00:02:03.675", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1425408, "start_va": 140717746094080, "type": "region", "version": 1 }, "end_va": 140717747519487, "entry_point": 140717746094080, "filename": "\\Windows\\System32\\msctf.dll", "id": "region_4090", "name": "msctf.dll", "norm_filename": "c:\\windows\\system32\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 140717746094080, "timestamp": "00:02:03.676", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 1097675112448, "type": "region", "version": 1 }, "end_va": 1097676689407, "entry_point": 0, "filename": null, "id": "region_4091", "name": "pagefile_0x000000ff92890000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1097675112448, "timestamp": "00:02:03.678", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 1097676750848, "type": "region", "version": 1 }, "end_va": 1097697722367, "entry_point": 0, "filename": null, "id": "region_4092", "name": "pagefile_0x000000ff92a20000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1097676750848, "timestamp": "00:02:03.679", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 1097662464000, "type": "region", "version": 1 }, "end_va": 1097662468095, "entry_point": 1097662464000, "filename": "\\Windows\\System32\\en-US\\svchost.exe.mui", "id": "region_4093", "name": "svchost.exe.mui", "norm_filename": "c:\\windows\\system32\\en-us\\svchost.exe.mui", "region_type": "memory_mapped_file", "start_va": 1097662464000, "timestamp": "00:02:03.680", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 1097663905792, "type": "region", "version": 1 }, "end_va": 1097663909887, "entry_point": 0, "filename": null, "id": "region_4094", "name": "private_0x000000ff91de0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097663905792, "timestamp": "00:02:03.694", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 1097663971328, "type": "region", "version": 1 }, "end_va": 1097663975423, "entry_point": 0, "filename": null, "id": "region_4095", "name": "private_0x000000ff91df0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1097663971328, "timestamp": "00:02:03.694", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 180224, "start_va": 140717687504896, "type": "region", "version": 1 }, "end_va": 140717687685119, "entry_point": 140717687504896, "filename": "\\Windows\\System32\\sspicli.dll", "id": "region_4096", "name": "sspicli.dll", "norm_filename": "c:\\windows\\system32\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 140717687504896, "timestamp": "00:02:03.699", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 1097697722368, "type": "region", "version": 1 }, "end_va": 1097701093375, "entry_point": 1097697722368, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_4097", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 1097697722368, "timestamp": "00:02:03.709", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 140717732593664, "type": "region", "version": 1 }, "end_va": 140717732626431, "entry_point": 140717732593664, "filename": "\\Windows\\System32\\psapi.dll", "id": "region_4098", "name": "psapi.dll", "norm_filename": "c:\\windows\\system32\\psapi.dll", "region_type": "memory_mapped_file", "start_va": 140717732593664, "timestamp": "00:02:03.729", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 598016, "start_va": 1097666134016, "type": "region", "version": 1 }, "end_va": 1097666732031, "entry_point": 0, "filename": null, "id": "region_4612", "name": "pagefile_0x000000ff92000000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1097666134016, "timestamp": "00:02:04.194", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "C:\\Windows\\Explorer.EXE", "filename": "c:\\windows\\explorer.exe", "id": "proc_19", "image_name": "explorer.exe", "monitor_reason": "injection", "monitored_id": 19, "origin_monitor_id": 18, "ref_parent_process": { "ref_id": "proc_18", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 1507328, "type": "region", "version": 1 }, "end_va": 1572863, "entry_point": 0, "filename": null, "id": "region_4099", "name": "pagefile_0x0000000000170000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1507328, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 1572864, "type": "region", "version": 1 }, "end_va": 1601535, "entry_point": 0, "filename": null, "id": "region_4100", "name": "private_0x0000000000180000", "norm_filename": null, "region_type": "private_memory", "start_va": 1572864, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 1638400, "type": "region", "version": 1 }, "end_va": 1720319, "entry_point": 0, "filename": null, "id": "region_4101", "name": "pagefile_0x0000000000190000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1638400, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 1769472, "type": "region", "version": 1 }, "end_va": 2293759, "entry_point": 0, "filename": null, "id": "region_4102", "name": "private_0x00000000001b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1769472, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 2293760, "type": "region", "version": 1 }, "end_va": 2310143, "entry_point": 0, "filename": null, "id": "region_4103", "name": "pagefile_0x0000000000230000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2293760, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 2359296, "type": "region", "version": 1 }, "end_va": 2371583, "entry_point": 0, "filename": null, "id": "region_4104", "name": "pagefile_0x0000000000240000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2359296, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 2424832, "type": "region", "version": 1 }, "end_va": 2433023, "entry_point": 0, "filename": null, "id": "region_4105", "name": "private_0x0000000000250000", "norm_filename": null, "region_type": "private_memory", "start_va": 2424832, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 2490368, "type": "region", "version": 1 }, "end_va": 3268607, "entry_point": 2490368, "filename": "\\Windows\\System32\\locale.nls", "id": "region_4106", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 2490368, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 3276800, "type": "region", "version": 1 }, "end_va": 3801087, "entry_point": 0, "filename": null, "id": "region_4107", "name": "private_0x0000000000320000", "norm_filename": null, "region_type": "private_memory", "start_va": 3276800, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 3801088, "type": "region", "version": 1 }, "end_va": 3829759, "entry_point": 0, "filename": null, "id": "region_4108", "name": "private_0x00000000003a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 3801088, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 3866624, "type": "region", "version": 1 }, "end_va": 4915199, "entry_point": 0, "filename": null, "id": "region_4109", "name": "private_0x00000000003b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 3866624, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 32768, "start_va": 4915200, "type": "region", "version": 1 }, "end_va": 4947967, "entry_point": 4915200, "filename": "\\Windows\\en-US\\explorer.exe.mui", "id": "region_4110", "name": "explorer.exe.mui", "norm_filename": "c:\\windows\\en-us\\explorer.exe.mui", "region_type": "memory_mapped_file", "start_va": 4915200, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 4980736, "type": "region", "version": 1 }, "end_va": 4984831, "entry_point": 0, "filename": null, "id": "region_4111", "name": "private_0x00000000004c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 4980736, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 5046272, "type": "region", "version": 1 }, "end_va": 5050367, "entry_point": 0, "filename": null, "id": "region_4112", "name": "private_0x00000000004d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 5046272, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 5111808, "type": "region", "version": 1 }, "end_va": 5115903, "entry_point": 0, "filename": null, "id": "region_4113", "name": "pagefile_0x00000000004e0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5111808, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 5177344, "type": "region", "version": 1 }, "end_va": 5181439, "entry_point": 0, "filename": null, "id": "region_4114", "name": "pagefile_0x00000000004f0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5177344, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 5242880, "type": "region", "version": 1 }, "end_va": 5246975, "entry_point": 0, "filename": null, "id": "region_4115", "name": "pagefile_0x0000000000500000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5242880, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 5308416, "type": "region", "version": 1 }, "end_va": 5312511, "entry_point": 0, "filename": null, "id": "region_4116", "name": "pagefile_0x0000000000510000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5308416, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 5373952, "type": "region", "version": 1 }, "end_va": 5390335, "entry_point": 5373952, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", "id": "region_4117", "name": "cversions.1.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db", "region_type": "memory_mapped_file", "start_va": 5373952, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 139264, "start_va": 5439488, "type": "region", "version": 1 }, "end_va": 5578751, "entry_point": 5439488, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000012.db", "id": "region_4118", "name": "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000012.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000012.db", "region_type": "memory_mapped_file", "start_va": 5439488, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 5636096, "type": "region", "version": 1 }, "end_va": 5640191, "entry_point": 0, "filename": null, "id": "region_4119", "name": "pagefile_0x0000000000560000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5636096, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 5701632, "type": "region", "version": 1 }, "end_va": 5767167, "entry_point": 0, "filename": null, "id": "region_4120", "name": "private_0x0000000000570000", "norm_filename": null, "region_type": "private_memory", "start_va": 5701632, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 5767168, "type": "region", "version": 1 }, "end_va": 7372799, "entry_point": 0, "filename": null, "id": "region_4121", "name": "pagefile_0x0000000000580000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5767168, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 7405568, "type": "region", "version": 1 }, "end_va": 8982527, "entry_point": 0, "filename": null, "id": "region_4122", "name": "pagefile_0x0000000000710000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 7405568, "timestamp": "00:02:03.748", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 9043968, "type": "region", "version": 1 }, "end_va": 30015487, "entry_point": 0, "filename": null, "id": "region_4123", "name": "pagefile_0x00000000008a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 9043968, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 30015488, "type": "region", "version": 1 }, "end_va": 30539775, "entry_point": 0, "filename": null, "id": "region_4124", "name": "private_0x0000000001ca0000", "norm_filename": null, "region_type": "private_memory", "start_va": 30015488, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 110592, "start_va": 30539776, "type": "region", "version": 1 }, "end_va": 30650367, "entry_point": 30539776, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000031.db", "id": "region_4125", "name": "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000031.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000031.db", "region_type": "memory_mapped_file", "start_va": 30539776, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 30670848, "type": "region", "version": 1 }, "end_va": 30736383, "entry_point": 0, "filename": null, "id": "region_4126", "name": "private_0x0000000001d40000", "norm_filename": null, "region_type": "private_memory", "start_va": 30670848, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 30736384, "type": "region", "version": 1 }, "end_va": 34107391, "entry_point": 30736384, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_4127", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 30736384, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 34144256, "type": "region", "version": 1 }, "end_va": 34668543, "entry_point": 0, "filename": null, "id": "region_4128", "name": "private_0x0000000002090000", "norm_filename": null, "region_type": "private_memory", "start_va": 34144256, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 34668544, "type": "region", "version": 1 }, "end_va": 35192831, "entry_point": 0, "filename": null, "id": "region_4129", "name": "private_0x0000000002110000", "norm_filename": null, "region_type": "private_memory", "start_va": 34668544, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 35192832, "type": "region", "version": 1 }, "end_va": 35717119, "entry_point": 0, "filename": null, "id": "region_4130", "name": "private_0x0000000002190000", "norm_filename": null, "region_type": "private_memory", "start_va": 35192832, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 397312, "start_va": 35717120, "type": "region", "version": 1 }, "end_va": 36114431, "entry_point": 35717120, "filename": "\\Windows\\System32\\en-US\\shell32.dll.mui", "id": "region_4131", "name": "shell32.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\shell32.dll.mui", "region_type": "memory_mapped_file", "start_va": 35717120, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 36175872, "type": "region", "version": 1 }, "end_va": 36188159, "entry_point": 0, "filename": null, "id": "region_4132", "name": "pagefile_0x0000000002280000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 36175872, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 36241408, "type": "region", "version": 1 }, "end_va": 36253695, "entry_point": 0, "filename": null, "id": "region_4133", "name": "pagefile_0x0000000002290000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 36241408, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 172032, "start_va": 36306944, "type": "region", "version": 1 }, "end_va": 36478975, "entry_point": 0, "filename": null, "id": "region_4134", "name": "pagefile_0x00000000022a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 36306944, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 913408, "start_va": 36503552, "type": "region", "version": 1 }, "end_va": 37416959, "entry_point": 36503552, "filename": "\\Windows\\System32\\en-US\\KernelBase.dll.mui", "id": "region_4135", "name": "kernelbase.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\kernelbase.dll.mui", "region_type": "memory_mapped_file", "start_va": 36503552, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 37421056, "type": "region", "version": 1 }, "end_va": 37945343, "entry_point": 0, "filename": null, "id": "region_4136", "name": "private_0x00000000023b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 37421056, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 37945344, "type": "region", "version": 1 }, "end_va": 38469631, "entry_point": 0, "filename": null, "id": "region_4137", "name": "private_0x0000000002430000", "norm_filename": null, "region_type": "private_memory", "start_va": 37945344, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 38469632, "type": "region", "version": 1 }, "end_va": 38993919, "entry_point": 0, "filename": null, "id": "region_4138", "name": "private_0x00000000024b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 38469632, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 38993920, "type": "region", "version": 1 }, "end_va": 39002111, "entry_point": 0, "filename": null, "id": "region_4139", "name": "pagefile_0x0000000002530000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 38993920, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 39059456, "type": "region", "version": 1 }, "end_va": 39067647, "entry_point": 0, "filename": null, "id": "region_4140", "name": "pagefile_0x0000000002540000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 39059456, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 39124992, "type": "region", "version": 1 }, "end_va": 39133183, "entry_point": 39124992, "filename": "\\Windows\\System32\\oleaccrc.dll", "id": "region_4141", "name": "oleaccrc.dll", "norm_filename": "c:\\windows\\system32\\oleaccrc.dll", "region_type": "memory_mapped_file", "start_va": 39124992, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20480, "start_va": 39190528, "type": "region", "version": 1 }, "end_va": 39211007, "entry_point": 39190528, "filename": "\\Windows\\System32\\en-US\\oleaccrc.dll.mui", "id": "region_4142", "name": "oleaccrc.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\oleaccrc.dll.mui", "region_type": "memory_mapped_file", "start_va": 39190528, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 753664, "start_va": 39256064, "type": "region", "version": 1 }, "end_va": 40009727, "entry_point": 0, "filename": null, "id": "region_4143", "name": "pagefile_0x0000000002570000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 39256064, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 40042496, "type": "region", "version": 1 }, "end_va": 40058879, "entry_point": 0, "filename": null, "id": "region_4144", "name": "pagefile_0x0000000002630000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 40042496, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 40108032, "type": "region", "version": 1 }, "end_va": 41156607, "entry_point": 0, "filename": null, "id": "region_4145", "name": "private_0x0000000002640000", "norm_filename": null, "region_type": "private_memory", "start_va": 40108032, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 41156608, "type": "region", "version": 1 }, "end_va": 42205183, "entry_point": 0, "filename": null, "id": "region_4146", "name": "private_0x0000000002740000", "norm_filename": null, "region_type": "private_memory", "start_va": 41156608, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 42205184, "type": "region", "version": 1 }, "end_va": 42233855, "entry_point": 0, "filename": null, "id": "region_4147", "name": "private_0x0000000002840000", "norm_filename": null, "region_type": "private_memory", "start_va": 42205184, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 42270720, "type": "region", "version": 1 }, "end_va": 42283007, "entry_point": 0, "filename": null, "id": "region_4148", "name": "pagefile_0x0000000002850000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 42270720, "timestamp": "00:02:03.749", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 17039360, "start_va": 42336256, "type": "region", "version": 1 }, "end_va": 59375615, "entry_point": 42336256, "filename": "\\Windows\\Fonts\\StaticCache.dat", "id": "region_4149", "name": "staticcache.dat", "norm_filename": "c:\\windows\\fonts\\staticcache.dat", "region_type": "memory_mapped_file", "start_va": 42336256, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 59375616, "type": "region", "version": 1 }, "end_va": 59379711, "entry_point": 0, "filename": null, "id": "region_4150", "name": "private_0x00000000038a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 59375616, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 59441152, "type": "region", "version": 1 }, "end_va": 59445247, "entry_point": 0, "filename": null, "id": "region_4151", "name": "private_0x00000000038b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 59441152, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 59506688, "type": "region", "version": 1 }, "end_va": 59510783, "entry_point": 0, "filename": null, "id": "region_4152", "name": "private_0x00000000038c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 59506688, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 59572224, "type": "region", "version": 1 }, "end_va": 59584511, "entry_point": 0, "filename": null, "id": "region_4153", "name": "pagefile_0x00000000038d0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 59572224, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 59637760, "type": "region", "version": 1 }, "end_va": 60162047, "entry_point": 0, "filename": null, "id": "region_4154", "name": "private_0x00000000038e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 59637760, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 60162048, "type": "region", "version": 1 }, "end_va": 60170239, "entry_point": 0, "filename": null, "id": "region_4155", "name": "private_0x0000000003960000", "norm_filename": null, "region_type": "private_memory", "start_va": 60162048, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 60227584, "type": "region", "version": 1 }, "end_va": 60231679, "entry_point": 0, "filename": null, "id": "region_4156", "name": "private_0x0000000003970000", "norm_filename": null, "region_type": "private_memory", "start_va": 60227584, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 60293120, "type": "region", "version": 1 }, "end_va": 60297215, "entry_point": 0, "filename": null, "id": "region_4157", "name": "private_0x0000000003980000", "norm_filename": null, "region_type": "private_memory", "start_va": 60293120, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 60358656, "type": "region", "version": 1 }, "end_va": 60362751, "entry_point": 0, "filename": null, "id": "region_4158", "name": "private_0x0000000003990000", "norm_filename": null, "region_type": "private_memory", "start_va": 60358656, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 60424192, "type": "region", "version": 1 }, "end_va": 60428287, "entry_point": 0, "filename": null, "id": "region_4159", "name": "private_0x00000000039a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 60424192, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 60489728, "type": "region", "version": 1 }, "end_va": 60555263, "entry_point": 0, "filename": null, "id": "region_4160", "name": "pagefile_0x00000000039b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 60489728, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 60555264, "type": "region", "version": 1 }, "end_va": 60620799, "entry_point": 0, "filename": null, "id": "region_4161", "name": "pagefile_0x00000000039c0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 60555264, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 60620800, "type": "region", "version": 1 }, "end_va": 60686335, "entry_point": 0, "filename": null, "id": "region_4162", "name": "pagefile_0x00000000039d0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 60620800, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 60686336, "type": "region", "version": 1 }, "end_va": 60690431, "entry_point": 0, "filename": null, "id": "region_4163", "name": "private_0x00000000039e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 60686336, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 60751872, "type": "region", "version": 1 }, "end_va": 60755967, "entry_point": 0, "filename": null, "id": "region_4164", "name": "private_0x00000000039f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 60751872, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 60817408, "type": "region", "version": 1 }, "end_va": 60821503, "entry_point": 0, "filename": null, "id": "region_4165", "name": "private_0x0000000003a00000", "norm_filename": null, "region_type": "private_memory", "start_va": 60817408, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 60882944, "type": "region", "version": 1 }, "end_va": 60899327, "entry_point": 60882944, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", "id": "region_4166", "name": "cversions.1.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db", "region_type": "memory_mapped_file", "start_va": 60882944, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 60948480, "type": "region", "version": 1 }, "end_va": 60952575, "entry_point": 0, "filename": null, "id": "region_4167", "name": "private_0x0000000003a20000", "norm_filename": null, "region_type": "private_memory", "start_va": 60948480, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 61014016, "type": "region", "version": 1 }, "end_va": 61018111, "entry_point": 0, "filename": null, "id": "region_4168", "name": "pagefile_0x0000000003a30000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 61014016, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 61079552, "type": "region", "version": 1 }, "end_va": 61083647, "entry_point": 0, "filename": null, "id": "region_4169", "name": "private_0x0000000003a40000", "norm_filename": null, "region_type": "private_memory", "start_va": 61079552, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 61145088, "type": "region", "version": 1 }, "end_va": 61157375, "entry_point": 0, "filename": null, "id": "region_4170", "name": "pagefile_0x0000000003a50000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 61145088, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 233472, "start_va": 61210624, "type": "region", "version": 1 }, "end_va": 61444095, "entry_point": 0, "filename": null, "id": "region_4171", "name": "pagefile_0x0000000003a60000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 61210624, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 61472768, "type": "region", "version": 1 }, "end_va": 61476863, "entry_point": 0, "filename": null, "id": "region_4172", "name": "private_0x0000000003aa0000", "norm_filename": null, "region_type": "private_memory", "start_va": 61472768, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 61538304, "type": "region", "version": 1 }, "end_va": 61542399, "entry_point": 0, "filename": null, "id": "region_4173", "name": "private_0x0000000003ab0000", "norm_filename": null, "region_type": "private_memory", "start_va": 61538304, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 61603840, "type": "region", "version": 1 }, "end_va": 61616127, "entry_point": 0, "filename": null, "id": "region_4174", "name": "pagefile_0x0000000003ac0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 61603840, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 61669376, "type": "region", "version": 1 }, "end_va": 61677567, "entry_point": 61669376, "filename": "\\Windows\\System32\\en-US\\stobject.dll.mui", "id": "region_4175", "name": "stobject.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\stobject.dll.mui", "region_type": "memory_mapped_file", "start_va": 61669376, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 61734912, "type": "region", "version": 1 }, "end_va": 61747199, "entry_point": 0, "filename": null, "id": "region_4176", "name": "pagefile_0x0000000003ae0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 61734912, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 61800448, "type": "region", "version": 1 }, "end_va": 61808639, "entry_point": 61800448, "filename": "\\Windows\\System32\\en-US\\InputSwitch.dll.mui", "id": "region_4177", "name": "inputswitch.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\inputswitch.dll.mui", "region_type": "memory_mapped_file", "start_va": 61800448, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 61865984, "type": "region", "version": 1 }, "end_va": 61870079, "entry_point": 0, "filename": null, "id": "region_4178", "name": "private_0x0000000003b00000", "norm_filename": null, "region_type": "private_memory", "start_va": 61865984, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 61931520, "type": "region", "version": 1 }, "end_va": 61943807, "entry_point": 0, "filename": null, "id": "region_4179", "name": "pagefile_0x0000000003b10000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 61931520, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 61997056, "type": "region", "version": 1 }, "end_va": 62005247, "entry_point": 0, "filename": null, "id": "region_4180", "name": "pagefile_0x0000000003b20000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 61997056, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 62062592, "type": "region", "version": 1 }, "end_va": 62074879, "entry_point": 0, "filename": null, "id": "region_4181", "name": "pagefile_0x0000000003b30000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 62062592, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 62128128, "type": "region", "version": 1 }, "end_va": 62144511, "entry_point": 62128128, "filename": "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db", "id": "region_4182", "name": "cversions.2.db", "norm_filename": "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db", "region_type": "memory_mapped_file", "start_va": 62128128, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 274432, "start_va": 62193664, "type": "region", "version": 1 }, "end_va": 62468095, "entry_point": 62193664, "filename": "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000007.db", "id": "region_4183", "name": "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000007.db", "norm_filename": "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000007.db", "region_type": "memory_mapped_file", "start_va": 62193664, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 62521344, "type": "region", "version": 1 }, "end_va": 62537727, "entry_point": 62521344, "filename": "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db", "id": "region_4184", "name": "cversions.2.db", "norm_filename": "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db", "region_type": "memory_mapped_file", "start_va": 62521344, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 569344, "start_va": 62586880, "type": "region", "version": 1 }, "end_va": 63156223, "entry_point": 62586880, "filename": "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db", "id": "region_4185", "name": "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db", "norm_filename": "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db", "region_type": "memory_mapped_file", "start_va": 62586880, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 69632, "start_va": 63176704, "type": "region", "version": 1 }, "end_va": 63246335, "entry_point": 63176704, "filename": "\\Windows\\System32\\en-US\\propsys.dll.mui", "id": "region_4186", "name": "propsys.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\propsys.dll.mui", "region_type": "memory_mapped_file", "start_va": 63176704, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 63307776, "type": "region", "version": 1 }, "end_va": 63832063, "entry_point": 0, "filename": null, "id": "region_4187", "name": "private_0x0000000003c60000", "norm_filename": null, "region_type": "private_memory", "start_va": 63307776, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 63832064, "type": "region", "version": 1 }, "end_va": 64356351, "entry_point": 0, "filename": null, "id": "region_4188", "name": "private_0x0000000003ce0000", "norm_filename": null, "region_type": "private_memory", "start_va": 63832064, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 64356352, "type": "region", "version": 1 }, "end_va": 64880639, "entry_point": 0, "filename": null, "id": "region_4189", "name": "private_0x0000000003d60000", "norm_filename": null, "region_type": "private_memory", "start_va": 64356352, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 64880640, "type": "region", "version": 1 }, "end_va": 65404927, "entry_point": 0, "filename": null, "id": "region_4190", "name": "private_0x0000000003de0000", "norm_filename": null, "region_type": "private_memory", "start_va": 64880640, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 65404928, "type": "region", "version": 1 }, "end_va": 65409023, "entry_point": 0, "filename": null, "id": "region_4191", "name": "private_0x0000000003e60000", "norm_filename": null, "region_type": "private_memory", "start_va": 65404928, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 65470464, "type": "region", "version": 1 }, "end_va": 65994751, "entry_point": 0, "filename": null, "id": "region_4192", "name": "private_0x0000000003e70000", "norm_filename": null, "region_type": "private_memory", "start_va": 65470464, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 65994752, "type": "region", "version": 1 }, "end_va": 66519039, "entry_point": 0, "filename": null, "id": "region_4193", "name": "private_0x0000000003ef0000", "norm_filename": null, "region_type": "private_memory", "start_va": 65994752, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 5185536, "start_va": 66519040, "type": "region", "version": 1 }, "end_va": 71704575, "entry_point": 0, "filename": null, "id": "region_4194", "name": "pagefile_0x0000000003f70000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 66519040, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 71761920, "type": "region", "version": 1 }, "end_va": 72286207, "entry_point": 0, "filename": null, "id": "region_4195", "name": "private_0x0000000004470000", "norm_filename": null, "region_type": "private_memory", "start_va": 71761920, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 72286208, "type": "region", "version": 1 }, "end_va": 72810495, "entry_point": 0, "filename": null, "id": "region_4196", "name": "private_0x00000000044f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 72286208, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 72810496, "type": "region", "version": 1 }, "end_va": 73334783, "entry_point": 0, "filename": null, "id": "region_4197", "name": "private_0x0000000004570000", "norm_filename": null, "region_type": "private_memory", "start_va": 72810496, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 73334784, "type": "region", "version": 1 }, "end_va": 73859071, "entry_point": 0, "filename": null, "id": "region_4198", "name": "private_0x00000000045f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 73334784, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 73859072, "type": "region", "version": 1 }, "end_va": 74383359, "entry_point": 0, "filename": null, "id": "region_4199", "name": "private_0x0000000004670000", "norm_filename": null, "region_type": "private_memory", "start_va": 73859072, "timestamp": "00:02:03.750", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 74383360, "type": "region", "version": 1 }, "end_va": 74391551, "entry_point": 74383360, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db", "id": "region_4200", "name": "iconcache_idx.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db", "region_type": "memory_mapped_file", "start_va": 74383360, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 74448896, "type": "region", "version": 1 }, "end_va": 74452991, "entry_point": 74448896, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_256.db", "id": "region_4201", "name": "iconcache_256.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_256.db", "region_type": "memory_mapped_file", "start_va": 74448896, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20480, "start_va": 74514432, "type": "region", "version": 1 }, "end_va": 74534911, "entry_point": 74514432, "filename": "\\Windows\\System32\\winnlsres.dll", "id": "region_4202", "name": "winnlsres.dll", "norm_filename": "c:\\windows\\system32\\winnlsres.dll", "region_type": "memory_mapped_file", "start_va": 74514432, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 74579968, "type": "region", "version": 1 }, "end_va": 75104255, "entry_point": 0, "filename": null, "id": "region_4203", "name": "private_0x0000000004720000", "norm_filename": null, "region_type": "private_memory", "start_va": 74579968, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 75104256, "type": "region", "version": 1 }, "end_va": 75108351, "entry_point": 0, "filename": null, "id": "region_4204", "name": "pagefile_0x00000000047a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 75104256, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 75169792, "type": "region", "version": 1 }, "end_va": 75173887, "entry_point": 0, "filename": null, "id": "region_4205", "name": "private_0x00000000047b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 75169792, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 75235328, "type": "region", "version": 1 }, "end_va": 75239423, "entry_point": 0, "filename": null, "id": "region_4206", "name": "private_0x00000000047c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 75235328, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 75300864, "type": "region", "version": 1 }, "end_va": 75825151, "entry_point": 0, "filename": null, "id": "region_4207", "name": "private_0x00000000047d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 75300864, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 75825152, "type": "region", "version": 1 }, "end_va": 75833343, "entry_point": 0, "filename": null, "id": "region_4208", "name": "pagefile_0x0000000004850000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 75825152, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 75890688, "type": "region", "version": 1 }, "end_va": 76414975, "entry_point": 0, "filename": null, "id": "region_4209", "name": "private_0x0000000004860000", "norm_filename": null, "region_type": "private_memory", "start_va": 75890688, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 76414976, "type": "region", "version": 1 }, "end_va": 76939263, "entry_point": 0, "filename": null, "id": "region_4210", "name": "private_0x00000000048e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 76414976, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 76939264, "type": "region", "version": 1 }, "end_va": 76947455, "entry_point": 76939264, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db", "id": "region_4211", "name": "iconcache_idx.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db", "region_type": "memory_mapped_file", "start_va": 76939264, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 77004800, "type": "region", "version": 1 }, "end_va": 78053375, "entry_point": 0, "filename": null, "id": "region_4212", "name": "private_0x0000000004970000", "norm_filename": null, "region_type": "private_memory", "start_va": 77004800, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 78053376, "type": "region", "version": 1 }, "end_va": 78118911, "entry_point": 78053376, "filename": "\\Windows\\System32\\en-US\\winnlsres.dll.mui", "id": "region_4213", "name": "winnlsres.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\winnlsres.dll.mui", "region_type": "memory_mapped_file", "start_va": 78053376, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 78118912, "type": "region", "version": 1 }, "end_va": 78131199, "entry_point": 78118912, "filename": "\\Windows\\System32\\en-US\\mswsock.dll.mui", "id": "region_4214", "name": "mswsock.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\mswsock.dll.mui", "region_type": "memory_mapped_file", "start_va": 78118912, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 78184448, "type": "region", "version": 1 }, "end_va": 78188543, "entry_point": 78184448, "filename": "\\Windows\\System32\\en-US\\imageres.dll.mui", "id": "region_4215", "name": "imageres.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\imageres.dll.mui", "region_type": "memory_mapped_file", "start_va": 78184448, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 36864, "start_va": 78249984, "type": "region", "version": 1 }, "end_va": 78286847, "entry_point": 0, "filename": null, "id": "region_4216", "name": "private_0x0000000004aa0000", "norm_filename": null, "region_type": "private_memory", "start_va": 78249984, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 78315520, "type": "region", "version": 1 }, "end_va": 78331903, "entry_point": 0, "filename": null, "id": "region_4217", "name": "private_0x0000000004ab0000", "norm_filename": null, "region_type": "private_memory", "start_va": 78315520, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 78381056, "type": "region", "version": 1 }, "end_va": 78389247, "entry_point": 78381056, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db", "id": "region_4218", "name": "thumbcache_idx.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db", "region_type": "memory_mapped_file", "start_va": 78381056, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 78446592, "type": "region", "version": 1 }, "end_va": 78450687, "entry_point": 78446592, "filename": "\\Windows\\System32\\netmsg.dll", "id": "region_4219", "name": "netmsg.dll", "norm_filename": "c:\\windows\\system32\\netmsg.dll", "region_type": "memory_mapped_file", "start_va": 78446592, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 36864, "start_va": 78512128, "type": "region", "version": 1 }, "end_va": 78548991, "entry_point": 0, "filename": null, "id": "region_4220", "name": "private_0x0000000004ae0000", "norm_filename": null, "region_type": "private_memory", "start_va": 78512128, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 78577664, "type": "region", "version": 1 }, "end_va": 78581759, "entry_point": 0, "filename": null, "id": "region_4221", "name": "private_0x0000000004af0000", "norm_filename": null, "region_type": "private_memory", "start_va": 78577664, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 78643200, "type": "region", "version": 1 }, "end_va": 79167487, "entry_point": 0, "filename": null, "id": "region_4222", "name": "private_0x0000000004b00000", "norm_filename": null, "region_type": "private_memory", "start_va": 78643200, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 79167488, "type": "region", "version": 1 }, "end_va": 79691775, "entry_point": 0, "filename": null, "id": "region_4223", "name": "private_0x0000000004b80000", "norm_filename": null, "region_type": "private_memory", "start_va": 79167488, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 79691776, "type": "region", "version": 1 }, "end_va": 79704063, "entry_point": 0, "filename": null, "id": "region_4224", "name": "pagefile_0x0000000004c00000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 79691776, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 294912, "start_va": 79757312, "type": "region", "version": 1 }, "end_va": 80052223, "entry_point": 0, "filename": null, "id": "region_4225", "name": "private_0x0000000004c10000", "norm_filename": null, "region_type": "private_memory", "start_va": 79757312, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 294912, "start_va": 80084992, "type": "region", "version": 1 }, "end_va": 80379903, "entry_point": 0, "filename": null, "id": "region_4226", "name": "private_0x0000000004c60000", "norm_filename": null, "region_type": "private_memory", "start_va": 80084992, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 80412672, "type": "region", "version": 1 }, "end_va": 80936959, "entry_point": 0, "filename": null, "id": "region_4227", "name": "private_0x0000000004cb0000", "norm_filename": null, "region_type": "private_memory", "start_va": 80412672, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "" ], "ref_process_dump": null, "size": 8388608, "start_va": 80936960, "type": "region", "version": 1 }, "end_va": 89325567, "entry_point": 0, "filename": null, "id": "region_4228", "name": "private_0x0000000004d30000", "norm_filename": null, "region_type": "private_memory", "start_va": 80936960, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 89325568, "type": "region", "version": 1 }, "end_va": 90374143, "entry_point": 89325568, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db", "id": "region_4229", "name": "thumbcache_48.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db", "region_type": "memory_mapped_file", "start_va": 89325568, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 204800, "start_va": 90374144, "type": "region", "version": 1 }, "end_va": 90578943, "entry_point": 90374144, "filename": "\\Windows\\System32\\en-US\\netmsg.dll.mui", "id": "region_4230", "name": "netmsg.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\netmsg.dll.mui", "region_type": "memory_mapped_file", "start_va": 90374144, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 90636288, "type": "region", "version": 1 }, "end_va": 91160575, "entry_point": 0, "filename": null, "id": "region_4231", "name": "private_0x0000000005670000", "norm_filename": null, "region_type": "private_memory", "start_va": 90636288, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 91160576, "type": "region", "version": 1 }, "end_va": 91168767, "entry_point": 91160576, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db", "id": "region_4232", "name": "iconcache_idx.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db", "region_type": "memory_mapped_file", "start_va": 91160576, "timestamp": "00:02:03.751", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 91226112, "type": "region", "version": 1 }, "end_va": 92274687, "entry_point": 91226112, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db", "id": "region_4233", "name": "iconcache_48.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db", "region_type": "memory_mapped_file", "start_va": 91226112, "timestamp": "00:02:03.752", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 92274688, "type": "region", "version": 1 }, "end_va": 92798975, "entry_point": 0, "filename": null, "id": "region_4234", "name": "private_0x0000000005800000", "norm_filename": null, "region_type": "private_memory", "start_va": 92274688, "timestamp": "00:02:03.752", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 92798976, "type": "region", "version": 1 }, "end_va": 93323263, "entry_point": 0, "filename": null, "id": "region_4235", "name": "private_0x0000000005880000", "norm_filename": null, "region_type": "private_memory", "start_va": 92798976, "timestamp": "00:02:03.752", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 93323264, "type": "region", "version": 1 }, "end_va": 93331455, "entry_point": 93323264, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db", "id": "region_4236", "name": "thumbcache_idx.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db", "region_type": "memory_mapped_file", "start_va": 93323264, "timestamp": "00:02:03.752", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 93388800, "type": "region", "version": 1 }, "end_va": 94437375, "entry_point": 93388800, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db", "id": "region_4237", "name": "thumbcache_48.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db", "region_type": "memory_mapped_file", "start_va": 93388800, "timestamp": "00:02:03.752", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 94437376, "type": "region", "version": 1 }, "end_va": 94445567, "entry_point": 94437376, "filename": "\\Users\\CIiHmnxMn6Ps\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db", "id": "region_4238", "name": "thumbcache_idx.db", "norm_filename": "c:\\users\\ciihmnxmn6ps\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db", "region_type": "memory_mapped_file", "start_va": 94437376, "timestamp": "00:02:03.752", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 299008, "start_va": 94502912, "type": "region", "version": 1 }, "end_va": 94801919, "entry_point": 0, "filename": null, "id": "region_4239", "name": "private_0x0000000005a20000", "norm_filename": null, "region_type": "private_memory", "start_va": 94502912, "timestamp": "00:02:03.752", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "untracked_file_region" ], "info": "No dump was created because mapped file is not tracked", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 94830592, "type": "region", "version": 1 }, "end_va": 94846975, "entry_point": 94830592, "filename": "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db", "id": "region_4240", "name": "cversions.2.db", "norm_filename": "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db", "region_type": "memory_mapped_file", "start_va": 94830592, "timestamp": "00:02:03.752", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 94896128, "type": "region", "version": 1 }, "end_va": 94904319, "entry_point": 94896128, "filename": "\\Windows\\System32\\en-US\\sndvolsso.dll.mui", "id": "region_4241", "name": "sndvolsso.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\sndvolsso.dll.mui", "region_type": "memory_mapped_file", "start_va": 94896128, "timestamp": "00:02:03.752", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 94961664, "type": "region", "version": 1 }, "end_va": 94973951, "entry_point": 0, "filename": null, "id": "region_4242", "name": "pagefile_0x0000000005a90000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 94961664, "timestamp": "00:02:03.752", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 95027200, "type": "region", "version": 1 }, "end_va": 95031295, "entry_point": 0, "filename": null, "id": "region_4243", "name": "private_0x0000000005aa0000", "norm_filename": null, "region_type": "private_memory", "start_va": 95027200, "timestamp": "00:02:03.752", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 95092736, "type": "region", "version": 1 }, "end_va": 95100927, "entry_point": 0, "filename": null, "id": "region_4244", "name": "pagefile_0x0000000005ab0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 95092736, "timestamp": "00:02:03.752", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 95158272, "type": "region", "version": 1 }, "end_va": 95162367, "entry_point": 0, "filename": null, "id": "region_4245", "name": "private_0x0000000005ac0000", "norm_filename": null, "region_type": "private_memory", "start_va": 95158272, "timestamp": "00:02:03.752", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 95223808, "type": "region", "version": 1 }, "end_va": 95748095, "entry_point": 0, "filename": null, "id": "region_4246", "name": "private_0x0000000005ad0000", "norm_filename": null, "region_type": "private_memory", "start_va": 95223808, "timestamp": "00:02:03.752", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 32768, "start_va": 95748096, "type": "region", "version": 1 }, "end_va": 95780863, "entry_point": 95748096, "filename": "\\Windows\\System32\\en-US\\windows.storage.dll.mui", "id": "region_4247", "name": "windows.storage.dll.mui", "norm_filename": "c:\\windows\\system32\\en-us\\windows.storage.dll.mui", "region_type": "memory_mapped_file", "start_va": 95748096, "timestamp": "00:02:03.752", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 95813632, "type": "region", "version": 1 }, "end_va": 95825919, "entry_point": 0, "filename": null, "id": "region_4248", "name": "pagefile_0x0000000005b60000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 95813632, "timestamp": "00:02:03.752", "type": "region", "version": 1 } ], "terminate_reason": "timeout", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "C:\\Windows\\SysWOW64\\runonce.exe /Run6432", "filename": "c:\\windows\\syswow64\\runonce.exe", "id": "proc_20", "image_name": "runonce.exe", "monitor_reason": "child_process", "monitored_id": 20, "origin_monitor_id": 19, "ref_parent_process": { "ref_id": "proc_19", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 131072, "start_va": 5111808, "type": "region", "version": 1 }, "end_va": 5242879, "entry_point": 0, "filename": null, "id": "region_4592", "name": "private_0x00000000004e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 5111808, "timestamp": "00:02:04.082", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 5242880, "type": "region", "version": 1 }, "end_va": 5246975, "entry_point": 0, "filename": null, "id": "region_4593", "name": "private_0x0000000000500000", "norm_filename": null, "region_type": "private_memory", "start_va": 5242880, "timestamp": "00:02:04.082", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 5308416, "type": "region", "version": 1 }, "end_va": 5390335, "entry_point": 0, "filename": null, "id": "region_4594", "name": "pagefile_0x0000000000510000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5308416, "timestamp": "00:02:04.082", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 5439488, "type": "region", "version": 1 }, "end_va": 5701631, "entry_point": 0, "filename": null, "id": "region_4595", "name": "private_0x0000000000530000", "norm_filename": null, "region_type": "private_memory", "start_va": 5439488, "timestamp": "00:02:04.082", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 5701632, "type": "region", "version": 1 }, "end_va": 5963775, "entry_point": 0, "filename": null, "id": "region_4596", "name": "private_0x0000000000570000", "norm_filename": null, "region_type": "private_memory", "start_va": 5701632, "timestamp": "00:02:04.082", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 5963776, "type": "region", "version": 1 }, "end_va": 5980159, "entry_point": 0, "filename": null, "id": "region_4597", "name": "pagefile_0x00000000005b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5963776, "timestamp": "00:02:04.082", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 6029312, "type": "region", "version": 1 }, "end_va": 6041599, "entry_point": 0, "filename": null, "id": "region_4598", "name": "pagefile_0x00000000005c0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 6029312, "timestamp": "00:02:04.082", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 6094848, "type": "region", "version": 1 }, "end_va": 6103039, "entry_point": 0, "filename": null, "id": "region_4599", "name": "private_0x00000000005d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 6094848, "timestamp": "00:02:04.082", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 11075584, "type": "region", "version": 1 }, "end_va": 11124735, "entry_point": 11075584, "filename": "\\Windows\\SysWOW64\\runonce.exe", "id": "region_4600", "name": "runonce.exe", "norm_filename": "c:\\windows\\syswow64\\runonce.exe", "region_type": "memory_mapped_file", "start_va": 11075584, "timestamp": "00:02:04.082", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "" ], "ref_process_dump": null, "size": 67108864, "start_va": 11141120, "type": "region", "version": 1 }, "end_va": 78249983, "entry_point": 0, "filename": null, "id": "region_4601", "name": "pagefile_0x0000000000aa0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 11141120, "timestamp": "00:02:04.193", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1544192, "start_va": 2000420864, "type": "region", "version": 1 }, "end_va": 2001965055, "entry_point": 2000420864, "filename": "\\Windows\\SysWOW64\\ntdll.dll", "id": "region_4602", "name": "ntdll.dll", "norm_filename": "c:\\windows\\syswow64\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 2000420864, "timestamp": "00:02:04.193", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 2125987840, "type": "region", "version": 1 }, "end_va": 2126131199, "entry_point": 0, "filename": null, "id": "region_4603", "name": "pagefile_0x000000007eb80000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2125987840, "timestamp": "00:02:04.193", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2126139392, "type": "region", "version": 1 }, "end_va": 2126143487, "entry_point": 0, "filename": null, "id": "region_4604", "name": "private_0x000000007eba5000", "norm_filename": null, "region_type": "private_memory", "start_va": 2126139392, "timestamp": "00:02:04.193", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2126163968, "type": "region", "version": 1 }, "end_va": 2126176255, "entry_point": 0, "filename": null, "id": "region_4605", "name": "private_0x000000007ebab000", "norm_filename": null, "region_type": "private_memory", "start_va": 2126163968, "timestamp": "00:02:04.193", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 2126176256, "type": "region", "version": 1 }, "end_va": 2126180351, "entry_point": 0, "filename": null, "id": "region_4606", "name": "private_0x000000007ebae000", "norm_filename": null, "region_type": "private_memory", "start_va": 2126176256, "timestamp": "00:02:04.193", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_4607", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:02:04.193", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 138516577320960, "start_va": 2147418112, "type": "region", "version": 1 }, "end_va": 138518724739071, "entry_point": 0, "filename": null, "id": "region_4608", "name": "private_0x000000007fff0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147418112, "timestamp": "00:02:04.193", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "" ], "ref_process_dump": null, "size": 2199023255552, "start_va": 138518724739072, "type": "region", "version": 1 }, "end_va": 140717747994623, "entry_point": 0, "filename": null, "id": "region_4609", "name": "pagefile_0x00007dfb67620000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 138518724739072, "timestamp": "00:02:04.193", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140717747994624, "type": "region", "version": 1 }, "end_va": 140717749837823, "entry_point": 140717747994624, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_4610", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140717747994624, "timestamp": "00:02:04.193", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "readable" ], "ref_process_dump": null, "size": 19738451968, "start_va": 140717749837824, "type": "region", "version": 1 }, "end_va": 140737488289791, "entry_point": 0, "filename": null, "id": "region_4611", "name": "private_0x00007ffb677e2000", "norm_filename": null, "region_type": "private_memory", "start_va": 140717749837824, "timestamp": "00:02:04.193", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 7208960, "type": "region", "version": 1 }, "end_va": 7274495, "entry_point": 0, "filename": null, "id": "region_4772", "name": "private_0x00000000006e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 7208960, "timestamp": "00:02:05.943", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 471040, "start_va": 1695481856, "type": "region", "version": 1 }, "end_va": 1695952895, "entry_point": 1695481856, "filename": "\\Windows\\System32\\wow64win.dll", "id": "region_4773", "name": "wow64win.dll", "norm_filename": "c:\\windows\\system32\\wow64win.dll", "region_type": "memory_mapped_file", "start_va": 1695481856, "timestamp": "00:02:05.943", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 323584, "start_va": 1696071680, "type": "region", "version": 1 }, "end_va": 1696395263, "entry_point": 1696071680, "filename": "\\Windows\\System32\\wow64.dll", "id": "region_4774", "name": "wow64.dll", "norm_filename": "c:\\windows\\system32\\wow64.dll", "region_type": "memory_mapped_file", "start_va": 1696071680, "timestamp": "00:02:05.943", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 8519680, "type": "region", "version": 1 }, "end_va": 9568255, "entry_point": 0, "filename": null, "id": "region_4775", "name": "private_0x0000000000820000", "norm_filename": null, "region_type": "private_memory", "start_va": 8519680, "timestamp": "00:02:05.951", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 1696006144, "type": "region", "version": 1 }, "end_va": 1696038911, "entry_point": 1696006144, "filename": "\\Windows\\System32\\wow64cpu.dll", "id": "region_4776", "name": "wow64cpu.dll", "norm_filename": "c:\\windows\\system32\\wow64cpu.dll", "region_type": "memory_mapped_file", "start_va": 1696006144, "timestamp": "00:02:05.951", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 5111808, "type": "region", "version": 1 }, "end_va": 5177343, "entry_point": 0, "filename": null, "id": "region_4831", "name": "pagefile_0x00000000004e0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 5111808, "timestamp": "00:02:06.290", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 16384, "start_va": 5177344, "type": "region", "version": 1 }, "end_va": 5193727, "entry_point": 0, "filename": null, "id": "region_4832", "name": "private_0x00000000004f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 5177344, "timestamp": "00:02:06.290", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 5242880, "type": "region", "version": 1 }, "end_va": 5246975, "entry_point": 5242880, "filename": "\\Windows\\SysWOW64\\en-US\\runonce.exe.mui", "id": "region_4833", "name": "runonce.exe.mui", "norm_filename": "c:\\windows\\syswow64\\en-us\\runonce.exe.mui", "region_type": "memory_mapped_file", "start_va": 5242880, "timestamp": "00:02:06.291", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 6160384, "type": "region", "version": 1 }, "end_va": 6938623, "entry_point": 6160384, "filename": "\\Windows\\System32\\locale.nls", "id": "region_4834", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 6160384, "timestamp": "00:02:06.291", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 6946816, "type": "region", "version": 1 }, "end_va": 7208959, "entry_point": 0, "filename": null, "id": "region_4835", "name": "private_0x00000000006a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 6946816, "timestamp": "00:02:06.291", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 7274496, "type": "region", "version": 1 }, "end_va": 7536639, "entry_point": 0, "filename": null, "id": "region_4836", "name": "private_0x00000000006f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 7274496, "timestamp": "00:02:06.291", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 7536640, "type": "region", "version": 1 }, "end_va": 7540735, "entry_point": 0, "filename": null, "id": "region_4837", "name": "private_0x0000000000730000", "norm_filename": null, "region_type": "private_memory", "start_va": 7536640, "timestamp": "00:02:06.291", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 7602176, "type": "region", "version": 1 }, "end_va": 7606271, "entry_point": 0, "filename": null, "id": "region_4838", "name": "private_0x0000000000740000", "norm_filename": null, "region_type": "private_memory", "start_va": 7602176, "timestamp": "00:02:06.291", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 10616832, "type": "region", "version": 1 }, "end_va": 10682367, "entry_point": 0, "filename": null, "id": "region_4839", "name": "private_0x0000000000a20000", "norm_filename": null, "region_type": "private_memory", "start_va": 10616832, "timestamp": "00:02:06.291", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 78249984, "type": "region", "version": 1 }, "end_va": 79855615, "entry_point": 0, "filename": null, "id": "region_4840", "name": "pagefile_0x0000000004aa0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 78249984, "timestamp": "00:02:06.291", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 79888384, "type": "region", "version": 1 }, "end_va": 81465343, "entry_point": 0, "filename": null, "id": "region_4841", "name": "pagefile_0x0000000004c30000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 79888384, "timestamp": "00:02:06.291", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 81526784, "type": "region", "version": 1 }, "end_va": 102498303, "entry_point": 0, "filename": null, "id": "region_4842", "name": "pagefile_0x0000000004dc0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 81526784, "timestamp": "00:02:06.292", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2134016, "start_va": 1948581888, "type": "region", "version": 1 }, "end_va": 1950715903, "entry_point": 1948581888, "filename": "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll", "id": "region_4843", "name": "comctl32.dll", "norm_filename": "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10240.16384_none_3bccb1ff6bcd1849\\comctl32.dll", "region_type": "memory_mapped_file", "start_va": 1948581888, "timestamp": "00:02:06.292", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 364544, "start_va": 1950744576, "type": "region", "version": 1 }, "end_va": 1951109119, "entry_point": 1950744576, "filename": "\\Windows\\SysWOW64\\bcryptprimitives.dll", "id": "region_4844", "name": "bcryptprimitives.dll", "norm_filename": "c:\\windows\\syswow64\\bcryptprimitives.dll", "region_type": "memory_mapped_file", "start_va": 1950744576, "timestamp": "00:02:06.297", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 40960, "start_va": 1951137792, "type": "region", "version": 1 }, "end_va": 1951178751, "entry_point": 1951137792, "filename": "\\Windows\\SysWOW64\\cryptbase.dll", "id": "region_4845", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\syswow64\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 1951137792, "timestamp": "00:02:06.298", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 122880, "start_va": 1951203328, "type": "region", "version": 1 }, "end_va": 1951326207, "entry_point": 1951203328, "filename": "\\Windows\\SysWOW64\\sspicli.dll", "id": "region_4846", "name": "sspicli.dll", "norm_filename": "c:\\windows\\syswow64\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 1951203328, "timestamp": "00:02:06.298", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1531904, "start_va": 1951727616, "type": "region", "version": 1 }, "end_va": 1953259519, "entry_point": 1951727616, "filename": "\\Windows\\SysWOW64\\KernelBase.dll", "id": "region_4847", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\syswow64\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 1951727616, "timestamp": "00:02:06.298", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 20705280, "start_va": 1955135488, "type": "region", "version": 1 }, "end_va": 1975840767, "entry_point": 1955135488, "filename": "\\Windows\\SysWOW64\\shell32.dll", "id": "region_4848", "name": "shell32.dll", "norm_filename": "c:\\windows\\syswow64\\shell32.dll", "region_type": "memory_mapped_file", "start_va": 1955135488, "timestamp": "00:02:06.299", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 1975844864, "type": "region", "version": 1 }, "end_va": 1976123391, "entry_point": 1975844864, "filename": "\\Windows\\SysWOW64\\powrprof.dll", "id": "region_4849", "name": "powrprof.dll", "norm_filename": "c:\\windows\\syswow64\\powrprof.dll", "region_type": "memory_mapped_file", "start_va": 1975844864, "timestamp": "00:02:06.299", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 503808, "start_va": 1976631296, "type": "region", "version": 1 }, "end_va": 1977135103, "entry_point": 1976631296, "filename": "\\Windows\\SysWOW64\\advapi32.dll", "id": "region_4850", "name": "advapi32.dll", "norm_filename": "c:\\windows\\syswow64\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 1976631296, "timestamp": "00:02:06.299", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 176128, "start_va": 1977155584, "type": "region", "version": 1 }, "end_va": 1977331711, "entry_point": 1977155584, "filename": "\\Windows\\SysWOW64\\imm32.dll", "id": "region_4851", "name": "imm32.dll", "norm_filename": "c:\\windows\\syswow64\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 1977155584, "timestamp": "00:02:06.299", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1310720, "start_va": 1977352192, "type": "region", "version": 1 }, "end_va": 1978662911, "entry_point": 1977352192, "filename": "\\Windows\\SysWOW64\\user32.dll", "id": "region_4852", "name": "user32.dll", "norm_filename": "c:\\windows\\syswow64\\user32.dll", "region_type": "memory_mapped_file", "start_va": 1977352192, "timestamp": "00:02:06.299", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1363968, "start_va": 1979318272, "type": "region", "version": 1 }, "end_va": 1980682239, "entry_point": 1979318272, "filename": "\\Windows\\SysWOW64\\gdi32.dll", "id": "region_4853", "name": "gdi32.dll", "norm_filename": "c:\\windows\\syswow64\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 1979318272, "timestamp": "00:02:06.299", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 983040, "start_va": 1981022208, "type": "region", "version": 1 }, "end_va": 1982005247, "entry_point": 1981022208, "filename": "\\Windows\\SysWOW64\\kernel32.dll", "id": "region_4854", "name": "kernel32.dll", "norm_filename": "c:\\windows\\syswow64\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 1981022208, "timestamp": "00:02:06.299", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1179648, "start_va": 1982005248, "type": "region", "version": 1 }, "end_va": 1983184895, "entry_point": 1982005248, "filename": "\\Windows\\SysWOW64\\msctf.dll", "id": "region_4855", "name": "msctf.dll", "norm_filename": "c:\\windows\\syswow64\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 1982005248, "timestamp": "00:02:06.299", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 958464, "start_va": 1983184896, "type": "region", "version": 1 }, "end_va": 1984143359, "entry_point": 1983184896, "filename": "\\Windows\\SysWOW64\\ole32.dll", "id": "region_4856", "name": "ole32.dll", "norm_filename": "c:\\windows\\syswow64\\ole32.dll", "region_type": "memory_mapped_file", "start_va": 1983184896, "timestamp": "00:02:06.299", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 1984823296, "type": "region", "version": 1 }, "end_va": 1985101823, "entry_point": 1984823296, "filename": "\\Windows\\SysWOW64\\shlwapi.dll", "id": "region_4857", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\syswow64\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 1984823296, "timestamp": "00:02:06.299", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 1985150976, "type": "region", "version": 1 }, "end_va": 1985200127, "entry_point": 1985150976, "filename": "\\Windows\\SysWOW64\\kernel.appcore.dll", "id": "region_4858", "name": "kernel.appcore.dll", "norm_filename": "c:\\windows\\syswow64\\kernel.appcore.dll", "region_type": "memory_mapped_file", "start_va": 1985150976, "timestamp": "00:02:06.299", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 5099520, "start_va": 1987379200, "type": "region", "version": 1 }, "end_va": 1992478719, "entry_point": 1987379200, "filename": "\\Windows\\SysWOW64\\windows.storage.dll", "id": "region_4859", "name": "windows.storage.dll", "norm_filename": "c:\\windows\\syswow64\\windows.storage.dll", "region_type": "memory_mapped_file", "start_va": 1987379200, "timestamp": "00:02:06.300", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 61440, "start_va": 1992491008, "type": "region", "version": 1 }, "end_va": 1992552447, "entry_point": 1992491008, "filename": "\\Windows\\SysWOW64\\profapi.dll", "id": "region_4860", "name": "profapi.dll", "norm_filename": "c:\\windows\\syswow64\\profapi.dll", "region_type": "memory_mapped_file", "start_va": 1992491008, "timestamp": "00:02:06.300", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 1992556544, "type": "region", "version": 1 }, "end_va": 1993334783, "entry_point": 1992556544, "filename": "\\Windows\\SysWOW64\\msvcrt.dll", "id": "region_4861", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\syswow64\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 1992556544, "timestamp": "00:02:06.300", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1810432, "start_va": 1995440128, "type": "region", "version": 1 }, "end_va": 1997250559, "entry_point": 1995440128, "filename": "\\Windows\\SysWOW64\\combase.dll", "id": "region_4862", "name": "combase.dll", "norm_filename": "c:\\windows\\syswow64\\combase.dll", "region_type": "memory_mapped_file", "start_va": 1995440128, "timestamp": "00:02:06.300", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 577536, "start_va": 1998454784, "type": "region", "version": 1 }, "end_va": 1999032319, "entry_point": 1998454784, "filename": "\\Windows\\SysWOW64\\SHCore.dll", "id": "region_4863", "name": "shcore.dll", "norm_filename": "c:\\windows\\syswow64\\shcore.dll", "region_type": "memory_mapped_file", "start_va": 1998454784, "timestamp": "00:02:06.300", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 704512, "start_va": 1999044608, "type": "region", "version": 1 }, "end_va": 1999749119, "entry_point": 1999044608, "filename": "\\Windows\\SysWOW64\\rpcrt4.dll", "id": "region_4864", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\syswow64\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 1999044608, "timestamp": "00:02:06.300", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 274432, "start_va": 1999765504, "type": "region", "version": 1 }, "end_va": 2000039935, "entry_point": 1999765504, "filename": "\\Windows\\SysWOW64\\sechost.dll", "id": "region_4865", "name": "sechost.dll", "norm_filename": "c:\\windows\\syswow64\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 1999765504, "timestamp": "00:02:06.300", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 2124939264, "type": "region", "version": 1 }, "end_va": 2125987839, "entry_point": 0, "filename": null, "id": "region_4866", "name": "pagefile_0x000000007ea80000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 2124939264, "timestamp": "00:02:06.300", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2126151680, "type": "region", "version": 1 }, "end_va": 2126163967, "entry_point": 0, "filename": null, "id": "region_4867", "name": "private_0x000000007eba8000", "norm_filename": null, "region_type": "private_memory", "start_va": 2126151680, "timestamp": "00:02:06.300", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 7733248, "type": "region", "version": 1 }, "end_va": 7741439, "entry_point": 0, "filename": null, "id": "region_4868", "name": "pagefile_0x0000000000760000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 7733248, "timestamp": "00:02:06.374", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 212992, "start_va": 7798784, "type": "region", "version": 1 }, "end_va": 8011775, "entry_point": 0, "filename": null, "id": "region_4869", "name": "private_0x0000000000770000", "norm_filename": null, "region_type": "private_memory", "start_va": 7798784, "timestamp": "00:02:06.374", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 8060928, "type": "region", "version": 1 }, "end_va": 8323071, "entry_point": 0, "filename": null, "id": "region_4870", "name": "private_0x00000000007b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 8060928, "timestamp": "00:02:06.374", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 262144, "start_va": 9568256, "type": "region", "version": 1 }, "end_va": 9830399, "entry_point": 0, "filename": null, "id": "region_4871", "name": "private_0x0000000000920000", "norm_filename": null, "region_type": "private_memory", "start_va": 9568256, "timestamp": "00:02:06.374", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 479232, "start_va": 1948057600, "type": "region", "version": 1 }, "end_va": 1948536831, "entry_point": 1948057600, "filename": "\\Windows\\SysWOW64\\uxtheme.dll", "id": "region_4872", "name": "uxtheme.dll", "norm_filename": "c:\\windows\\syswow64\\uxtheme.dll", "region_type": "memory_mapped_file", "start_va": 1948057600, "timestamp": "00:02:06.374", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 12288, "start_va": 2124926976, "type": "region", "version": 1 }, "end_va": 2124939263, "entry_point": 0, "filename": null, "id": "region_4873", "name": "private_0x000000007ea7d000", "norm_filename": null, "region_type": "private_memory", "start_va": 2124926976, "timestamp": "00:02:06.374", "type": "region", "version": 1 } ], "terminate_reason": "terminated", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "\"C:\\Program Files\\Microsoft Office\\root\\Office16\\ONENOTEM.EXE\" /tsr", "filename": "c:\\program files\\microsoft office\\root\\office16\\onenotem.exe", "id": "proc_21", "image_name": "onenotem.exe", "monitor_reason": "child_process", "monitored_id": 21, "origin_monitor_id": 19, "ref_parent_process": { "ref_id": "proc_19", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_4617", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:02:04.327", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 131072, "start_va": 86359080960, "type": "region", "version": 1 }, "end_va": 86359212031, "entry_point": 0, "filename": null, "id": "region_4618", "name": "private_0x000000141b670000", "norm_filename": null, "region_type": "private_memory", "start_va": 86359080960, "timestamp": "00:02:04.327", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 86359212032, "type": "region", "version": 1 }, "end_va": 86359293951, "entry_point": 0, "filename": null, "id": "region_4619", "name": "pagefile_0x000000141b690000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 86359212032, "timestamp": "00:02:04.327", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 86359343104, "type": "region", "version": 1 }, "end_va": 86360391679, "entry_point": 0, "filename": null, "id": "region_4620", "name": "private_0x000000141b6b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 86359343104, "timestamp": "00:02:04.327", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 86360391680, "type": "region", "version": 1 }, "end_va": 86360408063, "entry_point": 0, "filename": null, "id": "region_4621", "name": "pagefile_0x000000141b7b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 86360391680, "timestamp": "00:02:04.327", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 86360457216, "type": "region", "version": 1 }, "end_va": 86360461311, "entry_point": 0, "filename": null, "id": "region_4622", "name": "pagefile_0x000000141b7c0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 86360457216, "timestamp": "00:02:04.327", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 86360522752, "type": "region", "version": 1 }, "end_va": 86360530943, "entry_point": 0, "filename": null, "id": "region_4623", "name": "private_0x000000141b7d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 86360522752, "timestamp": "00:02:04.327", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 140701756882944, "type": "region", "version": 1 }, "end_va": 140701757026303, "entry_point": 0, "filename": null, "id": "region_4624", "name": "pagefile_0x00007ff7ae3d0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140701756882944, "timestamp": "00:02:04.327", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 140701757059072, "type": "region", "version": 1 }, "end_va": 140701757063167, "entry_point": 0, "filename": null, "id": "region_4625", "name": "private_0x00007ff7ae3fb000", "norm_filename": null, "region_type": "private_memory", "start_va": 140701757059072, "timestamp": "00:02:04.327", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140701757071360, "type": "region", "version": 1 }, "end_va": 140701757079551, "entry_point": 0, "filename": null, "id": "region_4626", "name": "private_0x00007ff7ae3fe000", "norm_filename": null, "region_type": "private_memory", "start_va": 140701757071360, "timestamp": "00:02:04.327", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 192512, "start_va": 140701761929216, "type": "region", "version": 1 }, "end_va": 140701762121727, "entry_point": 140701761929216, "filename": "\\Program Files\\Microsoft Office\\root\\Office16\\ONENOTEM.EXE", "id": "region_4627", "name": "onenotem.exe", "norm_filename": "c:\\program files\\microsoft office\\root\\office16\\onenotem.exe", "region_type": "memory_mapped_file", "start_va": 140701761929216, "timestamp": "00:02:04.327", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140717747994624, "type": "region", "version": 1 }, "end_va": 140717749837823, "entry_point": 140717747994624, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_4628", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140717747994624, "timestamp": "00:02:04.341", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 86359080960, "type": "region", "version": 1 }, "end_va": 86359146495, "entry_point": 0, "filename": null, "id": "region_4643", "name": "pagefile_0x000000141b670000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 86359080960, "timestamp": "00:02:05.814", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 86361571328, "type": "region", "version": 1 }, "end_va": 86362619903, "entry_point": 0, "filename": null, "id": "region_4644", "name": "private_0x000000141b8d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 86361571328, "timestamp": "00:02:05.814", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 140701755834368, "type": "region", "version": 1 }, "end_va": 140701756882943, "entry_point": 0, "filename": null, "id": "region_4645", "name": "pagefile_0x00007ff7ae2d0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140701755834368, "timestamp": "00:02:05.814", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1953792, "start_va": 140717702053888, "type": "region", "version": 1 }, "end_va": 140717704007679, "entry_point": 140717702053888, "filename": "\\Windows\\System32\\KernelBase.dll", "id": "region_4646", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\system32\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 140717702053888, "timestamp": "00:02:05.814", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 708608, "start_va": 140717742424064, "type": "region", "version": 1 }, "end_va": 140717743132671, "entry_point": 140717742424064, "filename": "\\Windows\\System32\\kernel32.dll", "id": "region_4647", "name": "kernel32.dll", "norm_filename": "c:\\windows\\system32\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 140717742424064, "timestamp": "00:02:05.814", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 86360588288, "type": "region", "version": 1 }, "end_va": 86361366527, "entry_point": 86360588288, "filename": "\\Windows\\System32\\locale.nls", "id": "region_4648", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 86360588288, "timestamp": "00:02:05.818", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 491520, "start_va": 140717665681408, "type": "region", "version": 1 }, "end_va": 140717666172927, "entry_point": 140717665681408, "filename": "\\Windows\\System32\\apphelp.dll", "id": "region_4649", "name": "apphelp.dll", "norm_filename": "c:\\windows\\system32\\apphelp.dll", "region_type": "memory_mapped_file", "start_va": 140717665681408, "timestamp": "00:02:05.818", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 86359146496, "type": "region", "version": 1 }, "end_va": 86359175167, "entry_point": 0, "filename": null, "id": "region_4791", "name": "private_0x000000141b680000", "norm_filename": null, "region_type": "private_memory", "start_va": 86359146496, "timestamp": "00:02:06.209", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 86361374720, "type": "region", "version": 1 }, "end_va": 86361378815, "entry_point": 0, "filename": null, "id": "region_4792", "name": "pagefile_0x000000141b8a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 86361374720, "timestamp": "00:02:06.209", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 86361440256, "type": "region", "version": 1 }, "end_va": 86361444351, "entry_point": 0, "filename": null, "id": "region_4793", "name": "pagefile_0x000000141b8b0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 86361440256, "timestamp": "00:02:06.209", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 86361505792, "type": "region", "version": 1 }, "end_va": 86361534463, "entry_point": 0, "filename": null, "id": "region_4794", "name": "private_0x000000141b8c0000", "norm_filename": null, "region_type": "private_memory", "start_va": 86361505792, "timestamp": "00:02:06.209", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 86362619904, "type": "region", "version": 1 }, "end_va": 86363668479, "entry_point": 0, "filename": null, "id": "region_4795", "name": "private_0x000000141b9d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 86362619904, "timestamp": "00:02:06.209", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 86363668480, "type": "region", "version": 1 }, "end_va": 86363672575, "entry_point": 0, "filename": null, "id": "region_4796", "name": "private_0x000000141bad0000", "norm_filename": null, "region_type": "private_memory", "start_va": 86363668480, "timestamp": "00:02:06.209", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 86363734016, "type": "region", "version": 1 }, "end_va": 86363738111, "entry_point": 0, "filename": null, "id": "region_4797", "name": "private_0x000000141bae0000", "norm_filename": null, "region_type": "private_memory", "start_va": 86363734016, "timestamp": "00:02:06.209", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 86365110272, "type": "region", "version": 1 }, "end_va": 86365175807, "entry_point": 0, "filename": null, "id": "region_4798", "name": "private_0x000000141bc30000", "norm_filename": null, "region_type": "private_memory", "start_va": 86365110272, "timestamp": "00:02:06.209", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 86365175808, "type": "region", "version": 1 }, "end_va": 86366781439, "entry_point": 0, "filename": null, "id": "region_4799", "name": "pagefile_0x000000141bc40000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 86365175808, "timestamp": "00:02:06.209", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 86366814208, "type": "region", "version": 1 }, "end_va": 86368391167, "entry_point": 0, "filename": null, "id": "region_4800", "name": "pagefile_0x000000141bdd0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 86366814208, "timestamp": "00:02:06.209", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 86368452608, "type": "region", "version": 1 }, "end_va": 86389424127, "entry_point": 0, "filename": null, "id": "region_4801", "name": "pagefile_0x000000141bf60000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 86368452608, "timestamp": "00:02:06.210", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140701757063168, "type": "region", "version": 1 }, "end_va": 140701757071359, "entry_point": 0, "filename": null, "id": "region_4802", "name": "private_0x00007ff7ae3fc000", "norm_filename": null, "region_type": "private_memory", "start_va": 140701757063168, "timestamp": "00:02:06.210", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 94208, "start_va": 140717447643136, "type": "region", "version": 1 }, "end_va": 140717447737343, "entry_point": 140717447643136, "filename": "\\Program Files\\Microsoft Office\\root\\Office16\\vcruntime140.dll", "id": "region_4803", "name": "vcruntime140.dll", "norm_filename": "c:\\program files\\microsoft office\\root\\office16\\vcruntime140.dll", "region_type": "memory_mapped_file", "start_va": 140717447643136, "timestamp": "00:02:06.210", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1216512, "start_va": 140717502300160, "type": "region", "version": 1 }, "end_va": 140717503516671, "entry_point": 140717502300160, "filename": "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll", "id": "region_4804", "name": "c2r64.dll", "norm_filename": "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll", "region_type": "memory_mapped_file", "start_va": 140717502300160, "timestamp": "00:02:06.210", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2318336, "start_va": 140717503545344, "type": "region", "version": 1 }, "end_va": 140717505863679, "entry_point": 140717503545344, "filename": "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll", "id": "region_4805", "name": "appvisvsubsystems64.dll", "norm_filename": "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll", "region_type": "memory_mapped_file", "start_va": 140717503545344, "timestamp": "00:02:06.214", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 499712, "start_va": 140717507149824, "type": "region", "version": 1 }, "end_va": 140717507649535, "entry_point": 140717507149824, "filename": "\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll", "id": "region_4806", "name": "appvisvstream64.dll", "norm_filename": "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll", "region_type": "memory_mapped_file", "start_va": 140717507149824, "timestamp": "00:02:06.215", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1740800, "start_va": 140717588086784, "type": "region", "version": 1 }, "end_va": 140717589827583, "entry_point": 140717588086784, "filename": "\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_89a94c179af51f83\\GdiPlus.dll", "id": "region_4807", "name": "gdiplus.dll", "norm_filename": "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10240.16384_none_89a94c179af51f83\\gdiplus.dll", "region_type": "memory_mapped_file", "start_va": 140717588086784, "timestamp": "00:02:06.216", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 991232, "start_va": 140717622886400, "type": "region", "version": 1 }, "end_va": 140717623877631, "entry_point": 140717622886400, "filename": "\\Windows\\System32\\ucrtbase.dll", "id": "region_4808", "name": "ucrtbase.dll", "norm_filename": "c:\\windows\\system32\\ucrtbase.dll", "region_type": "memory_mapped_file", "start_va": 140717622886400, "timestamp": "00:02:06.216", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 28672, "start_va": 140717656571904, "type": "region", "version": 1 }, "end_va": 140717656600575, "entry_point": 140717656571904, "filename": "\\Windows\\System32\\msimg32.dll", "id": "region_4809", "name": "msimg32.dll", "norm_filename": "c:\\windows\\system32\\msimg32.dll", "region_type": "memory_mapped_file", "start_va": 140717656571904, "timestamp": "00:02:06.216", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 126976, "start_va": 140717680754688, "type": "region", "version": 1 }, "end_va": 140717680881663, "entry_point": 140717680754688, "filename": "\\Windows\\System32\\userenv.dll", "id": "region_4810", "name": "userenv.dll", "norm_filename": "c:\\windows\\system32\\userenv.dll", "region_type": "memory_mapped_file", "start_va": 140717680754688, "timestamp": "00:02:06.216", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 45056, "start_va": 140717685538816, "type": "region", "version": 1 }, "end_va": 140717685583871, "entry_point": 140717685538816, "filename": "\\Windows\\System32\\cryptbase.dll", "id": "region_4811", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\system32\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 140717685538816, "timestamp": "00:02:06.216", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 438272, "start_va": 140717689798656, "type": "region", "version": 1 }, "end_va": 140717690236927, "entry_point": 140717689798656, "filename": "\\Windows\\System32\\bcryptprimitives.dll", "id": "region_4812", "name": "bcryptprimitives.dll", "norm_filename": "c:\\windows\\system32\\bcryptprimitives.dll", "region_type": "memory_mapped_file", "start_va": 140717689798656, "timestamp": "00:02:06.216", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 77824, "start_va": 140717691568128, "type": "region", "version": 1 }, "end_va": 140717691645951, "entry_point": 140717691568128, "filename": "\\Windows\\System32\\profapi.dll", "id": "region_4813", "name": "profapi.dll", "norm_filename": "c:\\windows\\system32\\profapi.dll", "region_type": "memory_mapped_file", "start_va": 140717691568128, "timestamp": "00:02:06.216", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 303104, "start_va": 140717691699200, "type": "region", "version": 1 }, "end_va": 140717692002303, "entry_point": 140717691699200, "filename": "\\Windows\\System32\\powrprof.dll", "id": "region_4814", "name": "powrprof.dll", "norm_filename": "c:\\windows\\system32\\powrprof.dll", "region_type": "memory_mapped_file", "start_va": 140717691699200, "timestamp": "00:02:06.216", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 61440, "start_va": 140717692026880, "type": "region", "version": 1 }, "end_va": 140717692088319, "entry_point": 140717692026880, "filename": "\\Windows\\System32\\kernel.appcore.dll", "id": "region_4815", "name": "kernel.appcore.dll", "norm_filename": "c:\\windows\\system32\\kernel.appcore.dll", "region_type": "memory_mapped_file", "start_va": 140717692026880, "timestamp": "00:02:06.216", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 6455296, "start_va": 140717692551168, "type": "region", "version": 1 }, "end_va": 140717699006463, "entry_point": 140717692551168, "filename": "\\Windows\\System32\\windows.storage.dll", "id": "region_4816", "name": "windows.storage.dll", "norm_filename": "c:\\windows\\system32\\windows.storage.dll", "region_type": "memory_mapped_file", "start_va": 140717692551168, "timestamp": "00:02:06.217", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 733184, "start_va": 140717704019968, "type": "region", "version": 1 }, "end_va": 140717704753151, "entry_point": 140717704019968, "filename": "\\Windows\\System32\\SHCore.dll", "id": "region_4817", "name": "shcore.dll", "norm_filename": "c:\\windows\\system32\\shcore.dll", "region_type": "memory_mapped_file", "start_va": 140717704019968, "timestamp": "00:02:06.217", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 140717704806400, "type": "region", "version": 1 }, "end_va": 140717705584639, "entry_point": 140717704806400, "filename": "\\Windows\\System32\\oleaut32.dll", "id": "region_4818", "name": "oleaut32.dll", "norm_filename": "c:\\windows\\system32\\oleaut32.dll", "region_type": "memory_mapped_file", "start_va": 140717704806400, "timestamp": "00:02:06.217", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1593344, "start_va": 140717707493376, "type": "region", "version": 1 }, "end_va": 140717709086719, "entry_point": 140717707493376, "filename": "\\Windows\\System32\\gdi32.dll", "id": "region_4819", "name": "gdi32.dll", "norm_filename": "c:\\windows\\system32\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 140717707493376, "timestamp": "00:02:06.217", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 22171648, "start_va": 140717709131776, "type": "region", "version": 1 }, "end_va": 140717731303423, "entry_point": 140717709131776, "filename": "\\Windows\\System32\\shell32.dll", "id": "region_4820", "name": "shell32.dll", "norm_filename": "c:\\windows\\system32\\shell32.dll", "region_type": "memory_mapped_file", "start_va": 140717709131776, "timestamp": "00:02:06.217", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1204224, "start_va": 140717731348480, "type": "region", "version": 1 }, "end_va": 140717732552703, "entry_point": 140717731348480, "filename": "\\Windows\\System32\\rpcrt4.dll", "id": "region_4821", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\system32\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 140717731348480, "timestamp": "00:02:06.218", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 221184, "start_va": 140717732659200, "type": "region", "version": 1 }, "end_va": 140717732880383, "entry_point": 140717732659200, "filename": "\\Windows\\System32\\imm32.dll", "id": "region_4822", "name": "imm32.dll", "norm_filename": "c:\\windows\\system32\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 140717732659200, "timestamp": "00:02:06.218", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1368064, "start_va": 140717732921344, "type": "region", "version": 1 }, "end_va": 140717734289407, "entry_point": 140717732921344, "filename": "\\Windows\\System32\\user32.dll", "id": "region_4823", "name": "user32.dll", "norm_filename": "c:\\windows\\system32\\user32.dll", "region_type": "memory_mapped_file", "start_va": 140717732921344, "timestamp": "00:02:06.218", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 331776, "start_va": 140717736525824, "type": "region", "version": 1 }, "end_va": 140717736857599, "entry_point": 140717736525824, "filename": "\\Windows\\System32\\shlwapi.dll", "id": "region_4824", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\system32\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 140717736525824, "timestamp": "00:02:06.218", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2605056, "start_va": 140717737312256, "type": "region", "version": 1 }, "end_va": 140717739917311, "entry_point": 140717737312256, "filename": "\\Windows\\System32\\combase.dll", "id": "region_4825", "name": "combase.dll", "norm_filename": "c:\\windows\\system32\\combase.dll", "region_type": "memory_mapped_file", "start_va": 140717737312256, "timestamp": "00:02:06.218", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1314816, "start_va": 140717739933696, "type": "region", "version": 1 }, "end_va": 140717741248511, "entry_point": 140717739933696, "filename": "\\Windows\\System32\\ole32.dll", "id": "region_4826", "name": "ole32.dll", "norm_filename": "c:\\windows\\system32\\ole32.dll", "region_type": "memory_mapped_file", "start_va": 140717739933696, "timestamp": "00:02:06.218", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 643072, "start_va": 140717744521216, "type": "region", "version": 1 }, "end_va": 140717745164287, "entry_point": 140717744521216, "filename": "\\Windows\\System32\\msvcrt.dll", "id": "region_4827", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\system32\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 140717744521216, "timestamp": "00:02:06.218", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 679936, "start_va": 140717745373184, "type": "region", "version": 1 }, "end_va": 140717746053119, "entry_point": 140717745373184, "filename": "\\Windows\\System32\\advapi32.dll", "id": "region_4828", "name": "advapi32.dll", "norm_filename": "c:\\windows\\system32\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 140717745373184, "timestamp": "00:02:06.218", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1425408, "start_va": 140717746094080, "type": "region", "version": 1 }, "end_va": 140717747519487, "entry_point": 140717746094080, "filename": "\\Windows\\System32\\msctf.dll", "id": "region_4829", "name": "msctf.dll", "norm_filename": "c:\\windows\\system32\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 140717746094080, "timestamp": "00:02:06.218", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 372736, "start_va": 140717747601408, "type": "region", "version": 1 }, "end_va": 140717747974143, "entry_point": 140717747601408, "filename": "\\Windows\\System32\\sechost.dll", "id": "region_4830", "name": "sechost.dll", "norm_filename": "c:\\windows\\system32\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 140717747601408, "timestamp": "00:02:06.218", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 86363799552, "type": "region", "version": 1 }, "end_va": 86363803647, "entry_point": 0, "filename": null, "id": "region_4874", "name": "pagefile_0x000000141baf0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 86363799552, "timestamp": "00:02:06.474", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 86389424128, "type": "region", "version": 1 }, "end_va": 86392795135, "entry_point": 86389424128, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_4875", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 86389424128, "timestamp": "00:02:06.474", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 65536, "start_va": 140717747535872, "type": "region", "version": 1 }, "end_va": 140717747601407, "entry_point": 0, "filename": null, "id": "region_4876", "name": "private_0x00007ffb675b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 140717747535872, "timestamp": "00:02:06.474", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 86363865088, "type": "region", "version": 1 }, "end_va": 86364913663, "entry_point": 0, "filename": null, "id": "region_4877", "name": "private_0x000000141bb00000", "norm_filename": null, "region_type": "private_memory", "start_va": 86363865088, "timestamp": "00:02:06.526", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 86364913664, "type": "region", "version": 1 }, "end_va": 86364917759, "entry_point": 0, "filename": null, "id": "region_4878", "name": "private_0x000000141bc00000", "norm_filename": null, "region_type": "private_memory", "start_va": 86364913664, "timestamp": "00:02:06.526", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 86364979200, "type": "region", "version": 1 }, "end_va": 86364983295, "entry_point": 0, "filename": null, "id": "region_4879", "name": "private_0x000000141bc10000", "norm_filename": null, "region_type": "private_memory", "start_va": 86364979200, "timestamp": "00:02:06.526", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 86393880576, "type": "region", "version": 1 }, "end_va": 86393946111, "entry_point": 0, "filename": null, "id": "region_4880", "name": "private_0x000000141d7a0000", "norm_filename": null, "region_type": "private_memory", "start_va": 86393880576, "timestamp": "00:02:06.526", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 614400, "start_va": 140717667254272, "type": "region", "version": 1 }, "end_va": 140717667868671, "entry_point": 140717667254272, "filename": "\\Windows\\System32\\uxtheme.dll", "id": "region_4881", "name": "uxtheme.dll", "norm_filename": "c:\\windows\\system32\\uxtheme.dll", "region_type": "memory_mapped_file", "start_va": 140717667254272, "timestamp": "00:02:06.526", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 86365044736, "type": "region", "version": 1 }, "end_va": 86365052927, "entry_point": 0, "filename": null, "id": "region_4882", "name": "pagefile_0x000000141bc20000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 86365044736, "timestamp": "00:02:06.534", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 86393356288, "type": "region", "version": 1 }, "end_va": 86393421823, "entry_point": 0, "filename": null, "id": "region_4883", "name": "private_0x000000141d720000", "norm_filename": null, "region_type": "private_memory", "start_va": 86393356288, "timestamp": "00:02:06.534", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 3395584, "start_va": 140717584678912, "type": "region", "version": 1 }, "end_va": 140717588074495, "entry_point": 140717584678912, "filename": "\\Windows\\System32\\msi.dll", "id": "region_4884", "name": "msi.dll", "norm_filename": "c:\\windows\\system32\\msi.dll", "region_type": "memory_mapped_file", "start_va": 140717584678912, "timestamp": "00:02:06.534", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 163840, "start_va": 140717689602048, "type": "region", "version": 1 }, "end_va": 140717689765887, "entry_point": 140717689602048, "filename": "\\Windows\\System32\\bcrypt.dll", "id": "region_4885", "name": "bcrypt.dll", "norm_filename": "c:\\windows\\system32\\bcrypt.dll", "region_type": "memory_mapped_file", "start_va": 140717689602048, "timestamp": "00:02:06.534", "type": "region", "version": 1 } ], "terminate_reason": "timeout", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 }, { "cmd_line": "C:\\Windows\\System32\\RuntimeBroker.exe -Embedding", "filename": "c:\\windows\\system32\\runtimebroker.exe", "id": "proc_22", "image_name": "runtimebroker.exe", "monitor_reason": "injection", "monitored_id": 22, "origin_monitor_id": 19, "ref_parent_process": { "ref_id": "proc_19", "ref_source": "summary", "ref_type": "monitored_process", "type": "reference", "version": 1 }, "regions": [ { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable" ], "ref_process_dump": null, "size": 65536, "start_va": 2147352576, "type": "region", "version": 1 }, "end_va": 2147418111, "entry_point": 0, "filename": null, "id": "region_4650", "name": "private_0x000000007ffe0000", "norm_filename": null, "region_type": "private_memory", "start_va": 2147352576, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 65536, "start_va": 1074701729792, "type": "region", "version": 1 }, "end_va": 1074701795327, "entry_point": 0, "filename": null, "id": "region_4651", "name": "pagefile_0x000000fa39370000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1074701729792, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 1074701795328, "type": "region", "version": 1 }, "end_va": 1074701799423, "entry_point": 0, "filename": null, "id": "region_4652", "name": "private_0x000000fa39380000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074701795328, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 81920, "start_va": 1074701860864, "type": "region", "version": 1 }, "end_va": 1074701942783, "entry_point": 0, "filename": null, "id": "region_4653", "name": "pagefile_0x000000fa39390000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1074701860864, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 1074701991936, "type": "region", "version": 1 }, "end_va": 1074702516223, "entry_point": 0, "filename": null, "id": "region_4654", "name": "private_0x000000fa393b0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074701991936, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 16384, "start_va": 1074702516224, "type": "region", "version": 1 }, "end_va": 1074702532607, "entry_point": 0, "filename": null, "id": "region_4655", "name": "pagefile_0x000000fa39430000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1074702516224, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 8192, "start_va": 1074702581760, "type": "region", "version": 1 }, "end_va": 1074702589951, "entry_point": 0, "filename": null, "id": "region_4656", "name": "pagefile_0x000000fa39440000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1074702581760, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 1074702647296, "type": "region", "version": 1 }, "end_va": 1074702655487, "entry_point": 0, "filename": null, "id": "region_4657", "name": "private_0x000000fa39450000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074702647296, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 778240, "start_va": 1074702712832, "type": "region", "version": 1 }, "end_va": 1074703491071, "entry_point": 1074702712832, "filename": "\\Windows\\System32\\locale.nls", "id": "region_4658", "name": "locale.nls", "norm_filename": "c:\\windows\\system32\\locale.nls", "region_type": "memory_mapped_file", "start_va": 1074702712832, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 1074703499264, "type": "region", "version": 1 }, "end_va": 1074703503359, "entry_point": 0, "filename": null, "id": "region_4659", "name": "private_0x000000fa39520000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074703499264, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 1074703564800, "type": "region", "version": 1 }, "end_va": 1074703568895, "entry_point": 0, "filename": null, "id": "region_4660", "name": "pagefile_0x000000fa39530000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1074703564800, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 4096, "start_va": 1074703630336, "type": "region", "version": 1 }, "end_va": 1074703634431, "entry_point": 0, "filename": null, "id": "region_4661", "name": "pagefile_0x000000fa39540000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1074703630336, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 1074703695872, "type": "region", "version": 1 }, "end_va": 1074703724543, "entry_point": 0, "filename": null, "id": "region_4662", "name": "private_0x000000fa39550000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074703695872, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 1074703761408, "type": "region", "version": 1 }, "end_va": 1074704285695, "entry_point": 0, "filename": null, "id": "region_4663", "name": "private_0x000000fa39560000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074703761408, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 12288, "start_va": 1074704285696, "type": "region", "version": 1 }, "end_va": 1074704297983, "entry_point": 0, "filename": null, "id": "region_4664", "name": "pagefile_0x000000fa395e0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1074704285696, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 1074704351232, "type": "region", "version": 1 }, "end_va": 1074704355327, "entry_point": 0, "filename": null, "id": "region_4665", "name": "pagefile_0x000000fa395f0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1074704351232, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 1074704416768, "type": "region", "version": 1 }, "end_va": 1074705465343, "entry_point": 0, "filename": null, "id": "region_4666", "name": "private_0x000000fa39600000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074704416768, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 1074705465344, "type": "region", "version": 1 }, "end_va": 1074705989631, "entry_point": 0, "filename": null, "id": "region_4667", "name": "private_0x000000fa39700000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074705465344, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 1074705989632, "type": "region", "version": 1 }, "end_va": 1074706513919, "entry_point": 0, "filename": null, "id": "region_4668", "name": "private_0x000000fa39780000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074705989632, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 1074706513920, "type": "region", "version": 1 }, "end_va": 1074707038207, "entry_point": 0, "filename": null, "id": "region_4669", "name": "private_0x000000fa39800000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074706513920, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 1074707038208, "type": "region", "version": 1 }, "end_va": 1074707042303, "entry_point": 0, "filename": null, "id": "region_4670", "name": "pagefile_0x000000fa39880000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1074707038208, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 1074707103744, "type": "region", "version": 1 }, "end_va": 1074707132415, "entry_point": 0, "filename": null, "id": "region_4671", "name": "private_0x000000fa39890000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074707103744, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 172032, "start_va": 1074707169280, "type": "region", "version": 1 }, "end_va": 1074707341311, "entry_point": 0, "filename": null, "id": "region_4672", "name": "pagefile_0x000000fa398a0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1074707169280, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 1074707562496, "type": "region", "version": 1 }, "end_va": 1074708611071, "entry_point": 0, "filename": null, "id": "region_4673", "name": "private_0x000000fa39900000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074707562496, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1605632, "start_va": 1074708611072, "type": "region", "version": 1 }, "end_va": 1074710216703, "entry_point": 0, "filename": null, "id": "region_4674", "name": "pagefile_0x000000fa39a00000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1074708611072, "timestamp": "00:02:05.902", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1576960, "start_va": 1074710249472, "type": "region", "version": 1 }, "end_va": 1074711826431, "entry_point": 0, "filename": null, "id": "region_4675", "name": "pagefile_0x000000fa39b90000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1074710249472, "timestamp": "00:02:05.903", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "region_too_big" ], "info": "No dump was created because region size surpasses maximum region dump size of the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 20971520, "start_va": 1074711887872, "type": "region", "version": 1 }, "end_va": 1074732859391, "entry_point": 0, "filename": null, "id": "region_4676", "name": "pagefile_0x000000fa39d20000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1074711887872, "timestamp": "00:02:05.903", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable" ], "ref_process_dump": null, "size": 3371008, "start_va": 1074732859392, "type": "region", "version": 1 }, "end_va": 1074736230399, "entry_point": 1074732859392, "filename": "\\Windows\\Globalization\\Sorting\\SortDefault.nls", "id": "region_4677", "name": "sortdefault.nls", "norm_filename": "c:\\windows\\globalization\\sorting\\sortdefault.nls", "region_type": "memory_mapped_file", "start_va": 1074732859392, "timestamp": "00:02:05.903", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 1074736267264, "type": "region", "version": 1 }, "end_va": 1074736791551, "entry_point": 0, "filename": null, "id": "region_4678", "name": "private_0x000000fa3b460000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074736267264, "timestamp": "00:02:05.903", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 1074736791552, "type": "region", "version": 1 }, "end_va": 1074737315839, "entry_point": 0, "filename": null, "id": "region_4679", "name": "private_0x000000fa3b4e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074736791552, "timestamp": "00:02:05.903", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 28672, "start_va": 1074737512448, "type": "region", "version": 1 }, "end_va": 1074737541119, "entry_point": 0, "filename": null, "id": "region_4680", "name": "private_0x000000fa3b590000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074737512448, "timestamp": "00:02:05.903", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 1074737971200, "type": "region", "version": 1 }, "end_va": 1074739019775, "entry_point": 0, "filename": null, "id": "region_4681", "name": "private_0x000000fa3b600000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074737971200, "timestamp": "00:02:05.903", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 1074739019776, "type": "region", "version": 1 }, "end_va": 1074740068351, "entry_point": 0, "filename": null, "id": "region_4682", "name": "private_0x000000fa3b700000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074739019776, "timestamp": "00:02:05.903", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 1074740068352, "type": "region", "version": 1 }, "end_va": 1074740592639, "entry_point": 0, "filename": null, "id": "region_4683", "name": "private_0x000000fa3b800000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074740068352, "timestamp": "00:02:05.903", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 1074740592640, "type": "region", "version": 1 }, "end_va": 1074741116927, "entry_point": 0, "filename": null, "id": "region_4684", "name": "private_0x000000fa3b880000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074740592640, "timestamp": "00:02:05.903", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 1074741116928, "type": "region", "version": 1 }, "end_va": 1074741641215, "entry_point": 0, "filename": null, "id": "region_4685", "name": "private_0x000000fa3b900000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074741116928, "timestamp": "00:02:05.903", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 524288, "start_va": 1074741641216, "type": "region", "version": 1 }, "end_va": 1074742165503, "entry_point": 0, "filename": null, "id": "region_4686", "name": "private_0x000000fa3b980000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074741641216, "timestamp": "00:02:05.903", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "ignored_region" ], "info": "No dump was created because this is an ignored region", "permissions": [ "" ], "ref_process_dump": null, "size": 2199023255552, "start_va": 138495506972672, "type": "region", "version": 1 }, "end_va": 140694530228223, "entry_point": 0, "filename": null, "id": "region_4687", "name": "pagefile_0x00007df5ff7f0000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 138495506972672, "timestamp": "00:02:05.903", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 8724480, "start_va": 140695691853824, "type": "region", "version": 1 }, "end_va": 140695700578303, "entry_point": 140695695912976, "filename": "\\Windows\\System32\\ntoskrnl.exe", "id": "region_4688", "name": "ntoskrnl.exe", "norm_filename": "c:\\windows\\system32\\ntoskrnl.exe", "region_type": "memory_mapped_file", "start_va": 140695691853824, "timestamp": "00:02:05.904", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140696633827328, "type": "region", "version": 1 }, "end_va": 140696633835519, "entry_point": 0, "filename": null, "id": "region_4689", "name": "private_0x00007ff67ce16000", "norm_filename": null, "region_type": "private_memory", "start_va": 140696633827328, "timestamp": "00:02:05.904", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140696633835520, "type": "region", "version": 1 }, "end_va": 140696633843711, "entry_point": 0, "filename": null, "id": "region_4690", "name": "private_0x00007ff67ce18000", "norm_filename": null, "region_type": "private_memory", "start_va": 140696633835520, "timestamp": "00:02:05.904", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140696633843712, "type": "region", "version": 1 }, "end_va": 140696633851903, "entry_point": 0, "filename": null, "id": "region_4691", "name": "private_0x00007ff67ce1a000", "norm_filename": null, "region_type": "private_memory", "start_va": 140696633843712, "timestamp": "00:02:05.904", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140696633851904, "type": "region", "version": 1 }, "end_va": 140696633860095, "entry_point": 0, "filename": null, "id": "region_4692", "name": "private_0x00007ff67ce1c000", "norm_filename": null, "region_type": "private_memory", "start_va": 140696633851904, "timestamp": "00:02:05.904", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140696633860096, "type": "region", "version": 1 }, "end_va": 140696633868287, "entry_point": 0, "filename": null, "id": "region_4693", "name": "private_0x00007ff67ce1e000", "norm_filename": null, "region_type": "private_memory", "start_va": 140696633860096, "timestamp": "00:02:05.904", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 1048576, "start_va": 140696633868288, "type": "region", "version": 1 }, "end_va": 140696634916863, "entry_point": 0, "filename": null, "id": "region_4694", "name": "pagefile_0x00007ff67ce20000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140696633868288, "timestamp": "00:02:05.904", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable" ], "ref_process_dump": null, "size": 143360, "start_va": 140696634916864, "type": "region", "version": 1 }, "end_va": 140696635060223, "entry_point": 0, "filename": null, "id": "region_4695", "name": "pagefile_0x00007ff67cf20000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 140696634916864, "timestamp": "00:02:05.904", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140696635060224, "type": "region", "version": 1 }, "end_va": 140696635068415, "entry_point": 0, "filename": null, "id": "region_4696", "name": "private_0x00007ff67cf43000", "norm_filename": null, "region_type": "private_memory", "start_va": 140696635060224, "timestamp": "00:02:05.904", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140696635068416, "type": "region", "version": 1 }, "end_va": 140696635076607, "entry_point": 0, "filename": null, "id": "region_4697", "name": "private_0x00007ff67cf45000", "norm_filename": null, "region_type": "private_memory", "start_va": 140696635068416, "timestamp": "00:02:05.904", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140696635076608, "type": "region", "version": 1 }, "end_va": 140696635084799, "entry_point": 0, "filename": null, "id": "region_4698", "name": "private_0x00007ff67cf47000", "norm_filename": null, "region_type": "private_memory", "start_va": 140696635076608, "timestamp": "00:02:05.904", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140696635084800, "type": "region", "version": 1 }, "end_va": 140696635092991, "entry_point": 0, "filename": null, "id": "region_4699", "name": "private_0x00007ff67cf49000", "norm_filename": null, "region_type": "private_memory", "start_va": 140696635084800, "timestamp": "00:02:05.904", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140696635092992, "type": "region", "version": 1 }, "end_va": 140696635101183, "entry_point": 0, "filename": null, "id": "region_4700", "name": "private_0x00007ff67cf4b000", "norm_filename": null, "region_type": "private_memory", "start_va": 140696635092992, "timestamp": "00:02:05.904", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 140696635101184, "type": "region", "version": 1 }, "end_va": 140696635109375, "entry_point": 0, "filename": null, "id": "region_4701", "name": "private_0x00007ff67cf4d000", "norm_filename": null, "region_type": "private_memory", "start_va": 140696635101184, "timestamp": "00:02:05.904", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 4096, "start_va": 140696635109376, "type": "region", "version": 1 }, "end_va": 140696635113471, "entry_point": 0, "filename": null, "id": "region_4702", "name": "private_0x00007ff67cf4f000", "norm_filename": null, "region_type": "private_memory", "start_va": 140696635109376, "timestamp": "00:02:05.904", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 90112, "start_va": 140696641732608, "type": "region", "version": 1 }, "end_va": 140696641822719, "entry_point": 140696641732608, "filename": "\\Windows\\System32\\RuntimeBroker.exe", "id": "region_4703", "name": "runtimebroker.exe", "norm_filename": "c:\\windows\\system32\\runtimebroker.exe", "region_type": "memory_mapped_file", "start_va": 140696641732608, "timestamp": "00:02:05.904", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 229376, "start_va": 140717395410944, "type": "region", "version": 1 }, "end_va": 140717395640319, "entry_point": 140717395410944, "filename": "\\Windows\\System32\\Windows.Networking.HostName.dll", "id": "region_4704", "name": "windows.networking.hostname.dll", "norm_filename": "c:\\windows\\system32\\windows.networking.hostname.dll", "region_type": "memory_mapped_file", "start_va": 140717395410944, "timestamp": "00:02:05.904", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 155648, "start_va": 140717406879744, "type": "region", "version": 1 }, "end_va": 140717407035391, "entry_point": 140717406879744, "filename": "\\Windows\\System32\\AuthBroker.dll", "id": "region_4705", "name": "authbroker.dll", "norm_filename": "c:\\windows\\system32\\authbroker.dll", "region_type": "memory_mapped_file", "start_va": 140717406879744, "timestamp": "00:02:05.904", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 106496, "start_va": 140717407076352, "type": "region", "version": 1 }, "end_va": 140717407182847, "entry_point": 140717407076352, "filename": "\\Windows\\System32\\msauserext.dll", "id": "region_4706", "name": "msauserext.dll", "norm_filename": "c:\\windows\\system32\\msauserext.dll", "region_type": "memory_mapped_file", "start_va": 140717407076352, "timestamp": "00:02:05.905", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 733184, "start_va": 140717407666176, "type": "region", "version": 1 }, "end_va": 140717408399359, "entry_point": 140717407666176, "filename": "\\Windows\\System32\\Windows.Security.Authentication.OnlineId.dll", "id": "region_4707", "name": "windows.security.authentication.onlineid.dll", "norm_filename": "c:\\windows\\system32\\windows.security.authentication.onlineid.dll", "region_type": "memory_mapped_file", "start_va": 140717407666176, "timestamp": "00:02:05.906", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 598016, "start_va": 140717421821952, "type": "region", "version": 1 }, "end_va": 140717422419967, "entry_point": 140717421821952, "filename": "\\Windows\\System32\\Windows.Internal.Shell.Broker.dll", "id": "region_4708", "name": "windows.internal.shell.broker.dll", "norm_filename": "c:\\windows\\system32\\windows.internal.shell.broker.dll", "region_type": "memory_mapped_file", "start_va": 140717421821952, "timestamp": "00:02:05.907", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 90112, "start_va": 140717442793472, "type": "region", "version": 1 }, "end_va": 140717442883583, "entry_point": 140717442793472, "filename": "\\Windows\\System32\\wwapi.dll", "id": "region_4709", "name": "wwapi.dll", "norm_filename": "c:\\windows\\system32\\wwapi.dll", "region_type": "memory_mapped_file", "start_va": 140717442793472, "timestamp": "00:02:05.907", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 704512, "start_va": 140717443383296, "type": "region", "version": 1 }, "end_va": 140717444087807, "entry_point": 140717443383296, "filename": "\\Windows\\System32\\Windows.Networking.Connectivity.dll", "id": "region_4710", "name": "windows.networking.connectivity.dll", "norm_filename": "c:\\windows\\system32\\windows.networking.connectivity.dll", "region_type": "memory_mapped_file", "start_va": 140717443383296, "timestamp": "00:02:05.907", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 811008, "start_va": 140717478117376, "type": "region", "version": 1 }, "end_va": 140717478928383, "entry_point": 140717478117376, "filename": "\\Windows\\System32\\TokenBroker.dll", "id": "region_4711", "name": "tokenbroker.dll", "norm_filename": "c:\\windows\\system32\\tokenbroker.dll", "region_type": "memory_mapped_file", "start_va": 140717478117376, "timestamp": "00:02:05.907", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 86016, "start_va": 140717480935424, "type": "region", "version": 1 }, "end_va": 140717481021439, "entry_point": 140717480935424, "filename": "\\Windows\\System32\\execmodelproxy.dll", "id": "region_4712", "name": "execmodelproxy.dll", "norm_filename": "c:\\windows\\system32\\execmodelproxy.dll", "region_type": "memory_mapped_file", "start_va": 140717480935424, "timestamp": "00:02:05.907", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 274432, "start_va": 140717483163648, "type": "region", "version": 1 }, "end_va": 140717483438079, "entry_point": 140717483163648, "filename": "\\Windows\\System32\\ExecModelClient.dll", "id": "region_4713", "name": "execmodelclient.dll", "norm_filename": "c:\\windows\\system32\\execmodelclient.dll", "region_type": "memory_mapped_file", "start_va": 140717483163648, "timestamp": "00:02:05.907", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 4628480, "start_va": 140717485654016, "type": "region", "version": 1 }, "end_va": 140717490282495, "entry_point": 140717485654016, "filename": "\\Windows\\System32\\actxprxy.dll", "id": "region_4714", "name": "actxprxy.dll", "norm_filename": "c:\\windows\\system32\\actxprxy.dll", "region_type": "memory_mapped_file", "start_va": 140717485654016, "timestamp": "00:02:05.908", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2781184, "start_va": 140717493518336, "type": "region", "version": 1 }, "end_va": 140717496299519, "entry_point": 140717493518336, "filename": "\\Windows\\System32\\wininet.dll", "id": "region_4715", "name": "wininet.dll", "norm_filename": "c:\\windows\\system32\\wininet.dll", "region_type": "memory_mapped_file", "start_va": 140717493518336, "timestamp": "00:02:05.908", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 159744, "start_va": 140717501972480, "type": "region", "version": 1 }, "end_va": 140717502132223, "entry_point": 140717501972480, "filename": "\\Windows\\System32\\IDStore.dll", "id": "region_4716", "name": "idstore.dll", "norm_filename": "c:\\windows\\system32\\idstore.dll", "region_type": "memory_mapped_file", "start_va": 140717501972480, "timestamp": "00:02:05.908", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 57344, "start_va": 140717518159872, "type": "region", "version": 1 }, "end_va": 140717518217215, "entry_point": 140717518159872, "filename": "\\Windows\\System32\\npmproxy.dll", "id": "region_4717", "name": "npmproxy.dll", "norm_filename": "c:\\windows\\system32\\npmproxy.dll", "region_type": "memory_mapped_file", "start_va": 140717518159872, "timestamp": "00:02:05.908", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 389120, "start_va": 140717525172224, "type": "region", "version": 1 }, "end_va": 140717525561343, "entry_point": 140717525172224, "filename": "\\Windows\\System32\\wlanapi.dll", "id": "region_4718", "name": "wlanapi.dll", "norm_filename": "c:\\windows\\system32\\wlanapi.dll", "region_type": "memory_mapped_file", "start_va": 140717525172224, "timestamp": "00:02:05.908", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 258048, "start_va": 140717528776704, "type": "region", "version": 1 }, "end_va": 140717529034751, "entry_point": 140717528776704, "filename": "\\Windows\\System32\\netprofm.dll", "id": "region_4719", "name": "netprofm.dll", "norm_filename": "c:\\windows\\system32\\netprofm.dll", "region_type": "memory_mapped_file", "start_va": 140717528776704, "timestamp": "00:02:05.908", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1798144, "start_va": 140717548961792, "type": "region", "version": 1 }, "end_va": 140717550759935, "entry_point": 140717548961792, "filename": "\\Windows\\System32\\Windows.UI.Immersive.dll", "id": "region_4720", "name": "windows.ui.immersive.dll", "norm_filename": "c:\\windows\\system32\\windows.ui.immersive.dll", "region_type": "memory_mapped_file", "start_va": 140717548961792, "timestamp": "00:02:05.908", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1110016, "start_va": 140717571899392, "type": "region", "version": 1 }, "end_va": 140717573009407, "entry_point": 140717571899392, "filename": "\\Windows\\System32\\MrmCoreR.dll", "id": "region_4721", "name": "mrmcorer.dll", "norm_filename": "c:\\windows\\system32\\mrmcorer.dll", "region_type": "memory_mapped_file", "start_va": 140717571899392, "timestamp": "00:02:05.908", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1249280, "start_va": 140717630685184, "type": "region", "version": 1 }, "end_va": 140717631934463, "entry_point": 140717630685184, "filename": "\\Windows\\System32\\WinTypes.dll", "id": "region_4722", "name": "wintypes.dll", "norm_filename": "c:\\windows\\system32\\wintypes.dll", "region_type": "memory_mapped_file", "start_va": 140717630685184, "timestamp": "00:02:05.908", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 114688, "start_va": 140717631995904, "type": "region", "version": 1 }, "end_va": 140717632110591, "entry_point": 140717631995904, "filename": "\\Windows\\System32\\samlib.dll", "id": "region_4723", "name": "samlib.dll", "norm_filename": "c:\\windows\\system32\\samlib.dll", "region_type": "memory_mapped_file", "start_va": 140717631995904, "timestamp": "00:02:05.908", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 98304, "start_va": 140717636190208, "type": "region", "version": 1 }, "end_va": 140717636288511, "entry_point": 140717636190208, "filename": "\\Windows\\System32\\samcli.dll", "id": "region_4724", "name": "samcli.dll", "norm_filename": "c:\\windows\\system32\\samcli.dll", "region_type": "memory_mapped_file", "start_va": 140717636190208, "timestamp": "00:02:05.908", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1585152, "start_va": 140717637107712, "type": "region", "version": 1 }, "end_va": 140717638692863, "entry_point": 140717637107712, "filename": "\\Windows\\System32\\propsys.dll", "id": "region_4725", "name": "propsys.dll", "norm_filename": "c:\\windows\\system32\\propsys.dll", "region_type": "memory_mapped_file", "start_va": 140717637107712, "timestamp": "00:02:05.908", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 466944, "start_va": 140717638746112, "type": "region", "version": 1 }, "end_va": 140717639213055, "entry_point": 140717638746112, "filename": "\\Windows\\System32\\MMDevAPI.dll", "id": "region_4726", "name": "mmdevapi.dll", "norm_filename": "c:\\windows\\system32\\mmdevapi.dll", "region_type": "memory_mapped_file", "start_va": 140717638746112, "timestamp": "00:02:05.908", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 90112, "start_va": 140717640187904, "type": "region", "version": 1 }, "end_va": 140717640278015, "entry_point": 140717640187904, "filename": "\\Windows\\System32\\wkscli.dll", "id": "region_4727", "name": "wkscli.dll", "norm_filename": "c:\\windows\\system32\\wkscli.dll", "region_type": "memory_mapped_file", "start_va": 140717640187904, "timestamp": "00:02:05.908", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 45056, "start_va": 140717649821696, "type": "region", "version": 1 }, "end_va": 140717649866751, "entry_point": 140717649821696, "filename": "\\Windows\\System32\\winnsi.dll", "id": "region_4728", "name": "winnsi.dll", "norm_filename": "c:\\windows\\system32\\winnsi.dll", "region_type": "memory_mapped_file", "start_va": 140717649821696, "timestamp": "00:02:05.908", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 229376, "start_va": 140717649952768, "type": "region", "version": 1 }, "end_va": 140717650182143, "entry_point": 140717649952768, "filename": "\\Windows\\System32\\IPHLPAPI.DLL", "id": "region_4729", "name": "iphlpapi.dll", "norm_filename": "c:\\windows\\system32\\iphlpapi.dll", "region_type": "memory_mapped_file", "start_va": 140717649952768, "timestamp": "00:02:05.908", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 77824, "start_va": 140717654999040, "type": "region", "version": 1 }, "end_va": 140717655076863, "entry_point": 140717654999040, "filename": "\\Windows\\System32\\wtsapi32.dll", "id": "region_4730", "name": "wtsapi32.dll", "norm_filename": "c:\\windows\\system32\\wtsapi32.dll", "region_type": "memory_mapped_file", "start_va": 140717654999040, "timestamp": "00:02:05.908", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 151552, "start_va": 140717655588864, "type": "region", "version": 1 }, "end_va": 140717655740415, "entry_point": 140717655588864, "filename": "\\Windows\\System32\\sppc.dll", "id": "region_4731", "name": "sppc.dll", "norm_filename": "c:\\windows\\system32\\sppc.dll", "region_type": "memory_mapped_file", "start_va": 140717655588864, "timestamp": "00:02:05.908", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 155648, "start_va": 140717655785472, "type": "region", "version": 1 }, "end_va": 140717655941119, "entry_point": 140717655785472, "filename": "\\Windows\\System32\\slc.dll", "id": "region_4732", "name": "slc.dll", "norm_filename": "c:\\windows\\system32\\slc.dll", "region_type": "memory_mapped_file", "start_va": 140717655785472, "timestamp": "00:02:05.908", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 819200, "start_va": 140717660831744, "type": "region", "version": 1 }, "end_va": 140717661650943, "entry_point": 140717660831744, "filename": "\\Windows\\System32\\CoreMessaging.dll", "id": "region_4733", "name": "coremessaging.dll", "norm_filename": "c:\\windows\\system32\\coremessaging.dll", "region_type": "memory_mapped_file", "start_va": 140717660831744, "timestamp": "00:02:05.908", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 614400, "start_va": 140717667254272, "type": "region", "version": 1 }, "end_va": 140717667868671, "entry_point": 140717667254272, "filename": "\\Windows\\System32\\uxtheme.dll", "id": "region_4734", "name": "uxtheme.dll", "norm_filename": "c:\\windows\\system32\\uxtheme.dll", "region_type": "memory_mapped_file", "start_va": 140717667254272, "timestamp": "00:02:05.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 159744, "start_va": 140717667909632, "type": "region", "version": 1 }, "end_va": 140717668069375, "entry_point": 140717667909632, "filename": "\\Windows\\System32\\devobj.dll", "id": "region_4735", "name": "devobj.dll", "norm_filename": "c:\\windows\\system32\\devobj.dll", "region_type": "memory_mapped_file", "start_va": 140717667909632, "timestamp": "00:02:05.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 974848, "start_va": 140717669220352, "type": "region", "version": 1 }, "end_va": 140717670195199, "entry_point": 140717669220352, "filename": "\\Windows\\System32\\twinapi.appcore.dll", "id": "region_4736", "name": "twinapi.appcore.dll", "norm_filename": "c:\\windows\\system32\\twinapi.appcore.dll", "region_type": "memory_mapped_file", "start_va": 140717669220352, "timestamp": "00:02:05.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 49152, "start_va": 140717677215744, "type": "region", "version": 1 }, "end_va": 140717677264895, "entry_point": 140717677215744, "filename": "\\Windows\\System32\\netutils.dll", "id": "region_4737", "name": "netutils.dll", "norm_filename": "c:\\windows\\system32\\netutils.dll", "region_type": "memory_mapped_file", "start_va": 140717677215744, "timestamp": "00:02:05.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 208896, "start_va": 140717679771648, "type": "region", "version": 1 }, "end_va": 140717679980543, "entry_point": 140717679771648, "filename": "\\Windows\\System32\\rsaenh.dll", "id": "region_4738", "name": "rsaenh.dll", "norm_filename": "c:\\windows\\system32\\rsaenh.dll", "region_type": "memory_mapped_file", "start_va": 140717679771648, "timestamp": "00:02:05.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 126976, "start_va": 140717680754688, "type": "region", "version": 1 }, "end_va": 140717680881663, "entry_point": 140717680754688, "filename": "\\Windows\\System32\\userenv.dll", "id": "region_4739", "name": "userenv.dll", "norm_filename": "c:\\windows\\system32\\userenv.dll", "region_type": "memory_mapped_file", "start_va": 140717680754688, "timestamp": "00:02:05.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 94208, "start_va": 140717684031488, "type": "region", "version": 1 }, "end_va": 140717684125695, "entry_point": 140717684031488, "filename": "\\Windows\\System32\\cryptsp.dll", "id": "region_4740", "name": "cryptsp.dll", "norm_filename": "c:\\windows\\system32\\cryptsp.dll", "region_type": "memory_mapped_file", "start_va": 140717684031488, "timestamp": "00:02:05.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 45056, "start_va": 140717685538816, "type": "region", "version": 1 }, "end_va": 140717685583871, "entry_point": 140717685538816, "filename": "\\Windows\\System32\\cryptbase.dll", "id": "region_4741", "name": "cryptbase.dll", "norm_filename": "c:\\windows\\system32\\cryptbase.dll", "region_type": "memory_mapped_file", "start_va": 140717685538816, "timestamp": "00:02:05.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 180224, "start_va": 140717687504896, "type": "region", "version": 1 }, "end_va": 140717687685119, "entry_point": 140717687504896, "filename": "\\Windows\\System32\\sspicli.dll", "id": "region_4742", "name": "sspicli.dll", "norm_filename": "c:\\windows\\system32\\sspicli.dll", "region_type": "memory_mapped_file", "start_va": 140717687504896, "timestamp": "00:02:05.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 163840, "start_va": 140717689602048, "type": "region", "version": 1 }, "end_va": 140717689765887, "entry_point": 140717689602048, "filename": "\\Windows\\System32\\bcrypt.dll", "id": "region_4743", "name": "bcrypt.dll", "norm_filename": "c:\\windows\\system32\\bcrypt.dll", "region_type": "memory_mapped_file", "start_va": 140717689602048, "timestamp": "00:02:05.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 438272, "start_va": 140717689798656, "type": "region", "version": 1 }, "end_va": 140717690236927, "entry_point": 140717689798656, "filename": "\\Windows\\System32\\bcryptprimitives.dll", "id": "region_4744", "name": "bcryptprimitives.dll", "norm_filename": "c:\\windows\\system32\\bcryptprimitives.dll", "region_type": "memory_mapped_file", "start_va": 140717689798656, "timestamp": "00:02:05.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 622592, "start_va": 140717690257408, "type": "region", "version": 1 }, "end_va": 140717690879999, "entry_point": 140717690257408, "filename": "\\Windows\\System32\\sxs.dll", "id": "region_4745", "name": "sxs.dll", "norm_filename": "c:\\windows\\system32\\sxs.dll", "region_type": "memory_mapped_file", "start_va": 140717690257408, "timestamp": "00:02:05.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 77824, "start_va": 140717691568128, "type": "region", "version": 1 }, "end_va": 140717691645951, "entry_point": 140717691568128, "filename": "\\Windows\\System32\\profapi.dll", "id": "region_4746", "name": "profapi.dll", "norm_filename": "c:\\windows\\system32\\profapi.dll", "region_type": "memory_mapped_file", "start_va": 140717691568128, "timestamp": "00:02:05.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 303104, "start_va": 140717691699200, "type": "region", "version": 1 }, "end_va": 140717692002303, "entry_point": 140717691699200, "filename": "\\Windows\\System32\\powrprof.dll", "id": "region_4747", "name": "powrprof.dll", "norm_filename": "c:\\windows\\system32\\powrprof.dll", "region_type": "memory_mapped_file", "start_va": 140717691699200, "timestamp": "00:02:05.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 61440, "start_va": 140717692026880, "type": "region", "version": 1 }, "end_va": 140717692088319, "entry_point": 140717692026880, "filename": "\\Windows\\System32\\kernel.appcore.dll", "id": "region_4748", "name": "kernel.appcore.dll", "norm_filename": "c:\\windows\\system32\\kernel.appcore.dll", "region_type": "memory_mapped_file", "start_va": 140717692026880, "timestamp": "00:02:05.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 69632, "start_va": 140717692092416, "type": "region", "version": 1 }, "end_va": 140717692162047, "entry_point": 140717692092416, "filename": "\\Windows\\System32\\msasn1.dll", "id": "region_4749", "name": "msasn1.dll", "norm_filename": "c:\\windows\\system32\\msasn1.dll", "region_type": "memory_mapped_file", "start_va": 140717692092416, "timestamp": "00:02:05.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 278528, "start_va": 140717692223488, "type": "region", "version": 1 }, "end_va": 140717692502015, "entry_point": 140717692223488, "filename": "\\Windows\\System32\\cfgmgr32.dll", "id": "region_4750", "name": "cfgmgr32.dll", "norm_filename": "c:\\windows\\system32\\cfgmgr32.dll", "region_type": "memory_mapped_file", "start_va": 140717692223488, "timestamp": "00:02:05.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 6455296, "start_va": 140717692551168, "type": "region", "version": 1 }, "end_va": 140717699006463, "entry_point": 140717692551168, "filename": "\\Windows\\System32\\windows.storage.dll", "id": "region_4751", "name": "windows.storage.dll", "norm_filename": "c:\\windows\\system32\\windows.storage.dll", "region_type": "memory_mapped_file", "start_va": 140717692551168, "timestamp": "00:02:05.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1839104, "start_va": 140717699039232, "type": "region", "version": 1 }, "end_va": 140717700878335, "entry_point": 140717699039232, "filename": "\\Windows\\System32\\crypt32.dll", "id": "region_4752", "name": "crypt32.dll", "norm_filename": "c:\\windows\\system32\\crypt32.dll", "region_type": "memory_mapped_file", "start_va": 140717699039232, "timestamp": "00:02:05.909", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1953792, "start_va": 140717702053888, "type": "region", "version": 1 }, "end_va": 140717704007679, "entry_point": 140717702053888, "filename": "\\Windows\\System32\\KernelBase.dll", "id": "region_4753", "name": "kernelbase.dll", "norm_filename": "c:\\windows\\system32\\kernelbase.dll", "region_type": "memory_mapped_file", "start_va": 140717702053888, "timestamp": "00:02:05.910", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 733184, "start_va": 140717704019968, "type": "region", "version": 1 }, "end_va": 140717704753151, "entry_point": 140717704019968, "filename": "\\Windows\\System32\\SHCore.dll", "id": "region_4754", "name": "shcore.dll", "norm_filename": "c:\\windows\\system32\\shcore.dll", "region_type": "memory_mapped_file", "start_va": 140717704019968, "timestamp": "00:02:05.910", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 778240, "start_va": 140717704806400, "type": "region", "version": 1 }, "end_va": 140717705584639, "entry_point": 140717704806400, "filename": "\\Windows\\System32\\oleaut32.dll", "id": "region_4755", "name": "oleaut32.dll", "norm_filename": "c:\\windows\\system32\\oleaut32.dll", "region_type": "memory_mapped_file", "start_va": 140717704806400, "timestamp": "00:02:05.910", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1593344, "start_va": 140717707493376, "type": "region", "version": 1 }, "end_va": 140717709086719, "entry_point": 140717707493376, "filename": "\\Windows\\System32\\gdi32.dll", "id": "region_4756", "name": "gdi32.dll", "norm_filename": "c:\\windows\\system32\\gdi32.dll", "region_type": "memory_mapped_file", "start_va": 140717707493376, "timestamp": "00:02:05.910", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 22171648, "start_va": 140717709131776, "type": "region", "version": 1 }, "end_va": 140717731303423, "entry_point": 140717709131776, "filename": "\\Windows\\System32\\shell32.dll", "id": "region_4757", "name": "shell32.dll", "norm_filename": "c:\\windows\\system32\\shell32.dll", "region_type": "memory_mapped_file", "start_va": 140717709131776, "timestamp": "00:02:05.910", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1204224, "start_va": 140717731348480, "type": "region", "version": 1 }, "end_va": 140717732552703, "entry_point": 140717731348480, "filename": "\\Windows\\System32\\rpcrt4.dll", "id": "region_4758", "name": "rpcrt4.dll", "norm_filename": "c:\\windows\\system32\\rpcrt4.dll", "region_type": "memory_mapped_file", "start_va": 140717731348480, "timestamp": "00:02:05.910", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 221184, "start_va": 140717732659200, "type": "region", "version": 1 }, "end_va": 140717732880383, "entry_point": 140717732659200, "filename": "\\Windows\\System32\\imm32.dll", "id": "region_4759", "name": "imm32.dll", "norm_filename": "c:\\windows\\system32\\imm32.dll", "region_type": "memory_mapped_file", "start_va": 140717732659200, "timestamp": "00:02:05.910", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1368064, "start_va": 140717732921344, "type": "region", "version": 1 }, "end_va": 140717734289407, "entry_point": 140717732921344, "filename": "\\Windows\\System32\\user32.dll", "id": "region_4760", "name": "user32.dll", "norm_filename": "c:\\windows\\system32\\user32.dll", "region_type": "memory_mapped_file", "start_va": 140717732921344, "timestamp": "00:02:05.910", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 331776, "start_va": 140717736525824, "type": "region", "version": 1 }, "end_va": 140717736857599, "entry_point": 140717736525824, "filename": "\\Windows\\System32\\shlwapi.dll", "id": "region_4761", "name": "shlwapi.dll", "norm_filename": "c:\\windows\\system32\\shlwapi.dll", "region_type": "memory_mapped_file", "start_va": 140717736525824, "timestamp": "00:02:05.910", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 2605056, "start_va": 140717737312256, "type": "region", "version": 1 }, "end_va": 140717739917311, "entry_point": 140717737312256, "filename": "\\Windows\\System32\\combase.dll", "id": "region_4762", "name": "combase.dll", "norm_filename": "c:\\windows\\system32\\combase.dll", "region_type": "memory_mapped_file", "start_va": 140717737312256, "timestamp": "00:02:05.911", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1314816, "start_va": 140717739933696, "type": "region", "version": 1 }, "end_va": 140717741248511, "entry_point": 140717739933696, "filename": "\\Windows\\System32\\ole32.dll", "id": "region_4763", "name": "ole32.dll", "norm_filename": "c:\\windows\\system32\\ole32.dll", "region_type": "memory_mapped_file", "start_va": 140717739933696, "timestamp": "00:02:05.911", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 675840, "start_va": 140717741703168, "type": "region", "version": 1 }, "end_va": 140717742379007, "entry_point": 140717741703168, "filename": "\\Windows\\System32\\clbcatq.dll", "id": "region_4764", "name": "clbcatq.dll", "norm_filename": "c:\\windows\\system32\\clbcatq.dll", "region_type": "memory_mapped_file", "start_va": 140717741703168, "timestamp": "00:02:05.911", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 708608, "start_va": 140717742424064, "type": "region", "version": 1 }, "end_va": 140717743132671, "entry_point": 140717742424064, "filename": "\\Windows\\System32\\kernel32.dll", "id": "region_4765", "name": "kernel32.dll", "norm_filename": "c:\\windows\\system32\\kernel32.dll", "region_type": "memory_mapped_file", "start_va": 140717742424064, "timestamp": "00:02:05.911", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 643072, "start_va": 140717744521216, "type": "region", "version": 1 }, "end_va": 140717745164287, "entry_point": 140717744521216, "filename": "\\Windows\\System32\\msvcrt.dll", "id": "region_4766", "name": "msvcrt.dll", "norm_filename": "c:\\windows\\system32\\msvcrt.dll", "region_type": "memory_mapped_file", "start_va": 140717744521216, "timestamp": "00:02:05.911", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 140717745307648, "type": "region", "version": 1 }, "end_va": 140717745340415, "entry_point": 140717745307648, "filename": "\\Windows\\System32\\nsi.dll", "id": "region_4767", "name": "nsi.dll", "norm_filename": "c:\\windows\\system32\\nsi.dll", "region_type": "memory_mapped_file", "start_va": 140717745307648, "timestamp": "00:02:05.911", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 679936, "start_va": 140717745373184, "type": "region", "version": 1 }, "end_va": 140717746053119, "entry_point": 140717745373184, "filename": "\\Windows\\System32\\advapi32.dll", "id": "region_4768", "name": "advapi32.dll", "norm_filename": "c:\\windows\\system32\\advapi32.dll", "region_type": "memory_mapped_file", "start_va": 140717745373184, "timestamp": "00:02:05.911", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1425408, "start_va": 140717746094080, "type": "region", "version": 1 }, "end_va": 140717747519487, "entry_point": 140717746094080, "filename": "\\Windows\\System32\\msctf.dll", "id": "region_4769", "name": "msctf.dll", "norm_filename": "c:\\windows\\system32\\msctf.dll", "region_type": "memory_mapped_file", "start_va": 140717746094080, "timestamp": "00:02:05.911", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 372736, "start_va": 140717747601408, "type": "region", "version": 1 }, "end_va": 140717747974143, "entry_point": 140717747601408, "filename": "\\Windows\\System32\\sechost.dll", "id": "region_4770", "name": "sechost.dll", "norm_filename": "c:\\windows\\system32\\sechost.dll", "region_type": "memory_mapped_file", "start_va": 140717747601408, "timestamp": "00:02:05.911", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 1843200, "start_va": 140717747994624, "type": "region", "version": 1 }, "end_va": 140717749837823, "entry_point": 140717747994624, "filename": "\\Windows\\System32\\ntdll.dll", "id": "region_4771", "name": "ntdll.dll", "norm_filename": "c:\\windows\\system32\\ntdll.dll", "region_type": "memory_mapped_file", "start_va": 140717747994624, "timestamp": "00:02:05.911", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "pagefile_backed_regions_ignored" ], "info": "No dump created because pagefile backed regions are disabled in the configuration", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 598016, "start_va": 1074742165504, "type": "region", "version": 1 }, "end_va": 1074742763519, "entry_point": 0, "filename": null, "id": "region_4778", "name": "pagefile_0x000000fa3ba00000", "norm_filename": null, "region_type": "pagefile_backed_memory", "start_va": 1074742165504, "timestamp": "00:02:06.019", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 4096, "start_va": 1074707365888, "type": "region", "version": 1 }, "end_va": 1074707369983, "entry_point": 0, "filename": null, "id": "region_4779", "name": "private_0x000000fa398d0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074707365888, "timestamp": "00:02:06.063", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 36864, "start_va": 1074707431424, "type": "region", "version": 1 }, "end_va": 1074707468287, "entry_point": 0, "filename": null, "id": "region_4780", "name": "private_0x000000fa398e0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074707431424, "timestamp": "00:02:06.101", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 2097152, "start_va": 1074742820864, "type": "region", "version": 1 }, "end_va": 1074744918015, "entry_point": 0, "filename": null, "id": "region_4781", "name": "private_0x000000fa3baa0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074742820864, "timestamp": "00:02:06.102", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 1074743214080, "type": "region", "version": 1 }, "end_va": 1074744262655, "entry_point": 0, "filename": null, "id": "region_4782", "name": "private_0x000000fa3bb00000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074743214080, "timestamp": "00:02:06.102", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 2097152, "start_va": 1074744262656, "type": "region", "version": 1 }, "end_va": 1074746359807, "entry_point": 0, "filename": null, "id": "region_4783", "name": "private_0x000000fa3bc00000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074744262656, "timestamp": "00:02:06.103", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 1074744262656, "type": "region", "version": 1 }, "end_va": 1074745311231, "entry_point": 0, "filename": null, "id": "region_4784", "name": "private_0x000000fa3bc00000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074744262656, "timestamp": "00:02:06.103", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 2097152, "start_va": 1074745311232, "type": "region", "version": 1 }, "end_va": 1074747408383, "entry_point": 0, "filename": null, "id": "region_4785", "name": "private_0x000000fa3bd00000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074745311232, "timestamp": "00:02:06.103", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 1074745311232, "type": "region", "version": 1 }, "end_va": 1074746359807, "entry_point": 0, "filename": null, "id": "region_4786", "name": "private_0x000000fa3bd00000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074745311232, "timestamp": "00:02:06.104", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 2097152, "start_va": 1074746359808, "type": "region", "version": 1 }, "end_va": 1074748456959, "entry_point": 0, "filename": null, "id": "region_4787", "name": "private_0x000000fa3be00000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074746359808, "timestamp": "00:02:06.104", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 1048576, "start_va": 1074746359808, "type": "region", "version": 1 }, "end_va": 1074747408383, "entry_point": 0, "filename": null, "id": "region_4788", "name": "private_0x000000fa3be00000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074746359808, "timestamp": "00:02:06.104", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "max_num_dumps_reached" ], "info": "No dump was created because the maximum number of dumps was reached", "permissions": [ "readable", "writable" ], "ref_process_dump": null, "size": 8192, "start_va": 1074707496960, "type": "region", "version": 1 }, "end_va": 1074707505151, "entry_point": 0, "filename": null, "id": "region_4789", "name": "private_0x000000fa398f0000", "norm_filename": null, "region_type": "private_memory", "start_va": 1074707496960, "timestamp": "00:02:06.105", "type": "region", "version": 1 }, { "dump": { "filename": "", "flags": [ "unmonitored" ], "info": "No dump was created because region is not monitored", "permissions": [ "readable", "writable", "executable" ], "ref_process_dump": null, "size": 32768, "start_va": 140717732593664, "type": "region", "version": 1 }, "end_va": 140717732626431, "entry_point": 140717732593664, "filename": "\\Windows\\System32\\psapi.dll", "id": "region_4790", "name": "psapi.dll", "norm_filename": "c:\\windows\\system32\\psapi.dll", "region_type": "memory_mapped_file", "start_va": 140717732593664, "timestamp": "00:02:06.150", "type": "region", "version": 1 } ], "terminate_reason": "timeout", "type": "monitored_process", "unmonitor_reason": "terminated_by_timeout", "version": 1 } ], "remarks": { "critical": [], "non_critical": [ { "comment": "The maximum number of extracted files was reached during the analysis. Some files may be missing in the reports. You can increase the limit in the configuration.", "id": 1024, "type": "remark", "version": 1 }, { "comment": "The maximum number of dumps was reached during the analysis. Some memory dumps may be missing in the reports. You can increase the limit in the configuration.", "id": 2048, "type": "remark", "version": 1 }, { "comment": "The dump total size limit was reached during the analysis. Some memory dump may be missing in the reports. You can increase the limit in the configuration.", "id": 512, "type": "remark", "version": 1 }, { "comment": "The operating system was rebooted during the analysis.", "id": 128, "type": "remark", "version": 1 } ], "type": "remarks", "version": 1 }, "sample_details": { "filename": "2999babb0c6ca9fcc1aa03ad5606043d70f45a1495820c7a22250a584d371d70.wsf", "id": 20551, "md5_hash": "0f0e9fe1d73ea9c0587fb9b1489207f0", "sample_type": "windows_script_file", "sha1_hash": "aa6cbb4f448a3e7654bc7272936239f176e05712", "sha256_hash": "2999babb0c6ca9fcc1aa03ad5606043d70f45a1495820c7a22250a584d371d70", "size": 97272, "type": "sample_details", "version": 1 }, "screenshots": [ { "screenshot_archive_path": "screenshots/screenshot_0.png", "size": 543262, "thumbnail_archive_path": "screenshots/thumbnail_0.png", "timestamp": "00:00:00.000", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_19996.png", "size": 256739, "thumbnail_archive_path": "screenshots/thumbnail_19996.png", "timestamp": "00:00:19.996", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_22710.png", "size": 540262, "thumbnail_archive_path": "screenshots/thumbnail_22710.png", "timestamp": "00:00:22.710", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_27738.png", "size": 350296, "thumbnail_archive_path": "screenshots/thumbnail_27738.png", "timestamp": "00:00:27.738", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_44975.png", "size": 540260, "thumbnail_archive_path": "screenshots/thumbnail_44975.png", "timestamp": "00:00:44.975", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_97681.png", "size": 3848, "thumbnail_archive_path": "screenshots/thumbnail_97681.png", "timestamp": "00:01:37.681", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_102715.png", "size": 458545, "thumbnail_archive_path": "screenshots/thumbnail_102715.png", "timestamp": "00:01:42.715", "type": "screenshot", "version": 1 }, { "screenshot_archive_path": "screenshots/screenshot_110841.png", "size": 537431, "thumbnail_archive_path": "screenshots/thumbnail_110841.png", "timestamp": "00:01:50.841", "type": "screenshot", "version": 1 } ], "type": "summary", "version": 1, "vm_and_analyzer_details": { "adobe_acrobat_reader_version": "not_installed", "analyzer_build_date": "2017-12-08 12:07", "analyzer_version": "2.2.0", "chrome_version": "58.0.3029.110", "firefox_version": "53.0.3", "flash_version": "25.0.0.148", "internet_explorer_version": "11.0.10240.16384", "java_version": "8.0.1310.11", "microsoft_excel_version": "not_installed", "microsoft_office_version": "not_installed", "microsoft_power_point_version": "not_installed", "microsoft_project_version": "not_installed", "microsoft_publisher_version": "not_installed", "microsoft_visio_version": "not_installed", "microsoft_word_version": "not_installed", "silverlight_version": "not_installed", "type": "vm_and_analyzer_details", "version": 1, "vm_architecture": "x86_64-bit", "vm_kernel_version": "10.0.10240.16384_(c68ee22f-dcf6-4778-95c5-4a862be16567)", "vm_name": null, "vm_os": "windows_10_threshold_1" }, "vti": { "type": "vti", "version": 1, "vti_built_in_rules_version": "2.6", "vti_rule_matches": [ { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [ { "operations": [ "write" ], "reg_key_name": "HKEY_USERS\\S-1-5-21-1462094071-1423818996-289466292-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", "type": "registry_artifact", "version": 1 } ], "type": "artifacts", "urls": [], "version": 1 }, "category": "_persistence", "category_desc": "Persistence", "operation": "_install_startup_script", "operation_desc": "Install system startup script or application", "ref_gfncalls": [ { "ref_id": "gfn_2906", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 4, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_install_startup_script_by_registry", "technique_desc": "Add \"C:\\Users\\CIiHmnxMn6Ps\\AppData\\Roaming\\Microsoft\\Amsisigd\\Chakmcat.exe\" to windows startup via registry.", "technique_path": "built_in._persistence._install_startup_script.vmray_install_startup_script_by_registry", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [ { "mutex_name": "{BB8A49DA-DE80-A5F2-C01F-F2A9F4C346ED}", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 } ], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_process", "category_desc": "Process", "operation": "_install_ipc_endpoint", "operation_desc": "Create system object", "ref_gfncalls": [ { "ref_id": "gfn_8466", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 1, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_install_ipc_endpoint", "technique_desc": "Create mutex with name \"{BB8A49DA-DE80-A5F2-C01F-F2A9F4C346ED}\".", "technique_path": "built_in._process._install_ipc_endpoint.vmray_install_ipc_endpoint", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_process", "category_desc": "Process", "operation": "_read_from_remote_process", "operation_desc": "Read from memory of another process", "ref_gfncalls": [ { "ref_id": "gfn_8545", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 4, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_read_from_remote_process", "technique_desc": "\"c:\\windows\\system32\\svchost.exe\" reads from \"c:\\windows\\explorer.exe\".", "technique_path": "built_in._process._read_from_remote_process.vmray_read_from_remote_process", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [ { "mutex_name": "{0F90C438-223E-19A7-A4B3-765D18970AE1}", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 } ], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_process", "category_desc": "Process", "operation": "_install_ipc_endpoint", "operation_desc": "Create system object", "ref_gfncalls": [ { "ref_id": "gfn_8889", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 1, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_install_ipc_endpoint", "technique_desc": "Create mutex with name \"{0F90C438-223E-19A7-A4B3-765D18970AE1}\".", "technique_path": "built_in._process._install_ipc_endpoint.vmray_install_ipc_endpoint", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [ { "mutex_name": "Local\\{14572DFD-6357-66D5-8D88-47FA113C6BCE}", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 } ], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_process", "category_desc": "Process", "operation": "_install_ipc_endpoint", "operation_desc": "Create system object", "ref_gfncalls": [ { "ref_id": "gfn_9141", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 1, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_install_ipc_endpoint", "technique_desc": "Create mutex with name \"Local\\{14572DFD-6357-66D5-8D88-47FA113C6BCE}\".", "technique_path": "built_in._process._install_ipc_endpoint.vmray_install_ipc_endpoint", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [ { "mutex_name": "Local\\{2EBE0010-B5EF-903D-AF42-B9C45396FD38}", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 } ], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_process", "category_desc": "Process", "operation": "_install_ipc_endpoint", "operation_desc": "Create system object", "ref_gfncalls": [ { "ref_id": "gfn_9151", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 1, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_install_ipc_endpoint", "technique_desc": "Create mutex with name \"Local\\{2EBE0010-B5EF-903D-AF42-B9C45396FD38}\".", "technique_path": "built_in._process._install_ipc_endpoint.vmray_install_ipc_endpoint", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [ { "mutex_name": "Local\\{CC210EB6-BBF2-DEC8-A5C0-1FF2A9F4C346}", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 } ], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_process", "category_desc": "Process", "operation": "_install_ipc_endpoint", "operation_desc": "Create system object", "ref_gfncalls": [ { "ref_id": "gfn_9153", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 1, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_install_ipc_endpoint", "technique_desc": "Create mutex with name \"Local\\{CC210EB6-BBF2-DEC8-A5C0-1FF2A9F4C346}\".", "technique_path": "built_in._process._install_ipc_endpoint.vmray_install_ipc_endpoint", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_process", "category_desc": "Process", "operation": "_read_from_remote_process", "operation_desc": "Read from memory of another process", "ref_gfncalls": [ { "ref_id": "gfn_9185", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 4, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_read_from_remote_process", "technique_desc": "\"c:\\windows\\explorer.exe\" reads from \"c:\\windows\\system32\\runtimebroker.exe\".", "technique_path": "built_in._process._read_from_remote_process.vmray_read_from_remote_process", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [ { "mutex_name": "{B3575357-76B9-5D62-1897-0AE1CCBBDEA5}", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 } ], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_process", "category_desc": "Process", "operation": "_install_ipc_endpoint", "operation_desc": "Create system object", "ref_gfncalls": [ { "ref_id": "gfn_9408", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 1, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_install_ipc_endpoint", "technique_desc": "Create mutex with name \"{B3575357-76B9-5D62-1897-0AE1CCBBDEA5}\".", "technique_path": "built_in._process._install_ipc_endpoint.vmray_install_ipc_endpoint", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [ { "ip_address": "208.67.222.222", "type": "ip_address_artifact", "version": 1 } ], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_network", "category_desc": "Network", "operation": "_request_dns", "operation_desc": "Perform DNS request", "ref_gfncalls": [ { "ref_id": "gfn_10599", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_request_dns_by_name", "technique_desc": "Resolve host name \"resolver1.opendns.com\".", "technique_path": "built_in._network._request_dns.vmray_request_dns_by_name", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [ { "mutex_name": "Nameless", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 } ], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_process", "category_desc": "Process", "operation": "_install_ipc_endpoint", "operation_desc": "Create system object", "ref_gfncalls": [ { "ref_id": "gfn_10873", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 1, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_install_ipc_endpoint", "technique_desc": "Create nameless mutex.", "technique_path": "built_in._process._install_ipc_endpoint.vmray_install_ipc_endpoint", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [ { "ip_address": "87.142.152.58", "type": "ip_address_artifact", "version": 1 } ], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_network", "category_desc": "Network", "operation": "_request_dns", "operation_desc": "Perform DNS request", "ref_gfncalls": [ { "ref_id": "gfn_11066", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_request_dns_by_name", "technique_desc": "Resolve host name \"87.142.152.58\".", "technique_path": "built_in._network._request_dns.vmray_request_dns_by_name", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_process", "category_desc": "Process", "operation": "_read_from_remote_process", "operation_desc": "Read from memory of another process", "ref_gfncalls": [ { "ref_id": "gfn_11160", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 4, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_read_from_remote_process", "technique_desc": "\"c:\\windows\\explorer.exe\" reads from \"\"C:\\Program Files\\Windows Mail\\WinMail\" OCInstallUserConfigOE\".", "technique_path": "built_in._process._read_from_remote_process.vmray_read_from_remote_process", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [ { "mutex_name": "{DB45C3D0-7EC1-C5FA-603F-92C994E3E60D}", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 } ], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_process", "category_desc": "Process", "operation": "_install_ipc_endpoint", "operation_desc": "Create system object", "ref_gfncalls": [ { "ref_id": "gfn_11375", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 1, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_install_ipc_endpoint", "technique_desc": "Create mutex with name \"{DB45C3D0-7EC1-C5FA-603F-92C994E3E60D}\".", "technique_path": "built_in._process._install_ipc_endpoint.vmray_install_ipc_endpoint", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [ { "mutex_name": "{BF4FAD76-121A-4972-1463-668D8847FA11}", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 } ], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_process", "category_desc": "Process", "operation": "_install_ipc_endpoint", "operation_desc": "Create system object", "ref_gfncalls": [ { "ref_id": "gfn_15257", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 1, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_install_ipc_endpoint", "technique_desc": "Create mutex with name \"{BF4FAD76-121A-4972-1463-668D8847FA11}\".", "technique_path": "built_in._process._install_ipc_endpoint.vmray_install_ipc_endpoint", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [ { "mutex_name": "{2B1EAAC7-8E9D-9587-F08F-A2992433F6DD}", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 } ], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_process", "category_desc": "Process", "operation": "_install_ipc_endpoint", "operation_desc": "Create system object", "ref_gfncalls": [ { "ref_id": "gfn_15556", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 1, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_install_ipc_endpoint", "technique_desc": "Create mutex with name \"{2B1EAAC7-8E9D-9587-F08F-A2992433F6DD}\".", "technique_path": "built_in._process._install_ipc_endpoint.vmray_install_ipc_endpoint", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [ { "mutex_name": "{67DC9F31-9A2E-31AD-DC8B-6EF5D0EF82F9}", "operations": [ "access" ], "type": "mutex_artifact", "version": 1 } ], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_process", "category_desc": "Process", "operation": "_install_ipc_endpoint", "operation_desc": "Create system object", "ref_gfncalls": [ { "ref_id": "gfn_16391", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 1, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_install_ipc_endpoint", "technique_desc": "Create mutex with name \"{67DC9F31-9A2E-31AD-DC8B-6EF5D0EF82F9}\".", "technique_path": "built_in._process._install_ipc_endpoint.vmray_install_ipc_endpoint", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_file_system", "category_desc": "File System", "operation": "_create_many_files", "operation_desc": "Create many files", "ref_gfncalls": [], "rule_score": 5, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_create_many_files", "technique_desc": "Create above average number of files.", "technique_path": "built_in._file_system._create_many_files.vmray_create_many_files", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_injection", "category_desc": "Injection", "operation": "_modify_memory_system", "operation_desc": "Write into memory of another process", "ref_gfncalls": [], "rule_score": 5, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_modify_memory_system", "technique_desc": "\"c:\\users\\ciihmn~1\\appdata\\roaming\\micros~1\\amsisigd\\chakmcat.exe\" modifies memory of \"c:\\windows\\system32\\svchost.exe\"", "technique_path": "built_in._injection._modify_memory_system.vmray_modify_memory_system", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_injection", "category_desc": "Injection", "operation": "_modify_memory_system", "operation_desc": "Write into memory of another process", "ref_gfncalls": [], "rule_score": 5, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_modify_memory_system", "technique_desc": "\"c:\\windows\\system32\\svchost.exe\" modifies memory of \"c:\\windows\\explorer.exe\"", "technique_path": "built_in._injection._modify_memory_system.vmray_modify_memory_system", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_injection", "category_desc": "Injection", "operation": "_modify_memory_system", "operation_desc": "Write into memory of another process", "ref_gfncalls": [], "rule_score": 5, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_modify_memory_system", "technique_desc": "\"c:\\windows\\explorer.exe\" modifies memory of \"c:\\windows\\system32\\runtimebroker.exe\"", "technique_path": "built_in._injection._modify_memory_system.vmray_modify_memory_system", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_injection", "category_desc": "Injection", "operation": "_modify_memory_system", "operation_desc": "Write into memory of another process", "ref_gfncalls": [], "rule_score": 5, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_modify_memory_system", "technique_desc": "\"c:\\windows\\explorer.exe\" modifies memory of \"c:\\program files\\windows mail\\winmail.exe\"", "technique_path": "built_in._injection._modify_memory_system.vmray_modify_memory_system", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_injection", "category_desc": "Injection", "operation": "_modify_memory_system", "operation_desc": "Write into memory of another process", "ref_gfncalls": [], "rule_score": 5, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_modify_memory_system", "technique_desc": "\"c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\amsisigd\\chakmcat.exe\" modifies memory of \"c:\\windows\\system32\\svchost.exe\"", "technique_path": "built_in._injection._modify_memory_system.vmray_modify_memory_system", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_injection", "category_desc": "Injection", "operation": "_modify_control_flow_system", "operation_desc": "Modify control flow of another process", "ref_gfncalls": [], "rule_score": 5, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_modify_control_flow_system", "technique_desc": "\"c:\\users\\ciihmn~1\\appdata\\roaming\\micros~1\\amsisigd\\chakmcat.exe\" alters context of \"c:\\windows\\system32\\svchost.exe\"", "technique_path": "built_in._injection._modify_control_flow_system.vmray_modify_control_flow_system", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_injection", "category_desc": "Injection", "operation": "_modify_control_flow_system", "operation_desc": "Modify control flow of another process", "ref_gfncalls": [], "rule_score": 5, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_modify_control_flow_system", "technique_desc": "\"c:\\windows\\system32\\svchost.exe\" alters context of \"c:\\windows\\explorer.exe\"", "technique_path": "built_in._injection._modify_control_flow_system.vmray_modify_control_flow_system", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_injection", "category_desc": "Injection", "operation": "_modify_control_flow_system", "operation_desc": "Modify control flow of another process", "ref_gfncalls": [], "rule_score": 5, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_modify_control_flow_system", "technique_desc": "\"c:\\windows\\explorer.exe\" alters context of \"c:\\windows\\system32\\runtimebroker.exe\"", "technique_path": "built_in._injection._modify_control_flow_system.vmray_modify_control_flow_system", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_injection", "category_desc": "Injection", "operation": "_modify_control_flow_system", "operation_desc": "Modify control flow of another process", "ref_gfncalls": [], "rule_score": 5, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_modify_control_flow_system", "technique_desc": "\"c:\\windows\\explorer.exe\" alters context of \"c:\\program files\\windows mail\\winmail.exe\"", "technique_path": "built_in._injection._modify_control_flow_system.vmray_modify_control_flow_system", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_injection", "category_desc": "Injection", "operation": "_modify_control_flow_system", "operation_desc": "Modify control flow of another process", "ref_gfncalls": [], "rule_score": 5, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_modify_control_flow_system", "technique_desc": "\"c:\\users\\ciihmnxmn6ps\\appdata\\roaming\\microsoft\\amsisigd\\chakmcat.exe\" alters context of \"c:\\windows\\system32\\svchost.exe\"", "technique_path": "built_in._injection._modify_control_flow_system.vmray_modify_control_flow_system", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_injection", "category_desc": "Injection", "operation": "_modify_control_flow_system", "operation_desc": "Modify control flow of another process", "ref_gfncalls": [], "rule_score": 5, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_create_remote_thread_system", "technique_desc": "\"c:\\windows\\system32\\svchost.exe\" creates thread in \"c:\\windows\\explorer.exe\"", "technique_path": "built_in._injection._modify_control_flow_system.vmray_create_remote_thread_system", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_injection", "category_desc": "Injection", "operation": "_modify_control_flow_system", "operation_desc": "Modify control flow of another process", "ref_gfncalls": [], "rule_score": 5, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_create_remote_thread_system", "technique_desc": "\"c:\\windows\\explorer.exe\" creates thread in \"c:\\windows\\system32\\runtimebroker.exe\"", "technique_path": "built_in._injection._modify_control_flow_system.vmray_create_remote_thread_system", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_network", "category_desc": "Network", "operation": "_connect", "operation_desc": "Connect to remote host", "ref_gfncalls": [ { "ref_id": "gfn_11765", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 1, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_tcp_out_connection", "technique_desc": "Outgoing TCP connection to host \"193.23.244.244:443\".", "technique_path": "built_in._network._connect.vmray_tcp_out_connection", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_network", "category_desc": "Network", "operation": "_reputation_url_lookup", "operation_desc": "Reputation URL lookup", "ref_gfncalls": [], "rule_score": 4, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_reputation_url_malicious", "technique_desc": "URL \"https://www.apapernotion.com/wp-includes/Text/ri.php\" is known as malicious URL.", "technique_path": "built_in._network._reputation_url_lookup.vmray_reputation_url_malicious", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_network", "category_desc": "Network", "operation": "_reputation_url_lookup", "operation_desc": "Reputation URL lookup", "ref_gfncalls": [], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_reputation_url_suspicious", "technique_desc": "URL \"titanliquor.ca/images/A/2.tif\" is known as suspicious URL.", "technique_path": "built_in._network._reputation_url_lookup.vmray_reputation_url_suspicious", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_network", "category_desc": "Network", "operation": "_download_data", "operation_desc": "Download data", "ref_gfncalls": [], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_download_data_http_request", "technique_desc": "URL \"https://www.apapernotion.com/wp-includes/Text/ri.php\".", "technique_path": "built_in._network._download_data.vmray_download_data_http_request", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_network", "category_desc": "Network", "operation": "_download_data", "operation_desc": "Download data", "ref_gfncalls": [], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_download_data_http_request", "technique_desc": "URL \"titanliquor.ca/images/A/2.tif\".", "technique_path": "built_in._network._download_data.vmray_download_data_http_request", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [ { "operations": [ "get" ], "type": "url_artifact", "url": "https://www.atdrrtd.vs", "version": 1 } ], "version": 1 }, "category": "_network", "category_desc": "Network", "operation": "_establish_http_connection", "operation_desc": "Connect to HTTP server", "ref_gfncalls": [ { "ref_id": "gfn_670", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "establish_http_connection", "technique_desc": "URL \"https://www.atdrrtd.vs\".", "technique_path": "built_in._network._establish_http_connection.establish_http_connection", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [ { "operations": [ "get" ], "type": "url_artifact", "url": "https://wsfxvers.ch/fdsffffjt.ico", "version": 1 } ], "version": 1 }, "category": "_network", "category_desc": "Network", "operation": "_establish_http_connection", "operation_desc": "Connect to HTTP server", "ref_gfncalls": [ { "ref_id": "gfn_683", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "establish_http_connection", "technique_desc": "URL \"https://wsfxvers.ch/fdsffffjt.ico\".", "technique_path": "built_in._network._establish_http_connection.establish_http_connection", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [ { "operations": [ "get" ], "type": "url_artifact", "url": "https://serfd.ch/fjgnt343.ico", "version": 1 } ], "version": 1 }, "category": "_network", "category_desc": "Network", "operation": "_establish_http_connection", "operation_desc": "Connect to HTTP server", "ref_gfncalls": [ { "ref_id": "gfn_696", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "establish_http_connection", "technique_desc": "URL \"https://serfd.ch/fjgnt343.ico\".", "technique_path": "built_in._network._establish_http_connection.establish_http_connection", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_network", "category_desc": "Network", "operation": "_install_server", "operation_desc": "Setup server that accepts incoming connections", "ref_gfncalls": [ { "ref_id": "gfn_10903", "ref_source": "glog", "ref_type": "gfncall", "type": "reference", "version": 1 } ], "rule_score": 5, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_install_tcp_server", "technique_desc": "TCP server listen on port \"0\".", "technique_path": "built_in._network._install_server.vmray_install_tcp_server", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_pe", "category_desc": "PE", "operation": "_drop_pe_file", "operation_desc": "Drop PE file", "ref_gfncalls": [], "rule_score": 2, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_drop_pe_file", "technique_desc": "Drop file \"c:\\users\\ciihmn~1\\appdata\\local\\temp\\84526935.scr\".", "technique_path": "built_in._pe._drop_pe_file.vmray_drop_pe_file", "type": "vti_rule_match", "version": 1 }, { "artifacts": { "files": [], "ips": [], "mutexes": [], "registry": [], "type": "artifacts", "urls": [], "version": 1 }, "category": "_pe", "category_desc": "PE", "operation": "_execute_dropped_pe_file", "operation_desc": "Execute dropped PE file", "ref_gfncalls": [], "rule_score": 4, "rule_type": "built_in", "rule_version": 1, "technique": "vmray_execute_dropped_pe_file", "technique_desc": "Execute dropped file \"c:\\users\\ciihmn~1\\appdata\\local\\temp\\84526935.scr\".", "technique_path": "built_in._pe._execute_dropped_pe_file.vmray_execute_dropped_pe_file", "type": "vti_rule_match", "version": 1 } ], "vti_rule_type": "Scripts", "vti_score": 100 }, "yara": { "apply_yara": true, "apply_yara_on_created_files": true, "apply_yara_on_modified_files": true, "apply_yara_on_pcap_file": true, "apply_yara_on_process_dumps": true, "apply_yara_on_sample_files": true, "match_count": 0, "matches": [], "ruleset_count": 7, "type": "yara", "version": 1 } }